7862eae57c6555f838fd09a5b95a31a2011b992e9a2ba49e3c6b259b1c315429

Analysis

max time kernel
143s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7862eae57c6555f838fd09a5b95a31a2011b992e9a2ba49e3c6b259b1c315429.apk
Size

2.2MB
MD5

657dee0b960dd87553fbd0b9a42bd1ff
SHA1

3c05880798366354110c2dc4a413c98fb7b790ea
SHA256

7862eae57c6555f838fd09a5b95a31a2011b992e9a2ba49e3c6b259b1c315429
SHA512

946bea5e6247381d7d01472c076a74588099ce2dcc29849a857eec4f1a6c6e43a87cdaf0f96463efeaa291ddce8f9689cb1e4856471ca96b9a7c767e4d63450d
SSDEEP

49152:XFbVjluI/cyVZTCKNoux/6XLChOp3sEOlzsciayjasY4OVVrR1cZJ+oWbTrfZy+f:XFbVj3cuOK6UuLVp3+sZaQaF4OVV3Ohy

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4425	com.gellery.services

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

com.gellery.services
1⤵
- Removes its main activity from the application launcher
PID:4425

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/._AWATMGDS/wapps.apk

Filesize
886KB

MD5
ff968854472bcf235ab0213163480a81

SHA1
37ad955a2efc39a261b13be7ee40c08ba05f1a56

SHA256
0d77d0744bcfb199f492234be27864a494a8b0cbf82098292258628af302cb0f

SHA512
187d2c8e9a664d79330a60efc9c0c1bfef17fffc4fd076d1656dbbee1d481d540462786f92528986040be27bac675b71ebe4997645d448dc19c347393ccb4e93

Download Submit
/storage/emulated/0/._HAEDASET_

Filesize
150B

MD5
99f8fe9da665508c8568b226e1d0ed07

SHA1
47002c616ca032dae510b272114a2c8238225585

SHA256
fa9ff2031e1b6325a2a763cff6c17323ad5cb1b6a63c336963534f855f9c09c3

SHA512
43a48f31019475d2b0d5914799970d788f30d7ddfea5c49837d884fa681d4a88ccb74154948613cb05e7566217d2df741684e0cdf80acf0eb13d57342dbb052c

Download Submit