969ec0828fa2e80ba7dee9458932fa895eff6f20e629d6a576920e6f038ed2c1

Resubmissions

29-11-2023 15:37

231129-s2f61she21 10

29-11-2023 09:40

231129-lm8t6afd9v 10

Analysis

max time kernel
465281s
max time network
159s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
29-11-2023 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1st Mall v8.8.apk
Size

20.8MB
MD5

9ad5aac3f171ff14172b19a73eeced34
SHA1

75508a751b36de5ca9d9648e2b88cc0167f452a6
SHA256

969ec0828fa2e80ba7dee9458932fa895eff6f20e629d6a576920e6f038ed2c1
SHA512

213438da9c57b0418737a5c7d504910aea5992a7aa629420ee5bbb5668903b8f7536b4505f1732ba9b7d269d4952b451a25abb13fed8a25b3d634e201a5fbff1
SSDEEP

49152:06jjgiKHUw7hPdlovtdIP5neIr9we1SCuhHmErDem:Bg1HUw3loFixGFem

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

telescope.essays.precision

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	telescope.essays.precision
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	telescope.essays.precision

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

telescope.essays.precision

pid process

5049 telescope.essays.precision
Acquires the wake lock. 1 IoCs

Processes:

telescope.essays.precision

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock telescope.essays.precision
Removes a system notification. 1 IoCs
evasion

Processes:

telescope.essays.precision

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag telescope.essays.precision

pid	process
5049	telescope.essays.precision

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	telescope.essays.precision

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	telescope.essays.precision

telescope.essays.precision
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
PID:5049

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-2023-11-29.txt
Filesize
29B

MD5
8398f9685db92ef32b358d39b8df1047

SHA1
a1531e795775c3ea86a5e007e7e2df5aa025567f

SHA256
ec95da19463ef809a63980f82489be34710e889f23f7adf06707ec698eeb4dde

SHA512
ea8c4142a67d70cc234c50059f6dd597d9505d6f57749ac0ed04e5f342eeb028232c60ee33974373e1d63f82dc5b264cc55a00126380a972f14c49855efad1a7

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-29.txt
Filesize
29B

MD5
8398f9685db92ef32b358d39b8df1047

SHA1
a1531e795775c3ea86a5e007e7e2df5aa025567f

SHA256
ec95da19463ef809a63980f82489be34710e889f23f7adf06707ec698eeb4dde

SHA512
ea8c4142a67d70cc234c50059f6dd597d9505d6f57749ac0ed04e5f342eeb028232c60ee33974373e1d63f82dc5b264cc55a00126380a972f14c49855efad1a7

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-29.txt
Filesize
29B

MD5
8398f9685db92ef32b358d39b8df1047

SHA1
a1531e795775c3ea86a5e007e7e2df5aa025567f

SHA256
ec95da19463ef809a63980f82489be34710e889f23f7adf06707ec698eeb4dde

SHA512
ea8c4142a67d70cc234c50059f6dd597d9505d6f57749ac0ed04e5f342eeb028232c60ee33974373e1d63f82dc5b264cc55a00126380a972f14c49855efad1a7

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-29.txt
Filesize
25B

MD5
ba30336bf53d54ed3c0ea69dd545de8c

SHA1
ce99c6724c75b93b7448e2d9fac16ca702a5711f

SHA256
2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af

SHA512
eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2023-11-29.txt
Filesize
284B

MD5
722d2045c8214d2fb736fa9cd22506eb

SHA1
cab05ab913e315a928eed0e4f099949d7b0bf7f7

SHA256
5f66ada84556bd0dcf90bf244d3df64c9542155a08180204ede90f2606fac4f4

SHA512
eea93b8ed06d13e20a58375b709acff58a5e7883c7ba4ba1d24dc2c185ba40acec73c42b0ab8ebebf9f5445290197c8a3239125f6e5f7750166f91c39178a8aa

Download Submit