a9e003cb0b5f5631130e8a9aa71cb9df1d6896931bdbba7e9c3999f59a681b88

General

Target
payload.apk
Size 4.7MB
Sample261006-e9qtjach68
SHA256 a9e003cb0b5f5631130e8a9aa71cb9df1d6896931bdbba7e9c3999f59a681b88
MD5 7793610d262cb261446fadad771721de
SHA1 050c67662858d4a297e507813c72b02084d238d1
SHA512 a61d12b616710f803135c12f9c49462019f058bff61ed0644ed25f74074e25174e06c556394224f6676a6e81a422991f38060d1b5e97fdb5d1f002a8d95de789
SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdnjYw3tTptYVgi5zAKy63dC:puylKSa7VZ1IF41f1xLSV5JFY
TLSH
T14E362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A898763C68372C44F4A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.eni.a11y

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eni.a11y

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eni.a11y

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.eni.a11y

com.eni.a11y
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:3259

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3259.tmp

Path /data/data/com.eni.a11y/cache/oat_primary/x86_64/base.3259.tmp
Size 423KB
SHA256 74ee8105d25737bd2c85c944098d8d518f912e5874b03b9096f4e519a032ea51
MD5 305065dcad98fe5fe738b68438cc7382
SHA1 d10c13197a5c8235f826bbca7d771b2b0cc8169d
SHA512 e1ca202cf076eecd5e34ccc1146e6eb10109d0dee71df510036f3dc47598103ffb9580a2a88c136d29b0d697feaf04fb4fe9367b226b995fcc3c1a702445bbb5
SSDEEP 6144:R5JsfsDFXtCO093K28BOoSJQQVEqGKmjirVTpxoyAcyIzcQ22naeYPO:/tX7PSJEJ/iFAcyIX2TeYP
TLSH
T135944ADFBE634111C1AEFEF79E8645F9FD29C025124B1914A4A2373EA423E14E764FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 3038b738219b7af331435990d8d5817d29464eeebbcacee37927ba82a8fa88bf
MD5 94cf244d8bfaef6cfc2445ec0f79ff1a
SHA1 5052682edfeb7771e6b193b7890da67c247845b6
SHA512 e49da4af88df22ddbf4c27fcfeb5aa9d6ffa78e5766331412d9f13061a0542560f7caa5ccdc1a33a68f72cd355d7e1b5abba1bd8cdd6f5d3a540b7b745064cc0
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 9209ece687e5e422d43f56791d914fd50392cc3ef2292ace0b3f35b5cd94b937
MD5 db98a0c0e50e59c1d9b23bb6eaa3f2b8
SHA1 29964c1baea1d443632ba978ce65d39e1bea47a0
SHA512 85a0f2a9cceda11df91a4cf4da15a657cb78fbb15788e32e7ad43aae898a31875f87dbde9d8a30cb4b1745774577e34d32762a77362f59762b7b3f22279a61e0
SSDEEP 6:K4C6VAxaC619FZdvlWlOERX4PBX4ogLugMBX4suuK+/aC6XGEl0mUXyDJZo4Ow2:KGqSjzdvloRmBEyPbP/kfOjXSJZVOw2
TLSH
T12972C259F6C00D4BC3155377F0C8C3460D2066194772C79742915935AE03F8C7960E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 e71a9cf7cec59bf6828688e5e7c8eec723c96e73d9b529ecca3c12efd2d5be05
MD5 d4083421ef82c11b242abd18329e35de
SHA1 5a00e00d48bb124a5ce7fee6f8788a556aa24e68
SHA512 4a88d3bd3eb3459805936013ed1d707f31565812915ce5057d45a7c375a338dc510eb79c9a1bc3d307d1673168c2c58bfdde74fa753eb6312d29c29d7f2ba091
SSDEEP 96:rB6+etidjnZRWzzb8/KeKcK+zSVdxKz+ZD86u0ExV:rytidjnfWzzb83zSVdK+ZD86u0ED
TLSH
T185C3038E1F992A01C19954B0E5D00FE2793E412E97A3E3D265914075AED3D21FE2ACFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 189KB
SHA256 3a3c65c7f7ac31baefdb1d7de14f6afd181ea360829ba5b7ea28b70cf2259adb
MD5 2bc694b51923b71bc2d6c81947da5bbc
SHA1 2d19a98ebae4cd4a1f84e51ce42ce22377dba2fa
SHA512 0c823581a0f9105cfbce5a784aa7bbee65cc13a9ee80e4cf295c084cc26d491440b214eda37f47900076930eeff44d31ee1bf84bffafb5c1851cd6b0524b605e
SSDEEP 48:nVJ1a5CAz8F8pXAggJ1aHZwUJ1aAdJ1ae:nVJ1a5CAzIOXAbJ1aHZRJ1aAdJ1ae
TLSH
T16314A0D7FBD1890EF35601B8FADD42F8A7B38EE40360E44185A2B2713556C27BE2E108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.wJaWVi.tmp

Path /data/misc/profiles/cur/0/com.eni.a11y/primary.prof.wJaWVi.tmp
Size 4KB
SHA256 1944a0f00c8962a40eea769b8a08a7451c45692a73c77cf4d995818d557bbe80
MD5 76dabece6a5e0ef02b7c7e2357c2211b
SHA1 a1d5f723afa7658c5acea05d8c050f311176fde5
SHA512 4a784eecc97a2a179baed3617fff16f0b4213b628bf2a8535eaf9b1b4de10d44678091cbfab00de4b9f56a26595579ef465fd8fe3f90a896ec3a6683ca6a9260
SSDEEP 96:xUxw/JGevj+ss0grqpfRLATIxx5mgIohjvci26gK7q+As:KxCJGW+wEqpJLARgDrT2i7ws
TLSH
T149A17DADE868F94AE7AA94F308D4BF4735FBE841893F9D43CBAC6390644445861DD0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads