98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb

Analysis

max time kernel
2264683s
max time network
154s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
12-09-2023 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cc2e191eabc04b6c1d4e3f277b9d052.apk
Size

11.1MB
MD5

5cc2e191eabc04b6c1d4e3f277b9d052
SHA1

91855aa2aacb651c7b7d8adb73d7bb4366e10c67
SHA256

98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb
SHA512

8b7e63c0015d7f6a8bc2b9d0e928f065b2586e6a08c3de067e5151bfd6b5d4692f2b0323056f4cd18ecd829a370b3e28c0c16df1fe4a362324933010d46eceeb
SSDEEP

24576:zB+zHyFbeWD1i4lC7Qy6U5XA1n9KGY+XWL9Nbd:qHyJeI1BSQylXAmpp

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

satisfied.lightning.complex

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	satisfied.lightning.complex

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

satisfied.lightning.complex

pid process

4178 satisfied.lightning.complex
Acquires the wake lock. 1 IoCs

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock satisfied.lightning.complex
Tries to add a device administrator. 1 IoCs

Processes:

satisfied.lightning.complex

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN satisfied.lightning.complex
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

satisfied.lightning.complex

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS satisfied.lightning.complex
Removes a system notification. 1 IoCs
evasion

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag satisfied.lightning.complex

pid	process
4178	satisfied.lightning.complex

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	satisfied.lightning.complex

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	satisfied.lightning.complex

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	satisfied.lightning.complex

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	satisfied.lightning.complex

satisfied.lightning.complex
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4178

getprop ro.miui.ui.version.name
2⤵
PID:4222

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
21B

MD5
7d387073b297d63997ab2390e9dabd36

SHA1
e7075ec4bf25d31e33510a9b1aad963c9e292d44

SHA256
69315b352d0cb43451ffc6956cc7f3b4065a783dc85b8edeb4d0c0549bdf0eda

SHA512
87789a6ea23b37766bf37059ce3a4f83bd05d184d226119e5c363b1bc14c2d6ec8d9e919ea2c7d85ffbd5f0bf834ba697853a9171a9b54d37f5b1b8e58d25949

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
276B

MD5
601a309789d96659578d1974675458de

SHA1
24cf35bd6fa56675db793710480ad8b73c3713cf

SHA256
0b42d907a556062a8d93190d8c1e018f6c8faf9356abc7a3f51189994b450166

SHA512
b4a4e152d3d5586257b74ffaf37aaaf09f164da3fe788a73a7c2a01c1e160666c9e78462cd0a7a5d9dcdd57f67c9407bf6f4791cad8df7efde4eb3067384e203

Download Submit