a3c483f20a5a70ff6e7c9c8b8d0476e4d6a6ff3a77179e136169b58aedfb31be

Analysis

max time kernel
143s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3c483f20a5a70ff6e7c9c8b8d0476e4d6a6ff3a77179e136169b58aedfb31be.apk
Size

25.6MB
MD5

8aefe01233306ef5fb12917a1eb417b8
SHA1

52fa814539a18680b824a69111f5308061d02884
SHA256

a3c483f20a5a70ff6e7c9c8b8d0476e4d6a6ff3a77179e136169b58aedfb31be
SHA512

46293742c0294011a44b307feab1e12159ad8134a1f18d8fe78f55e9e9d1287aa28de331572f19a9114c10d8f6c46c66a3d3c40cf5ef802f0aa26b3f9f871420
SSDEEP

393216:bMQoGKBUVJ0JgavYyDGMvxKWExBbZwtHkK+A+pVLFX9VOg+w+0dpJGbwVVojBpgC:bMQontJgpY3ibKBkU+x7HVostfD4

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4230	com.android.player

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

com.android.player
1⤵
- Removes its main activity from the application launcher
PID:4230

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/._ABDMGDS/meippes.apk

Filesize
24.3MB

MD5
9b196bad17fe6bf0290c3ff64bf4822e

SHA1
c7a557fdf8572695cf37d6c33fd008154d358c1c

SHA256
724201792c37c8728f14899e93b9ceaa9f8be85e932e817779920bf1e8ac5454

SHA512
b3a7dda2ecb3ffb4f82442fca91c07d03615040b56d515d6988ebaf03287a073be4b07b0faf867b8a4e6f6d8992889a744b51d890d091569c9a766204714c169

Download Submit
/storage/emulated/0/._HRADASEA_

Filesize
150B

MD5
99f8fe9da665508c8568b226e1d0ed07

SHA1
47002c616ca032dae510b272114a2c8238225585

SHA256
fa9ff2031e1b6325a2a763cff6c17323ad5cb1b6a63c336963534f855f9c09c3

SHA512
43a48f31019475d2b0d5914799970d788f30d7ddfea5c49837d884fa681d4a88ccb74154948613cb05e7566217d2df741684e0cdf80acf0eb13d57342dbb052c

Download Submit