108b71d36154f83703bbbb2d41af7c8bdfab3cb0db2356ef55cd5ccb7cdc4256

Analysis

max time kernel
2250478s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
11-09-2023 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

1.9MB
MD5

44c8af4ca4f31c2046369b1358bfad3c
SHA1

44506f784503bd5c7ac56771ed732a6f05269853
SHA256

108b71d36154f83703bbbb2d41af7c8bdfab3cb0db2356ef55cd5ccb7cdc4256
SHA512

9535c2e65805b0aedf54e9648dea048929c6c332cf8a6d8eb73e3b423f775e9e484d454b71042dbad67d23bd369aacd3e8786e210d5548d75eba02bd5c39fc30
SSDEEP

12288:ZUr3WuwmWrrFj2NGMDdwT9YbTZcQyuh4+8fnjL0:6r3Wuwm4rFj2fwT9wTZcQU+6jL0

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

incorporated.messaging.jan

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	incorporated.messaging.jan

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

incorporated.messaging.jan

pid process

4524 incorporated.messaging.jan
Acquires the wake lock. 1 IoCs

Processes:

incorporated.messaging.jan

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock incorporated.messaging.jan
Removes a system notification. 1 IoCs
evasion

Processes:

incorporated.messaging.jan

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag incorporated.messaging.jan

pid	process
4524	incorporated.messaging.jan

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	incorporated.messaging.jan

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	incorporated.messaging.jan

incorporated.messaging.jan
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
PID:4524

incorporated.messaging.jan:remote
1⤵
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt
Filesize
25B

MD5
a9148d406d2aa27774f728eac988cdd3

SHA1
68c1e93debcda4b97e06720a3b93a434e0f0c4e5

SHA256
bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38

SHA512
f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt
Filesize
37B

MD5
8ff31bd87f525742d1693a62d99dd4d6

SHA1
41eb9344509dc310898211a6ca6a2d32ce42923e

SHA256
4083c1d7859c738c9ac2d623a97f3a5abee21df619cdd78da2690793b60bedca

SHA512
2978ac96f893e3a465406e22a2f6ca89c78ca212f691f868f751c3ce5d2bcc3b975f28dadeb86bf2bf9e8c7332c7481a9734e6a9bdd36d474250313ee7fc90e7

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt
Filesize
57B

MD5
a9ec0c42a43c72d73c499e5c17ccbb8b

SHA1
731652fbfe61eac3fdb4b9d3e2eaa010848a0906

SHA256
6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b

SHA512
5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt
Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt
Filesize
284B

MD5
666ace324b4b100e5aae320572280b49

SHA1
09b02334d471cd2b61d5dc37ada4d54c3f0a51f6

SHA256
18024c86c46a979305b10da6933cca8ed5b80338f97f743b3a18ec24cb4fb835

SHA512
a5f985a32bdaa87177c1d8ae444142eed17d7c09b3c3d497d54d94c5b2d223ba46adfce0e3ac11404f7ffc2abe547b4284b4f6f94b54865a0645e08c7259a1db

Download Submit