66cd4e2436ed1823d25cce080bfef847203488795d895ee1b2be95f53b1e20bc

Analysis

max time kernel
1515619s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20231020-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231020-enlocale:en-usos:android-11-x64system
submitted
17-08-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Grab And Go v8.8.apk
Size

11.8MB
MD5

334524cfe3d1e4659f84357b35002380
SHA1

ea32f624eb93410117eb9df6f3799864e1950b89
SHA256

66cd4e2436ed1823d25cce080bfef847203488795d895ee1b2be95f53b1e20bc
SHA512

278e2345cc44d7955b1413bb81bb9306a899d0114caa5a2bef39790d26930452fddfe885bd02c6d03ec4a09b171a3a4e5e6d7c4e8661a2415ebbf83bf2754356
SSDEEP

12288:pXSfnGOnkGHB3RK+Rk9HxxPqofA9m0ETkGYaGXBKq9x2greWeN7dkb4FdiWS+lcu:pwGOkGHe+aFnPpAITkGYrKqTreWe6c

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

round.host.finder

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	round.host.finder
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	round.host.finder

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

round.host.finder

pid process

4522 round.host.finder
Acquires the wake lock. 1 IoCs

Processes:

round.host.finder

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock round.host.finder
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

round.host.finder

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS round.host.finder
Removes a system notification. 1 IoCs
evasion

Processes:

round.host.finder

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag round.host.finder

pid	process
4522	round.host.finder

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	round.host.finder

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	round.host.finder

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	round.host.finder

round.host.finder
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4522

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
33B

MD5
6578d215286cef5c2a0fc24109885903

SHA1
cccee1f14932405483629b3f30ce01a272d3848c

SHA256
47035bdf8519af0896bfb1687615a2f2bd458dedc92ae6845b3b537317182fba

SHA512
38bfbbc321658eb7c8c03f4dd20af1258556691ef5d89cf250c886e11c0aa201600dad3a85ff2832c2a0df59fcc8bbf351606744c46a2568830b5c2ae58f8b4b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-23.txt
Filesize
288B

MD5
18e15a23119d00c29c32325326bf34df

SHA1
b4b849d4dc7920aaa83908637df15a88264bd3bd

SHA256
8a8fa460e9c537a64b7b6f8550439224a92fd4a0aff92a47d4c55b9979aa2072

SHA512
e3b146dac7a5a457b8d0ec895e8ba702533fca76efc2f9455d4bef08204d6bad47c15a657eec3583ec0fc61fa9402f4372ae7aedfa6db7af3751d5ed738dcd47

Download Submit