98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb

Analysis

max time kernel
2264688s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20230831-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
submitted
12-09-2023 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cc2e191eabc04b6c1d4e3f277b9d052.apk
Size

11.1MB
MD5

5cc2e191eabc04b6c1d4e3f277b9d052
SHA1

91855aa2aacb651c7b7d8adb73d7bb4366e10c67
SHA256

98440746eb599a4cad862ded3089b9f830117e2b7ba4deaf1b521f7ed8e6c5eb
SHA512

8b7e63c0015d7f6a8bc2b9d0e928f065b2586e6a08c3de067e5151bfd6b5d4692f2b0323056f4cd18ecd829a370b3e28c0c16df1fe4a362324933010d46eceeb
SSDEEP

24576:zB+zHyFbeWD1i4lC7Qy6U5XA1n9KGY+XWL9Nbd:qHyJeI1BSQylXAmpp

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

satisfied.lightning.complex

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	satisfied.lightning.complex
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	satisfied.lightning.complex

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

satisfied.lightning.complex

pid process

4338 satisfied.lightning.complex
Acquires the wake lock. 1 IoCs

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock satisfied.lightning.complex
Tries to add a device administrator. 1 IoCs

Processes:

satisfied.lightning.complex

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN satisfied.lightning.complex
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

satisfied.lightning.complex

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS satisfied.lightning.complex
Removes a system notification. 1 IoCs
evasion

Processes:

satisfied.lightning.complex

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag satisfied.lightning.complex

pid	process
4338	satisfied.lightning.complex

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	satisfied.lightning.complex

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	satisfied.lightning.complex

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	satisfied.lightning.complex

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	satisfied.lightning.complex

satisfied.lightning.complex
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Tries to add a device administrator.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4338

getprop ro.miui.ui.version.name
2⤵
PID:4457

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
21B

MD5
7d387073b297d63997ab2390e9dabd36

SHA1
e7075ec4bf25d31e33510a9b1aad963c9e292d44

SHA256
69315b352d0cb43451ffc6956cc7f3b4065a783dc85b8edeb4d0c0549bdf0eda

SHA512
87789a6ea23b37766bf37059ce3a4f83bd05d184d226119e5c363b1bc14c2d6ec8d9e919ea2c7d85ffbd5f0bf834ba697853a9171a9b54d37f5b1b8e58d25949

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
57B

MD5
a9ec0c42a43c72d73c499e5c17ccbb8b

SHA1
731652fbfe61eac3fdb4b9d3e2eaa010848a0906

SHA256
6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b

SHA512
5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
21B

MD5
40fcf48a4ecdb632240619eb756772ce

SHA1
83706b0dcc3ff8032962dcd0d73a36ba65dd6f30

SHA256
d153cc76e9f7a12c26dbe0d197285a77fc8efeed1b1f3d35c25ba386711b5c80

SHA512
4757ed0904a24ed77c8c2dca9be96f084cebc54a93c43eb0eb27545aba7e58916abb0b639254d90ebffea1e760b85d0a0fe53ada28194734748116475dd9829b

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
276B

MD5
96c002aecdd80ca7b56c058cc1c2e8d1

SHA1
8c736329b2614315b78505f9da361d271ed3f048

SHA256
c7a9b9a3e0ffce9723e9bd01a982494ec78303bfd1279abf228203f71af98afe

SHA512
b2097157d5c05a2be5e4b60ab43bd224bdeed19a963fc581678e88d6aeaf4ba58c02de37734d013f251120ad46a850d37ca85a974ba52138272eaa0c40f7bbc0

Download Submit