772c84379e3052b184041befcb20a1454b61a7fffb1cfaeb864bf68cb684d67e

Resubmissions

01-11-2023 01:32

231101-bye14sgf6y 10

Analysis

max time kernel
2290468s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
01-11-2023 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Grab And GO v1.73.apk
Size

7.9MB
MD5

ac34306769579abd4e586879c10cba4f
SHA1

de091cd542c59ea8fb663aaa74c5605055c8abfc
SHA256

5643dc5315cced7c71ddd3451763cefb829d786246d3cb2bfbed2d4ddb39bcf8
SHA512

82fb1148173cfcbae669cae3fdc9266d5322b792e7ae80bc04fe0eafd521d8e085e959f29f3c746ea767a6f84d6106db33ed7faa4a9cc75f38314043e6facf02
SSDEEP

12288:DNe5uBN2jzdpR/v+2I2uHq++JKDG2cnYzQeBol+GbDrbBOalGpJ2lkU9qzYCEg:6uuzdpR/I2yq+aKDG2yYz/SfXB4cCEg

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

glasses.sexo.wow

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	glasses.sexo.wow
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	glasses.sexo.wow

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

glasses.sexo.wow

pid process

4271 glasses.sexo.wow
Acquires the wake lock. 1 IoCs

Processes:

glasses.sexo.wow

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock glasses.sexo.wow
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

glasses.sexo.wow

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS glasses.sexo.wow
Removes a system notification. 1 IoCs
evasion

Processes:

glasses.sexo.wow

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag glasses.sexo.wow

pid	process
4271	glasses.sexo.wow

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	glasses.sexo.wow

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	glasses.sexo.wow

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	glasses.sexo.wow

glasses.sexo.wow
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4271

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txt
Filesize
37B

MD5
fcc732da81309213510bf5124aa19aae

SHA1
fb555d66bb100814544f7be8e0188bd5bac00b5a

SHA256
a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae

SHA512
67e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txt
Filesize
37B

MD5
fcc732da81309213510bf5124aa19aae

SHA1
fb555d66bb100814544f7be8e0188bd5bac00b5a

SHA256
a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae

SHA512
67e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txt
Filesize
37B

MD5
fcc732da81309213510bf5124aa19aae

SHA1
fb555d66bb100814544f7be8e0188bd5bac00b5a

SHA256
a21d70b4c6433cb16b162d10d269a686db2c73b8092c857adb651723eb1079ae

SHA512
67e8bb420057bfe7b25d47fd11ca799e1569464c7db15ba1e5d697b4b41f2bee4bde2b3da912ad52f3bcb1d3578a904176d0b12f7d5cf70ed79bb11e0ef37beb

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-01.txt
Filesize
288B

MD5
0256a7751621ce12a6583fac0bde8575

SHA1
053582a7eb6997849cb13495491c636970fe4334

SHA256
74a39e0e492c8fed2efe2f17e835e52dbb92c926b28f8d03af49839d96de8f4f

SHA512
74bbc1d76c40f810a63bcc203e763ac6cb1cb5aebc33731825aed165b9cb2af82415b1a92dfb4835fdecb4948926baf5ce653db6538ac54a1f987f5bb99d0b64

Download Submit