Overview

overview

7

Static

static

6

ed2313bfeb...fb.apk

android-10-x64

7

Resubmissions

05/11/2025, 19:17

251105-xzcs2a1kbl10

05/11/2025, 19:16

251105-xy46wsbj6t10

04/11/2025, 16:03

251104-thnx7adn9t10

27/10/2025, 07:27

251027-jajcma1kek7

22/08/2025, 08:13

250822-j4vbzsdr3v7

Sharing

Copy URL Twitter E-mail

General

  • Target
    ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
  • Size 5.5MB
  • Sample250822-j4vbzsdr3v
  • SHA256 ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
androidcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Targets

    • Target
      ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
    • Size 5.5MB
    • SHA256 ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery
    behavioral1

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks