84c2d61e083fa5f9c8118738c4c0bebc15de31d6f9cf416f9cced7aef6aecc56

Analysis

max time kernel
144s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84c2d61e083fa5f9c8118738c4c0bebc15de31d6f9cf416f9cced7aef6aecc56.apk
Size 17.0MB
Sample240410-phra4afd22
SHA256 84c2d61e083fa5f9c8118738c4c0bebc15de31d6f9cf416f9cced7aef6aecc56
MD5 2e70192831896872b504a4c4ad674505
SHA1 570396392bf74362cb28288397147d7c6c7b817e
SHA512 2d8e473f35d7e86a17dc9de2af5a0c8569922ecd7e4755ceb5e9f5ce2a4a0e7a22f8c27291365a89433a99aba070e23b2b713376312bc83ab8e59eaa0e8085f4
SSDEEP 393216:yYThy/z57aggCMoqIKW8pRdbqZlKcbc9x2H3sc5DqXOK3VLx:3k57JYWCRdbylRH3sKqeKFLx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4262	com.gellery.services

Requests dangerous framework permissions 12 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

com.gellery.services
1⤵
- Removes its main activity from the application launcher
PID:4262

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

meapps.apk

Path /storage/emulated/0/._AUATMGDS/meapps.apk
Size 17.9MB
SHA256 acb2b713c7adda968d8402f855d8203312702e0262447b206449e558f613cd90
MD5 473dfb33022a287f00cd079d7690f599
SHA1 f7854d0fb82a34386656dc3ca52cc6fc04023f3e
SHA512 b7166a9ca4b3981a0c84af5b607abd4e6134f09fc62f63a305736153909d6a1336403714cdbf902af0934ba35a456455ccfc6f333049a1a76c47ba5416c130f5
SSDEEP 393216:zqXX/nl4gjBa9vVSdE+Acsbm4+c8P7sMCv1k7dTm+dRhOHA:O/FBa998Fsuc8PX79mtHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

._HAEDASET_

Path /storage/emulated/0/._HAEDASET_
Size 150B
SHA256 fa9ff2031e1b6325a2a763cff6c17323ad5cb1b6a63c336963534f855f9c09c3
MD5 99f8fe9da665508c8568b226e1d0ed07
SHA1 47002c616ca032dae510b272114a2c8238225585
SHA512 43a48f31019475d2b0d5914799970d788f30d7ddfea5c49837d884fa681d4a88ccb74154948613cb05e7566217d2df741684e0cdf80acf0eb13d57342dbb052c
MD5 SHA1 SHA512