122d19180834cb2ee093c7455f1e75ea4273b80eb997ffec768127f15c57633e

Resubmissions

02-02-2024 14:58

240202-scl1zaggb6 10

02-02-2024 14:55

240202-salx7aahep 10

Analysis

max time kernel
149s
max time network
155s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
02-02-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

833KB
MD5

81aa3135c5f97fbd4509cbb1176b2ae3
SHA1

504c08f10a522c2f0b3e14ff2b154bb5a8a0a698
SHA256

122d19180834cb2ee093c7455f1e75ea4273b80eb997ffec768127f15c57633e
SHA512

2213d8ec5c7b9ba9fa5a862f287884cb107f18763f9bb79670eed570ee1d3e13922ef1cc7ca28c22869601fe12dfe432f5f0c2a06a4dc018384a8e71d4a58529
SSDEEP

12288:c2irslMFHAiHDrPOk46o+688+LaD26C9XgqRCIlNE8Z6GvhZH:cjrsl0AiHPOk8+69WaDnG5Zb

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

yps.eton.application

pid process

4195 yps.eton.application
Requests enabling of the accessibility settings. 1 IoCs

Processes:

yps.eton.application

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS yps.eton.application
Tries to add a device administrator. 1 IoCs

Processes:

yps.eton.application

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN yps.eton.application
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 4.tcp.eu.ngrok.io
241 4.tcp.eu.ngrok.io
506 4.tcp.eu.ngrok.io

pid	process
4195	yps.eton.application

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	yps.eton.application

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	yps.eton.application

flow	ioc
4	4.tcp.eu.ngrok.io
241	4.tcp.eu.ngrok.io
506	4.tcp.eu.ngrok.io

yps.eton.application
1⤵
- Removes its main activity from the application launcher
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4195

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
178B

MD5
992d10fb031ec05db49d3d597c0ca611

SHA1
f1a9ba3ba63e7200bbd46e1ddc26e11e8ddaf96a

SHA256
aa874cfb6bc0c9c1bd37068e8a317e05759dbf9b299d930e3360cfe1e8b3bc5b

SHA512
71a761a7ee2f003a46a1546369b603752dbcf2a9cf6af012d0e568248227eb9d44f69b41ea8b58c23b94f06e4cbb8e69cd160c4fd3326aae65f4b47c6e4a7a1e

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
183B

MD5
e4018d5594193e768992f989edcfa722

SHA1
abc02084d574846bcb7d2594cb47446a7b1134e0

SHA256
7fbb8f420739ad7197cc4a7b7cc9c29edab3b32019686db1fbfa5efc4cbc5eab

SHA512
170145ff2f4b1faefbd4bfdc269b2725da54648ef00ce2582e2c1fb9761a86b6da5b9311e94a424d60dbfab6b433e6b1e51954af19246b013118dff7cd304852

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
161B

MD5
3a8f956b8f61eaaaf05fdc07eba16894

SHA1
1043f7b7facd7f3c8fa09740f37d7ca0ea3509e3

SHA256
f602418aeb4fca4866928b753d7d9c728139d0ddda662587fc548859b8b7d5ad

SHA512
c953fe1782dce57ec16f872a152df54af651211bea15997fd1388f767bf139d39e650b444d20dbd1a4eb7d247a4494d5f87f35d271bd84175554e973ccb7beb3

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
161B

MD5
85f8e3fb0fa5d0d5aa8227fffcc61ffd

SHA1
e4efc42595a8a5ddad464479a152eb8502716b2b

SHA256
a4ed00e9fa8b72490c106ac5aa328bf8ed7bf9995c851268dd81f047bf7feccb

SHA512
22982722e6d24f2d043234a488da3ff771a39392cbd83a4e7a913352d6d90c356d2dde36428078d5ba9d172b357c5c164283ab96b723c1e24129a7dc374103ab

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
324B

MD5
e9b2c4ed6769112e9369c60f76e3cd57

SHA1
aeb5ee3318c9fbfb01a8d580ef3092933ea2ba42

SHA256
a8760a25bd6ff0d5a5c28e62b0828eb7a2cae33392ae5931355ae9c92e418baa

SHA512
f56fa67d8faef2c99588e2a0290776836e0ef5854f242ad3824a199ef6fc74d573ee53e0f030776bbd4fa57d9d9deba0f1362407f321c1982e715961de23f716

Download Submit