d526f57b68b8a221a093109664cc41c5b03ca0ed8d4c2ae915414852c004535c

Analysis

max time kernel
149s
max time network
156s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
10/03/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d526f57b68b8a221a093109664cc41c5b03ca0ed8d4c2ae915414852c004535c.apk
Size

24KB
MD5

bcec5a7ec4e8c469b62368a73d550208
SHA1

c3e24a9acd61c2bad9b564e60e58c8ce12958667
SHA256

d526f57b68b8a221a093109664cc41c5b03ca0ed8d4c2ae915414852c004535c
SHA512

1eaff8a500310ae715ea8d5fcc402d773a370513dc234a95540d5e28b726d32e2a03cf050e54354bd275c200bcfa6fee8a08287284a8c0bb6da036f2037fd1c3
SSDEEP

384:tflll543cjxr/1kMGfrcFpMUxXTIUuYGgYA8xpxxpD7o:t9l3Dx/QTc/N7/h8Fo

Score

8^/10

collection discovery evasion stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.god.voucher
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.god.voucher

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5006	com.god.voucher

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.god.voucher

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.god.voucher

com.god.voucher
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5006

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads