608b135fef91c308928b1fa4e4d59b341f18e2110dc9d81bad4335f056d957e2

Analysis

max time kernel
2318114s
max time network
131s
platform
android_x64
resource
android-x64-20230831-en
resource tags

androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
submitted
12-09-2023 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

6.2MB
MD5

ce8e042ead7aef0e32f3a991fac2a922
SHA1

ded7bd84ac7158d5288e7a51d4237ad2b9719dd4
SHA256

608b135fef91c308928b1fa4e4d59b341f18e2110dc9d81bad4335f056d957e2
SHA512

2d3b2c17851de482c2da687ae2c9d904446c916b074705e91954cf6d66853181a1c3b47c06bce1674ac93267eeb8ec5bfef27f697f0624a770705eb1d02729e3
SSDEEP

24576:z/N+TGQRXv1fRvYDgETx6o6XNLk2ck8QtNERp:zVghNlYDgCB6XJk2cki7

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

establishment.impose.screensavers

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	establishment.impose.screensavers
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	establishment.impose.screensavers
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	establishment.impose.screensavers

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

establishment.impose.screensavers

pid process

4987 establishment.impose.screensavers
Acquires the wake lock. 1 IoCs

Processes:

establishment.impose.screensavers

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock establishment.impose.screensavers
Removes a system notification. 1 IoCs
evasion

Processes:

establishment.impose.screensavers

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag establishment.impose.screensavers

pid	process
4987	establishment.impose.screensavers

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	establishment.impose.screensavers

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	establishment.impose.screensavers

establishment.impose.screensavers
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
PID:4987

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
33B

MD5
dad19748ab74eae998ec37809040b2a6

SHA1
fae6325438b64b424434eb9242b91d88bdf0cfb0

SHA256
fe833c5114d3b4eb089255d94ca554e5e688cf255b4da4f8263998d88bb89fc7

SHA512
2c8ca6468d64ceab3cfda400c79c2c31d4848e9ac87f7f64c68fe1240780f3b0b4d3690d62fecdcd19383e877b4b23bde1811ec587dc6be44c7529861bf2dd27

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
29B

MD5
b9b530e2448252311640bbecb69b796a

SHA1
215ede46fb42a68a7ae84c3019acb3019668a46c

SHA256
5a290151305de1ec4f790cd8ada8bd68c076a2c4ed497c40a519509659b65150

SHA512
5834499307946d130887067b2f837ddfef7fdfe3a7e5ed8977eb14c2dc1ab328334da35ed4c978e20b3e6b28ff30dbd12f0430f4b7c831481f339d360c260919

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
45B

MD5
899800deb4be5590d02deb23fc0126b3

SHA1
d4e18f630fd2e7363b8390c909a77224b9ff87fc

SHA256
2af7d44d0776a950389bfa49168149194da15715a8e754790a167acc8f408e87

SHA512
88976e504cc08a0a9dd1231cf85c410b350015282e4d15f0e119ef067cb0786b139f5acaafb28f638694fa09b48fe28a0a8e69a28d0d6e5c007e0b5ddfcab22c

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt

Filesize
57B

MD5
32f7ae6f6744db81be94462e6ae06bf9

SHA1
9a417d732eda218bf469a7769897949a6be01427

SHA256
3ed4f695a971d16c1dd3e4ba2776c9c07f736e8b156d70b99031266fc70f9fb7

SHA512
1d360eecd5863d767afe5c0ac249a71102516a2ada87ceb59ca8d59fc4ae15be1c7c8af3af643ce2e4ae9eaefaa0fe75296a6e9565be5823be3bab40a75085c6

Download Submit