f13c303fbcd5a7c976b8bf2beeb7f9703bb3478720cc4c8478b5c4cfc2103bc0

General

Target
payload.apk
Size 4.7MB
Sample261006-e9qtjach68
SHA256 f13c303fbcd5a7c976b8bf2beeb7f9703bb3478720cc4c8478b5c4cfc2103bc0
MD5 84ab17d7b72f6b0b1af01258dc26d927
SHA1 f8de5515ddee69a84ac4ba408484670dc3a54aab
SHA512 bc7759a0a0cc1684a3f075f4d7ee1db04471181ef78575cc3ea1942ff0554324d28d59dac061b1b670820f7a073893c3b64a8ae8bf003b39ae2a251922ea3e1e
SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdhjYw3tTptYVgi5zAKy63kZW:puylKSa7VZ1IF41f1nLSV5JFV
TLSH
T193362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A894763C68372C44F4ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.eni.a11y

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eni.a11y

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.eni.a11y

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eni.a11y

Requests overlaying windows on top of other apps. 1 TTPs 1 IoCs

collection credential_access

GUI Input Capture

T1417.002

description	ioc	Process
Intent action	android.settings.action.MANAGE_OVERLAY_PERMISSION	com.eni.a11y

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.eni.a11y

com.eni.a11y
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests overlaying windows on top of other apps.
- Schedules tasks to execute at a specified time
PID:3219

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1629

Prevent Application Removal

1

T1629.001

Credential Access

Clipboard Data

1

T1414

Input Capture

1

T1417

GUI Input Capture

1

T1417.002

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

1

T1417

GUI Input Capture

1

T1417.002

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3219.tmp

Path /data/data/com.eni.a11y/cache/oat_primary/x86_64/base.3219.tmp
Size 423KB
SHA256 5f8973747e4f2db9d91738ab1a7edf5e801b540c951c520c17b9e231f962a45c
MD5 cc40dbaf1d00357ba714ace6716a7e46
SHA1 9db7ac6cbfbaa7af2989fae85804bdc928d86775
SHA512 a5f659f0752811913a930bc4d1f3461b3a06b44b98d3e982b2f4d159fe4067fc33322ca26aeffaa26e55a2255faac4d9ac687e8096cd032bbdb20343cc3e8e94
SSDEEP 6144:46f5IuZvrefn74Iq8VQ4VE08jDGbneryGhx7cyAdzPeZhrARmilzaz:rXgY8VSLCejAdzPe7YZa
TLSH
T161944A9FBE634011C1AEBEF79E8745F9F929C015124B1914A4F2377EA423E24E364FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 bc92999b8404b3f76b8a86b594b0c5c50418ea6a13b3919554fd7a36b00553fc
MD5 ba46561a2c084a9c26f3d33e43c35251
SHA1 1309224721e2bd9837c53a423614be9367d8254c
SHA512 c59370f1d1582fdbf374127b1a1038d140faad9ee16c7667d9a0e0e78bfb3767ae5baa8969c8c0777e0850262787dee60b91dfb2aafa994273c34073613982ed
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 64b38a6577724e26c2105b05a8c187c182263006c2a0c78e87cc33432fd93ad1
MD5 7c00babcd088a6d4c392abcd2c60bf37
SHA1 2aff80de4051bfbffe9a8a1b7c68d3b487eb0aa4
SHA512 38caf7dd608c3223991bb5ce0eb4e047e65cf1e74f40084b955e8fe2af5f0b575ec9db3da41c58d199c5659b938264847e2d6fee11c3d4120ff0fad8508d3349
SSDEEP 6:KqmEgE5zo9FZdvlWlOERX4PBX4ogLugMBX4suuK+/1E1MrOfllhOgalWOw2:K4952zdvloRmBEyPbP/+1J34vWOw2
TLSH
T129722B5453400B53C01973B3B4C9E3083D51170D5763C7AB7A510E95AC127DCE4D1E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 e0ec2b522381e13f2ead1097fc8c6cbeffc98bb1b0252a14ce4b7a5eeb265fdf
MD5 0a722e68510a8a7fe8531993fe0452d7
SHA1 a327ab61f85dcae91fd1f835bcabb238d3471246
SHA512 9a13afe8a32f4d3bafdc4a3fe9090d69bf0ac044bedd39df5f8450393b1da335eca0e21cd449ced8bf4fc7fb6d1ac167fc4913892a872e2e62c4627a92b0dd0a
SSDEEP 96:wA8P6+etidjnZRWzzb8/KeKcK+zSE6WdxKz+ZD86u0ExV:U0tidjnfWzzb83zS2dK+ZD86u0ED
TLSH
T134C3228D0F192700C0A9A4F1F5D00FA17D3E422E9793E3E1759105B5ADD2921DE2ADFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 197KB
SHA256 bd933f716dc28ae26af77d77d45742f95d9ddb2f059cad8f736cc9203c1a8dd6
MD5 1084f4f9feaadfb32b85cd930dd82b2c
SHA1 80e49eec658362e60925eb5f00e938c5a2704077
SHA512 537bdc960dc958ef2c4d98098480affad8fef0a0f81756e5617228ac0324e70d00415bc6d4659832f1678a1ebb8c417666ce486cf6fbb1f3bccd7e9214b86063
SSDEEP 384:6swJ1aPRfLfOOfajwJ1abaPwJ1ahSJ1a:n8aPdLOOfaj8abaP8ahia
TLSH
T15A149DD17BB3CE44F505B3BABC9AC6E931358E75C002466833A96F1038B206289397AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.jxpviX.tmp

Path /data/misc/profiles/cur/0/com.eni.a11y/primary.prof.jxpviX.tmp
Size 4KB
SHA256 ff5e0d6ad3f4ef72f70be055a2506d4f2acf3178edeb6b81acab8e90ea9dfb99
MD5 4e67f08a01208b37e3af993619a207f4
SHA1 37710b74036dda19fe2c356f67eeb9e78394392c
SHA512 daa839eee1897f1a607c91e8fd09928008ee7bdf7fe901731434fad85a5b4c9756de8bf6f6a5b951c2312afdaae58536022c8a3067df62c941194a3a5422469f
SSDEEP 96:lUxw/JGevjWSYKk8/9eClMS12bkSfp3kw1DBHInLNSawwpE8ASIjrLWZmhQDjS:mxCJGWWhKJ/jdWvfpPDBHitwwpE8ASCj
TLSH
T1B3A18CBF05F85DE2CBDF2EDB02642D0671D50A85A236A617296C6E5C8D0E91C1AF1C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads