1b083b1514fbbf0b1488a680a1f7f388620acbae4503ef28b3b1a5758fb97421

Analysis

max time kernel
146s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
30/03/2025, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.apk
Size

760KB
MD5

6fc9294f3dd37a2fa0fbf869e5c6df8d
SHA1

f61bbdae56f02f2ac60f607cf3e47e664e6ec219
SHA256

1b083b1514fbbf0b1488a680a1f7f388620acbae4503ef28b3b1a5758fb97421
SHA512

138921c008ed51a8fb35af95d021a0b356ddd93ed702b33ed6af66453446d40edd5d801d2e5e9067aef5cec7fdd724bfad68670d14dbde2e55780e413166f8e4
SSDEEP

12288:8DZoa1a8LdeCvcHovx95WmpYshXZPbGwidNpgx6:8Ca1a6eCqovx95WmD9idNpP

Score

8^/10

banker defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4783	cmf0.c3b5bm90zq.patch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cmf0.c3b5bm90zq.patch

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	cmf0.c3b5bm90zq.patch

cmf0.c3b5bm90zq.patch
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
PID:4783

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
39B

MD5
76a49363e1b7995a2ae88f9e112e5f70

SHA1
cefb6c5a1a39a4de02539a4d64cf59f044c556b8

SHA256
cd24e150fe0db3564add7cbce56c1103f9ce57842bda39aa2823eaccf891f7cf

SHA512
2f556ce2c359d34bdca2165ddfa634ec5265f6431882912363fbc3d9498ca62e55b6a1b891ab114fc1255cfd1a8b03d29942a523941d7d64ed8407c2aad85136

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
1KB

MD5
688ca5c03ee75ec6877a453521e90f7a

SHA1
eeeb86ebe75caf6c921d39788bd7897fe46ac8d9

SHA256
1541126747e4458329e8649da6bdc6a38bbed183c25caa6d260e593fd12d5791

SHA512
c4eef93a7e72bfebbcfa8505ed1e399d2d5affa3febbd5b2e3d1bb7b765236324ad72e66406b2a0ef285a8044994767c2721eccf0b48454d007e8f1c9108afaf

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
936B

MD5
a69a4a1b081f8c976f6af28f1d1498c1

SHA1
48b93a073045e301a380a2797c4ca47c4e3695b1

SHA256
1103855b4207374c3ec197e06688ef09955ce4e7395422e5d1b93b4542d7cd6a

SHA512
96d43a01f1cca446dd05b4519ab5c584c7269b5e1507283da21822581135a965fa5b43d54d9d960ca01509004575a47654b6682b65259a796ae42af470639a32

Download Submit
/storage/emulated/0/systeminformation.android.app/config30-03-2025.log

Filesize
85B

MD5
29c222c0e3e5fbbafbc2a2561b56af3a

SHA1
aa3733230fe5a3dcafae5b7a2cb3da30cb9766c5

SHA256
6d908cd1b915743513425ce6c786665276740c8572e16d14223b265e500cc097

SHA512
e6bd735b21389fabd453d078e2743dddadcc2d864960f0a15c08cf6ae717e90b5e6b937905e49175696acd698ddb5da6a60bf02e9fca88fe2419c4e1d814cf8e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads