fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea

Analysis

max time kernel
145s
max time network
151s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
16-02-2024 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a05d21746c3544b791069914774238b0.apk
Size

1.7MB
MD5

a05d21746c3544b791069914774238b0
SHA1

b3e828208106d0148eb8f0366d3dc66701c8b164
SHA256

fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea
SHA512

4f21d957fb9ce645a3376c010d5ce2c55fc72d944690ee0339a9c647b3e2f3424889546c7ae4c0a6d0f3498fc2429acd666057e570e0a0e92c29d3c4cb98e493
SSDEEP

49152:34TNqElUb49sOxZ/6Q1sym8JeSa7WBhX/zyt:34goyUlFCy9pa6Yt

Score

8^/10

stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 IoCs

stealth trojan

Processes:

com.example.dat.a8andoserverx

pid	Process
4241	com.example.dat.a8andoserverx

Acquires the wake lock 1 IoCs

Processes:

com.example.dat.a8andoserverx

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.dat.a8andoserverx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
4	1.tcp.ngrok.io
17	1.tcp.ngrok.io
26	1.tcp.ngrok.io

com.example.dat.a8andoserverx
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
PID:4241

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads