d5223c601db560dd767fce18f791cbe67b8cbf832039c531411041caf598137f

Resubmissions

11-09-2023 20:47

230911-zk26gsbd77 10

11-09-2023 20:47

230911-zktt4sba3s 10

Analysis

max time kernel
2248750s
max time network
608s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
11-09-2023 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

10.7MB
MD5

a486ca3f722b1cff608c2c71ce78ab13
SHA1

930affb485ed640adae66e61f8f71c00c79d9aca
SHA256

d5223c601db560dd767fce18f791cbe67b8cbf832039c531411041caf598137f
SHA512

c3f243694516a4158483e396c7c6138a27196738cfb4ff77b53aeab80b1eaf8f6e7d3f5ecb5a6825797ba295fa13af7aa575657781d8ea1ddc9e0a73e37df4e7
SSDEEP

12288:9KWDfK0+VuOD1MNuCz33NsyaGpcahVN9nunH:RDSOcyNt3NsYcAN9EH

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

disco.herald.even

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	disco.herald.even
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	disco.herald.even

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

disco.herald.even

pid process

4178 disco.herald.even
Acquires the wake lock. 1 IoCs

Processes:

disco.herald.even

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock disco.herald.even
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

disco.herald.even

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS disco.herald.even
Removes a system notification. 1 IoCs
evasion

Processes:

disco.herald.even

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag disco.herald.even

pid	process
4178	disco.herald.even

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	disco.herald.even

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	disco.herald.even

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	disco.herald.even

disco.herald.even
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4178

disco.herald.even:remote
1⤵
PID:4335

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt

Filesize
25B

MD5
a9148d406d2aa27774f728eac988cdd3

SHA1
68c1e93debcda4b97e06720a3b93a434e0f0c4e5

SHA256
bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38

SHA512
f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt

Filesize
25B

MD5
a9148d406d2aa27774f728eac988cdd3

SHA1
68c1e93debcda4b97e06720a3b93a434e0f0c4e5

SHA256
bd8740f21d0f44f343afebfd133a234fa5210d5f4f79f2d826980a4a1bf07a38

SHA512
f6f089bbf90a16061e1af9dc677451ce729fcc908218f60977862beb3f370ff69948eace2a4c995a0d65a96efc5263da307d77f514ec3a16f02133d7d9cc2215

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-11.txt

Filesize
276B

MD5
1dde337d238c503e4ee6ee91814d95b7

SHA1
e3cc019bb5aca5d735d79d10824abe646d17dab6

SHA256
eadd02fbe521487d27627522aac1fe88ef8134a9eb1dcc144bdda36ce93ee15b

SHA512
5b8082e1f6f32b2ffa11539d40caa090a5b1a757aed43fe4ed6dd1001d36ec0a1dd3fd6710baff83278f40066575b320c7d5696ed6979bea732870fdb168d0f2

Download Submit