fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea

Analysis

max time kernel
145s
max time network
153s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
16-02-2024 12:17

Target

a05d21746c3544b791069914774238b0.apk
Size

1.7MB
MD5

a05d21746c3544b791069914774238b0
SHA1

b3e828208106d0148eb8f0366d3dc66701c8b164
SHA256

fd19637e4cf7eeca5a713ad56971475e5571fa1af24afeba11cfc28b3c0d8aea
SHA512

4f21d957fb9ce645a3376c010d5ce2c55fc72d944690ee0339a9c647b3e2f3424889546c7ae4c0a6d0f3498fc2429acd666057e570e0a0e92c29d3c4cb98e493
SSDEEP

49152:34TNqElUb49sOxZ/6Q1sym8JeSa7WBhX/zyt:34goyUlFCy9pa6Yt

Score

8^/10

stealth trojan

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

com.example.dat.a8andoserverx

pid process

4992 com.example.dat.a8andoserverx
Acquires the wake lock 1 IoCs

Processes:

com.example.dat.a8andoserverx

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.example.dat.a8andoserverx
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

6 1.tcp.ngrok.io
23 1.tcp.ngrok.io
33 1.tcp.ngrok.io

pid	process
4992	com.example.dat.a8andoserverx

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.dat.a8andoserverx

com.example.dat.a8andoserverx
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
PID:4992

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact