010a657926667e125bf1eb9775544dc038cddc242dd9bc4d71acc99d0fe2c913

Analysis

max time kernel
45s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
01/04/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

010a657926667e125bf1eb9775544dc038cddc242dd9bc4d71acc99d0fe2c913.apk
Size

2.2MB
MD5

544026ab10fa9f1aa76ce514896b2453
SHA1

657b9563234e38ed1ddd7b7f8351f3e4cd3286a6
SHA256

010a657926667e125bf1eb9775544dc038cddc242dd9bc4d71acc99d0fe2c913
SHA512

768ecbeda0b8285e8deffb0af5affb01e98050cc4e37cfb6929677dd4bcd26641dac01d89dc76e34df0f038304a0cda89dab106a0f7c44df004d21c60dbf2df6
SSDEEP

49152:Uucd2zfrsxLFbIaijjx1Il4UwoakyuSLg+YhI39u:UQzfrs3MfjDUwoligPhGs

Score

7^/10

banker collection credential_access defense_evasion discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	la.openport.yoyojaja
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	la.openport.yoyojaja
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	la.openport.yoyojaja

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	la.openport.yoyojaja

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	la.openport.yoyojaja

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	la.openport.yoyojaja

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	la.openport.yoyojaja

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	la.openport.yoyojaja

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	la.openport.yoyojaja

la.openport.yoyojaja
1⤵
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4330