19dfc7885342c68908e45221d278ebf84207f7f85c72f516d499b3e6cef24b31

Analysis

max time kernel
2869058s
max time network
314s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
07-11-2023 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ready.apk
Size

1.9MB
MD5

01119cd4e26e4e6b5259d0615bf57280
SHA1

865ad17462fe38a3825941ba6ca3a423afef962d
SHA256

19dfc7885342c68908e45221d278ebf84207f7f85c72f516d499b3e6cef24b31
SHA512

7df5a09334aef19788a4a3ef4aa76663147df7d7866a9431fd788c7f3ec7b52b7122eaa03295aa393ba5eea9f7c2644512954017b4b14206ef5c072ab6020831
SSDEEP

12288:rOLGarYjI8mxd+sB3oMkoSiOnxkSeamc8Z6hOnFHY:SLGXjI8mLTB3bNShnxki8XFHY

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

cut.support.mountains

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	cut.support.mountains
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cut.support.mountains

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

cut.support.mountains

pid process

5014 cut.support.mountains
Acquires the wake lock. 1 IoCs

Processes:

cut.support.mountains

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock cut.support.mountains
Removes a system notification. 1 IoCs
evasion

Processes:

cut.support.mountains

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag cut.support.mountains

pid	process
5014	cut.support.mountains

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	cut.support.mountains

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	cut.support.mountains

cut.support.mountains
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
PID:5014

cut.support.mountains:remote
1⤵
PID:5496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-11-07.txt

Filesize
21B

MD5
37d89fce167d71541d5aa851313125be

SHA1
8495970754dfe842721fa21c5ede2b108493f413

SHA256
c4caf68b4aee62177357d9a650d90f3d1dc475910fa277684d3335281f6011ab

SHA512
4cd3d68f742172a3a2a4eabcee9d43659f09cbaf0cfe5b50892b37f2a9c3f2c7b2e26c344c52a8c11ec6fddcb6a7a2cfc814c4d6a99e71a6efacaf38e4e2f417

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-07.txt

Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-07.txt

Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-07.txt

Filesize
33B

MD5
365f074d64faad2f0f0c7784608e5b57

SHA1
2105b80d01621cbd370bec93f73709a7b67d565b

SHA256
0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4

SHA512
d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-07.txt

Filesize
276B

MD5
0552dc1075661bd7f689ceca5c755dbc

SHA1
ba3ebc6a1f7836b1dfb7a16d1ec38334159406de

SHA256
27e99a462b57653dad08c2ac469bbd023b6b9c32d0acfdde999c5e1c8a872ebf

SHA512
265cbcf55a29d478c01a36248f93e00100d03f37630c978cadd5a45b282ae597d0845a8ba49d65b8b0ffb95378c21f42d93cd3cb28e1f69522533339535a5897

Download Submit