5df569eea5cdf6829f72c63f2b58a62f9e984c8ff82046ba645d3f8751454707

Analysis

max time kernel
1832368s
max time network
159s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
07-09-2023 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2436d1e4dc60044a245ea39224e8e8c8.apk
Size

11.5MB
MD5

2436d1e4dc60044a245ea39224e8e8c8
SHA1

99cedf39ee63d7c9979259292825b9de1b171de8
SHA256

5df569eea5cdf6829f72c63f2b58a62f9e984c8ff82046ba645d3f8751454707
SHA512

d30551feb9e936e632c31e91628fd30ca3bb3fbc1aac4f0ab6bd041f2762cd37694549321fb0d90256cab75c5dab69ec783e1678d9fd4596799cf9e48b7b921b
SSDEEP

196608:1PyO4l7g1Fk2m63esNSotDKiMar17BVp+qx7W/Ct9vg4JM9PpXrZnm8Y8xZp:BKNg1FkuHDRMa7VoMsQvg8cxrRm8PxZp

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4987	package.name.suffix

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

package.name.suffix
1⤵
- Removes its main activity from the application launcher
PID:4987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/.apk.apk

Filesize
13.4MB

MD5
b36cb4e582681aab768cf2731bdb8927

SHA1
624273b16cf4eb85a497fb8513435e8310cc8c71

SHA256
2d283bed87dc74115922b5e011a8a8012dad34da76da34bb98b476989e0b8b90

SHA512
4c0ecafe3cbfd3c3a9a2b8a6ef8922c9c97b8c053f5a67e6d3758558f8861e9586ec67cfec8954128e3ba75abf485956707780851f96985637f90075540680b1

Download Submit