fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea

Analysis

max time kernel
3821855s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
27/12/2023, 03:20

Target
a05d21746c3544b791069914774238b0.apk
Size 1.7MB
Sample231227-dv548sgbc3
SHA256 fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea
MD5 a05d21746c3544b791069914774238b0
SHA1 b3e828208106d0148eb8f0366d3dc66701c8b164
SHA512 4f21d957fb9ce645a3376c010d5ce2c55fc72d944690ee0339a9c647b3e2f3424889546c7ae4c0a6d0f3498fc2429acd666057e570e0a0e92c29d3c4cb98e493
SSDEEP 49152:34TNqElUb49sOxZ/6Q1sym8JeSa7WBhX/zyt:34goyUlFCy9pa6Yt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

stealth trojan

Removes its main activity from the application launcher 1 IoCs

pid	Process
4977	com.example.dat.a8andoserverx

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.dat.a8andoserverx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

com.example.dat.a8andoserverx
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
PID:4977

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact