8304a6d1410629d7bc79b78f7f719530be0be764a4e0527bb3a3cf456ce2036a

Analysis

max time kernel
143s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8304a6d1410629d7bc79b78f7f719530be0be764a4e0527bb3a3cf456ce2036a.apk
Size

2.8MB
MD5

8d431067dbe336fe4216a1114d737506
SHA1

65e85c04fc7e6fd7906caa52afe9997d6f084c7a
SHA256

8304a6d1410629d7bc79b78f7f719530be0be764a4e0527bb3a3cf456ce2036a
SHA512

f7d69cf787cabd4241a7abc852ba3eec72c39bb03d913453cee0c3e0f9161e102713d52833b6e76a82876f627416a932cee8fc2cd71b359e88c30aefcfb2de6e
SSDEEP

49152:Om0L4bTrsZy+YqUaA4HM2C6i3/HW8a0MVEPxTvjJyI8SCS8+G/yS3jrhaZAFzYJB:kZy+YqUaA4HM2C6i3+nhMjJyIkS4BaZj

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4166	com.android.player

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

com.android.player
1⤵
- Removes its main activity from the application launcher
PID:4166

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/._ASTMGDS/myappes.apk

Filesize
1.4MB

MD5
1096ebb936270e8877402a0c7f2eae36

SHA1
e2ba20fd033b778725e25d662554573fd39f0344

SHA256
4ce9fee0295cbb745c37e0f1da085ef500159b5bd9e5ec8c986e9cce38882c50

SHA512
7ed05574747d3ec3ad145cb61bfd48b0781ae0f1439ad25e3097ae9d25cf38bd4af8d316be56e02015ee9b44391a234a84bd3f2269e4b1b7e5ed1071b7e1ed5e

Download Submit
/storage/emulated/0/._HAEDASET_

Filesize
150B

MD5
99f8fe9da665508c8568b226e1d0ed07

SHA1
47002c616ca032dae510b272114a2c8238225585

SHA256
fa9ff2031e1b6325a2a763cff6c17323ad5cb1b6a63c336963534f855f9c09c3

SHA512
43a48f31019475d2b0d5914799970d788f30d7ddfea5c49837d884fa681d4a88ccb74154948613cb05e7566217d2df741684e0cdf80acf0eb13d57342dbb052c

Download Submit