5aea864b311979c78abd4f8a8d9d09ac2f85032c2d118721d9fb59f98448222c

General

Target
payload.apk
Size 4.7MB
Sample261006-e9qtjach68
SHA256 5aea864b311979c78abd4f8a8d9d09ac2f85032c2d118721d9fb59f98448222c
MD5 116d6227716be388ca7a139de90950ce
SHA1 636ad0ff11139c03798ce290514b154256dc1646
SHA512 ac48bd193ac3130bb09014a8737b909e78d23a91bb7c4fc5282bb762463b8348d347a64b9e0223f0cc564afa47bb9e75aa3f8ff4ad97a81d13ee60208aef347e
SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdFjYw3tTptYVgi5zAKy63V5p:puylKSa7VZ1IF41f1bLSV5JF9
TLSH
T1C4362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A894763C68372C44F4ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.eni.a11y

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eni.a11y

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eni.a11y

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.eni.a11y

com.eni.a11y
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:3161

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Credential Access

Clipboard Data

1

T1414

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.3161.tmp

Path /data/data/com.eni.a11y/cache/oat_primary/x86_64/base.3161.tmp
Size 423KB
SHA256 d2d4a3ca5e816d9abe1b53a5e3ec551376d17292d68e3c81ff2307209dd11a46
MD5 ad59fde8a5d42611838a59421463a453
SHA1 3fe763dc95d835989994416005cdf580a83c8593
SHA512 b0cbe89c7c44b3adcfa32469a7605009d5562bbe25f848b1a7aebca0468671ae553db665c691014ec97e6117ed0cbfd60bec86b1e1b1ddb5d294ee49b45b8d9e
SSDEEP 6144:DWC/nrhPmqLea18t6IgBMUHaQyVEsElcAPW3WBP1S0yAQTQmfbqyI8yu5Z:aCnpSa1VHa61/WtAQT7Gy5
TLSH
T16B943B9FBE634111C1AAFEF79F8745F9F929C015124B1910A4E2373EA423E24E764FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8c5aa442bd63dbe1177b2ee2474ae1e26733ee9d8888d88e82f44f3efa7287ac
MD5 467a26f792a99b2b4dd6d052587a0e9b
SHA1 36ce9c6c0a668bcc4bde11d572d61086003b4031
SHA512 ca721063116d2ceb35a948d1b2d46cc537fda61386e43295950d604cc7b07e8baf79ffc6a340c448e22b98bd0904898678f83975e0440c2dedfe4158cde48796
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 157c0cbfd72943e95e181d9e59298b3eb53d6d841b96fecd47179445c45f106d
MD5 c9744ea128d396b967e5f82ad74264de
SHA1 b3c2b0bad68962272781b05abfa718884a97fd46
SHA512 29b78086db44a4009aa73218662673eee5fb38f1ede5bfccc2e3c70394b6cc6414a314ad2c1b3ba992d2570f2a654324c5bbe2548ce9e37bc8670948c9a21116
SSDEEP 6:KvDtFklHvDMw9FZdvlWlOERX4PBX4ogLugMBX4suuK+/RDCucsiscDcmiscDJOw2:KvzklHvQ6zdvloRmBEyPbP/RVc/c9Ow2
TLSH
T12872C29593801A03C3398B374CCAE3550F711ECA0323C7470A4018527C167C8A4A0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 a08ec0ae095eb39189df251f97511dbbd5087eaa2652692aafcb5404cb4a5733
MD5 c5ab9b1cf7059871221a7f7348acd129
SHA1 e7ef02e13cd078e154b5aa0848b57a2eb68832fd
SHA512 89e161673908721da4590740751afb38f65ca7980865761c9e5ba31c4a4c8e43f4c7c2d42c51b8f4924c1e7af0627a02a50cb8b4b16a44bbec741ab4d45b40b3
SSDEEP 96:/nRGkE6+etidjnZRWzzb8/KeKcK+zSadxKz+ZD86u0ExV:ZGk1tidjnfWzzb83zSadK+ZD86u0ED
TLSH
T10BC3438E0F192600C1B994B1D8D01FF17E3E895E9793E3D169910075EDEA921DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.eni.a11y/no_backup/androidx.work.workdb-wal
Size 197KB
SHA256 b11491130a2a67a9888424de9ed4adfb3a3a3a5f0a16dffff61907031ea40a85
MD5 11b8eba882a4687a7918a4e22ad125fc
SHA1 b72fe038826d5ea83679955551292eddba9036d4
SHA512 268634a1fa794ac29de3bd788452d5267a7fa0cbcc5e377f64c58b0b777d872aeb656f290c0e728126d38c0e8ecd7d7d2902e25606bfb68a0e92de30df0f1cb6
SSDEEP 192:hoxJ1a/8d3dShatv2xJ1acPFY+xJ1a7RJ1a:hoJ1aE50LJ1aY+eJ1adJ1a
TLSH
T184149BE3B330CD97E77A56B6BF921DAC26710ED981078F0432BA275A7D372875839204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.ERoEK9.tmp

Path /data/misc/profiles/cur/0/com.eni.a11y/primary.prof.ERoEK9.tmp
Size 4KB
SHA256 cc7f79d4c0368c881704dbae0d849b2283c43b242f7537327a94822a012a8b08
MD5 d1bdc3d064d0c73305c7b7cce93dce76
SHA1 04a0cd7d2d98e74acdb28dd935a9ee8fdc6ea221
SHA512 a82712a8558e4b1df1cd41aebd5c149531355c9bfddabc84256e6b0a2bc0f416e7fe654f7c3cb2377b1a3f6b3022141e580edc70d8305fa25b7d106d28b2cb09
SSDEEP 96:hUxw/JGevjTws8knsCb6ALPd2QZA4CAIPKQEpEKaj95szsfg:6xCJGW0sJbTA4CATpvah51fg
TLSH
T192A17DDC0A62EEC8EDFF04FE09E4726223879069A6D438590F5A471D0E3912EC93846E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads