d271655cc1451a97c0a64ba45a976dd6138cc1d985a87fbd123bfebf29fbd599

Analysis

max time kernel
524947s
max time network
150s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
11-10-2023 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bffc0b6757f47fe056f45cc73b7bcd57.apk
Size

8.5MB
MD5

bffc0b6757f47fe056f45cc73b7bcd57
SHA1

5bb41f418cbb8e994fd410f4040545a428ae0c1d
SHA256

d271655cc1451a97c0a64ba45a976dd6138cc1d985a87fbd123bfebf29fbd599
SHA512

c14e1dea37fcb15ebdd0b6d4168afbb2a89981936b10f3baafdab6c2db45d82a07ca00f34d2ebe7b686a121163d95a29daf0348381c7009920269faf2e4287ed
SSDEEP

98304:RmwCr6gQKMutHoU15N63+tDTcnmz3zByTr0toZH4:4V6gQKM8IU176WT/zkUR

Score

8^/10

banker evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

host.festival.rail

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	host.festival.rail
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	host.festival.rail
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	host.festival.rail

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

host.festival.rail

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications host.festival.rail
Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

host.festival.rail

pid process

4180 host.festival.rail
Acquires the wake lock. 1 IoCs

Processes:

host.festival.rail

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock host.festival.rail
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

host.festival.rail

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS host.festival.rail
Removes a system notification. 1 IoCs
evasion

Processes:

host.festival.rail

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag host.festival.rail

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	host.festival.rail

pid	process
4180	host.festival.rail

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	host.festival.rail

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	host.festival.rail

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	host.festival.rail

host.festival.rail
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-10-11.txt

Filesize
33B

MD5
ece9c3592f4a4ed0e4026343859b67b9

SHA1
708328c68597c36b645dbb0c2e50fd3f6f58946f

SHA256
2bc4b91ae008b9eb9244419e73f1f8540704067a3107bd47b6710b5161877405

SHA512
b126a1a0ae20cc72649ec07a4cdc9203d910180ee3ea747f64a5a48235249b497d6286b252759e88d1c04317033fa3c448c1aa6e27183f34503079e1c141796d

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-11.txt

Filesize
33B

MD5
2226bbe60cfbaff11e1b07b1f717cd0a

SHA1
be2aebbdef5cc198d15bf38ef7dcd6319c852faf

SHA256
67a216a2df67b9e1ec870dd791414bfe828ea234160b412a4adc4a708051a91b

SHA512
7ae203bceea2fc2ad2778e82224a7f1b707accd417ef793c2bb980ff3538e017e9d3f85f38e76c11a4d417cbdb77445a0f19aad99404fbb5c9c49ee1d01518ce

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-11.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-11.txt

Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-10-11.txt

Filesize
288B

MD5
fd0376ef4bc6430de6c1ee23820e875a

SHA1
98615ea7f04d8cba7e9efc7ec9e62487b9c7f6cf

SHA256
55663d5baf47c1592747c832ab87b85ca53f8760d0541d44a5a9a3b09a530dfe

SHA512
a88ffbd5aabb6ae46cf1ea8fa3af2499c04ca8b3f3158870bbea83ff34ebafc988ed4784b646d653ff6b77e89466c649f70d03408f7a894b8c3ba49a9e707750

Download Submit