082cd501946faf10f82205d01bad071c1b6f4bb08e8870ccb29cbd2f9b6c2ecd

Analysis

max time kernel
2318735s
max time network
149s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
12-09-2023 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

11.1MB
MD5

4ca4f866cfba682b375b490299f8337d
SHA1

e5aab2e9c8870a5bec69832860043f80d9b7b026
SHA256

082cd501946faf10f82205d01bad071c1b6f4bb08e8870ccb29cbd2f9b6c2ecd
SHA512

652ea2d88561fb5ccd30c16eaa02fc171dd37126c93bec9ccb5e3363d821786f9340ce7374de3237f00d69a05649da7303e0a3169fa60b19e0f8f646520feb90
SSDEEP

24576:KSk55NcUO+AzCKd+Zebb01IecYYYYYYmYYJXdujakSs:KSkvNPAzC2b0ZN6l

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

jefferson.dice.means

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	jefferson.dice.means
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	jefferson.dice.means
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	jefferson.dice.means

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

jefferson.dice.means

pid process

4171 jefferson.dice.means
Acquires the wake lock. 1 IoCs

Processes:

jefferson.dice.means

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock jefferson.dice.means
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

jefferson.dice.means

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS jefferson.dice.means
Removes a system notification. 1 IoCs
evasion

Processes:

jefferson.dice.means

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag jefferson.dice.means

pid	process
4171	jefferson.dice.means

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	jefferson.dice.means

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	jefferson.dice.means

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	jefferson.dice.means

jefferson.dice.means
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4171

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
17B

MD5
e9741c8b822d66f3190e379511b05305

SHA1
5a534d9a8acf1d681cc5fcc3fe872eff02abaec2

SHA256
5cbdeb6552a33c4de8ade686f135d01418fe09d82e9cb3a7219be145c80bd152

SHA512
44db01c4a90608d23be9825e7ce24d240e1ee211e576b7b67b564b67f7737d9fcd28ed5338196bc5541592ad0284aeda4a9f4df0302f462147b127f3a1db1fc9

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
29B

MD5
c9db0aece56267f06c34e62d03659b4a

SHA1
e52a55ea4e5a0d30d70e90a5f5833a39370609d9

SHA256
d77bace5ecc67118face00462acf4fdb6724b5a1647a37b1283e8ca8d316ed80

SHA512
f8f1b07bbfe3837598288ac5935e7ad7e7ccaabbeb90b41903717a62d69a37cbbcc7a9ab63ada7b714f31a333270fd626abf40a27e26fad2a909e12a0d6468b2

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
33B

MD5
6b94bea08ec89adfe4d3881d4a0f5219

SHA1
14e92ba374ec92e9955bd8d30ab52a66f9da2e98

SHA256
b860abf383a68809b1da0742522251936f569a317c82052747f83c6ea0cd62c9

SHA512
fa33b75c4e7fadad785fe2db27dcead6ac050ad0500ec651d3deff00cffc800af7ece3e72f93d066538587a7df398f833dde8f964f5273fd6a71f79933e80568

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-09-12.txt
Filesize
57B

MD5
3af69119804d1d999d56d230338ffd36

SHA1
69350826205583c8acc385ee0a6e3fc2673ee2ca

SHA256
10994862cb263ab6b1e4428cc24cc9c585458fc67544fe0f5dfea81a5a7a115c

SHA512
4a41b19d28f637b397d9dff225621694c44c750a9bd65f3e6ad5d3b9acf0d118910ddf53d4618213f9e14c61e0fb154f33f2747dd3b8d50459990767f42fc8cb

Download Submit