98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb

Analysis

max time kernel
2264686s
max time network
153s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
12-09-2023 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cc2e191eabc04b6c1d4e3f277b9d052.apk
Size

11.1MB
MD5

5cc2e191eabc04b6c1d4e3f277b9d052
SHA1

91855aa2aacb651c7b7d8adb73d7bb4366e10c67
SHA256

98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb
SHA512

8b7e63c0015d7f6a8bc2b9d0e928f065b2586e6a08c3de067e5151bfd6b5d4692f2b0323056f4cd18ecd829a370b3e28c0c16df1fe4a362324933010d46eceeb
SSDEEP

24576:zB+zHyFbeWD1i4lC7Qy6U5XA1n9KGY+XWL9Nbd:qHyJeI1BSQylXAmpp

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

satisfied.lightning.complex

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	satisfied.lightning.complex

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

satisfied.lightning.complex

pid process

4843 satisfied.lightning.complex
Acquires the wake lock. 1 IoCs

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock satisfied.lightning.complex
Removes a system notification. 1 IoCs
evasion

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag satisfied.lightning.complex

pid	process
4843	satisfied.lightning.complex

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	satisfied.lightning.complex

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	satisfied.lightning.complex

satisfied.lightning.complex
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
PID:4843

getprop ro.miui.ui.version.name
2⤵
PID:4906

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
21B

MD5
7d387073b297d63997ab2390e9dabd36

SHA1
e7075ec4bf25d31e33510a9b1aad963c9e292d44

SHA256
69315b352d0cb43451ffc6956cc7f3b4065a783dc85b8edeb4d0c0549bdf0eda

SHA512
87789a6ea23b37766bf37059ce3a4f83bd05d184d226119e5c363b1bc14c2d6ec8d9e919ea2c7d85ffbd5f0bf834ba697853a9171a9b54d37f5b1b8e58d25949

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
276B

MD5
a2b1432e6f0e0eea5280083e7b27b3ec

SHA1
c4533ed959835e70d4d5ab6241e1c944f6b43190

SHA256
115d23b8d6423d345b42e3bbc2a0efcf482d71cf6f85934cd4da62ae1cbe7216

SHA512
d6a002b39fc18028d8c62c7b0000ccbb472ce7d27e00f1b74d11061e646a3650035af628c25c83b1948beee35f4fb23b83a843bab850933173f8ad0689e03075

Download Submit