122d19180834cb2ee093c7455f1e75ea4273b80eb997ffec768127f15c57633e

Resubmissions

02-02-2024 14:58

240202-scl1zaggb6 10

02-02-2024 14:55

240202-salx7aahep 10

Analysis

max time kernel
94s
max time network
98s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
02-02-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

833KB
MD5

81aa3135c5f97fbd4509cbb1176b2ae3
SHA1

504c08f10a522c2f0b3e14ff2b154bb5a8a0a698
SHA256

122d19180834cb2ee093c7455f1e75ea4273b80eb997ffec768127f15c57633e
SHA512

2213d8ec5c7b9ba9fa5a862f287884cb107f18763f9bb79670eed570ee1d3e13922ef1cc7ca28c22869601fe12dfe432f5f0c2a06a4dc018384a8e71d4a58529
SSDEEP

12288:c2irslMFHAiHDrPOk46o+688+LaD26C9XgqRCIlNE8Z6GvhZH:cjrsl0AiHPOk8+69WaDnG5Zb

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

yps.eton.application

pid process

4199 yps.eton.application
Requests enabling of the accessibility settings. 1 IoCs

Processes:

yps.eton.application

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS yps.eton.application
Tries to add a device administrator. 1 IoCs

Processes:

yps.eton.application

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN yps.eton.application
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 4.tcp.eu.ngrok.io
235 4.tcp.eu.ngrok.io

pid	process
4199	yps.eton.application

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	yps.eton.application

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	yps.eton.application

flow	ioc
4	4.tcp.eu.ngrok.io
235	4.tcp.eu.ngrok.io

yps.eton.application
1⤵
- Removes its main activity from the application launcher
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
PID:4199

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
150B

MD5
ff54bcdcd4d5fecfa55a7e1c865742e2

SHA1
fcd6f4dad2a73ae61ca303301b91e61bf8a44534

SHA256
7b094e8a054046286583501b7a5309337331a78b49ce97d781d9cd7a361de274

SHA512
d5d7245b1cef5dbb117b87d79209afe1c95e2c4a4705da4c20d3987c77b70555f0904347023d4b899dfd6614f43c010c4c45c3a62c3cb76b73c77fb3825858e3

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
218B

MD5
11943be52924c6fb92fac072520aa7fe

SHA1
665f7e506c9543f7b72ba2ac74ab92cd53e545a9

SHA256
425fd281aff9548c1650fb6d5d7bab16530e01a17456a84654cbf45d3a09b447

SHA512
7a467247f6d1c4e07c74414da27108f14f1275814e38c1f9ce979e3a22e00c33b727919cdb93ab28fb45962396801bb08c328a3e4097009456d7724729dc9583

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
150B

MD5
f80beae7bb271252f218a78783dc4650

SHA1
a8d5c08babfd6ea28d1a8dde3d030614548f3072

SHA256
846b7c3a0d76f3b1ea0d533c3da288e32d40151c3317e683f07fd07822569a6c

SHA512
f1de0bd36aebe09f7e8e90c3784f6382fb796173d614fc5e90c7c55eec419363717fa431db7331d201a70bde2fb8b147bc649a2657917b0f49601d3e37a219e5

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
162B

MD5
af3c252c8555f7a8b6a2e0d223020c34

SHA1
68f68737d36be46d851c27e1496f1127fef080b8

SHA256
b64e8249fc3b4fe92ad661da72ea103181e9030fd13841c53ddbd31a36a2a178

SHA512
f74aa424195f08a7be2b5ef2e1f2b84505c12b33ec1d133b7435d8333c89a6a6e24b3a718514f0b7e06f247bbc77d8e611862c8a6cb86d7d62042c129d591c75

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
159B

MD5
594f68a1045cf404ead4fdcdbf24c67d

SHA1
d81ddee4607689d09d35ffed6494f8c1151d0369

SHA256
15199dd67502a1ae1b05747aaca1d6fdc8343e5069acb534f1e9b42cc5e4a339

SHA512
51110232722fbd96aa87e78a41cf0d1ab881e12c35f781108fbf037cb83b61e7c3b5ac31f4397f3eab0ed5fc6b1e5ddf5064a89080e516319229ed4d9d080da2

Download Submit
/data/data/yps.eton.application/files/config2024-02-02.log
Filesize
161B

MD5
920622752ef7982c8a3a88fbb3b378d3

SHA1
1b19bf12c7c4f3cb818cc510aa491606b692a3b3

SHA256
095427780b9464ccadf08b358ecef72cbaaf68c50fb84bc99acbf2dc21c0be61

SHA512
acb4c1807441b61d1320dbe8b1dc380dcf15742a79538a911e65fa5d0c8adcb861e1f30f17e63f7b1b0e6fc0ff5a063933db8dc917e0e8917fdae309063eece1

Download Submit