66cd4e2436ed1823d25cce080bfef847203488795d895ee1b2be95f53b1e20bc

Analysis

max time kernel
1515601s
max time network
155s
platform
android_x86
resource
android-x86-arm-20231020-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231020-enlocale:en-usos:android-9-x86system
submitted
17-08-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Grab And Go v8.8.apk
Size

11.8MB
MD5

334524cfe3d1e4659f84357b35002380
SHA1

ea32f624eb93410117eb9df6f3799864e1950b89
SHA256

66cd4e2436ed1823d25cce080bfef847203488795d895ee1b2be95f53b1e20bc
SHA512

278e2345cc44d7955b1413bb81bb9306a899d0114caa5a2bef39790d26930452fddfe885bd02c6d03ec4a09b171a3a4e5e6d7c4e8661a2415ebbf83bf2754356
SSDEEP

12288:pXSfnGOnkGHB3RK+Rk9HxxPqofA9m0ETkGYaGXBKq9x2greWeN7dkb4FdiWS+lcu:pwGOkGHe+aFnPpAITkGYrKqTreWe6c

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

round.host.finder

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	round.host.finder
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	round.host.finder

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

round.host.finder

pid process

4259 round.host.finder
Acquires the wake lock. 1 IoCs

Processes:

round.host.finder

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock round.host.finder
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

round.host.finder

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS round.host.finder
Removes a system notification. 1 IoCs
evasion

Processes:

round.host.finder

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag round.host.finder

pid	process
4259	round.host.finder

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	round.host.finder

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	round.host.finder

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	round.host.finder

round.host.finder
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4259

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
288B

MD5
49831ff179b9c80d690d1d67b124293b

SHA1
cdbf85c969e539fa212a4bb60fa3c853b8b64f38

SHA256
cde90d46a59b9473e303c0314f0d0c8904eca8dae840b9fe7727514c73b404a8

SHA512
f0e31e697648824089e944e4c193fe1ed35cdaf418a63dae0d28b0e3913fae72c644fec74c451d90a04f54c8e2fac483fc02f3c4475c6466b480540f63ef5b44

Download Submit