fd99acc504649e8e42687481abbceb71c730f0ab032357d4dc1e95a6ef8bb7ca

Analysis

max time kernel
143s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd99acc504649e8e42687481abbceb71c730f0ab032357d4dc1e95a6ef8bb7ca.apk
Size

342KB
MD5

a38e8d70855412b7ece6de603b35ad63
SHA1

92118623c417c7b9c46b99ae71424198327698a8
SHA256

fd99acc504649e8e42687481abbceb71c730f0ab032357d4dc1e95a6ef8bb7ca
SHA512

7fb48ed59df753a79a9f42750d71c5cc5aa9a6bca976b83ba72add9ddec1fb50c799b21e874d111bfb414635b1e7f6e9d388867d679a29597f0b912a105c56a4
SSDEEP

6144:HIOn1UQtZOfKr3V33gmAIAM+WubYnmNMbwy9UXKfgWUGl:HImpOfKrF33pdAgubQmNM/SuUC

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4177	com.emc.pdf

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.emc.pdf

com.emc.pdf
1⤵
- Removes its main activity from the application launcher
- Uses Crypto APIs (Might try to encrypt user data)
PID:4177

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/The China Freedom Trap.pdf

Filesize
190KB

MD5
6b29d371194faa13a94ce51fca39e25b

SHA1
c9e2d28f1f5680ac193084127cd185bfde253d1e

SHA256
10e70e0b421a6e59f1a7ceccadb8e2846881cba8692a9ca062e1a647dec1d02e

SHA512
e9132b31aa0f8327c227c75285912065f1bc687cd80a4f6121c1a90dd4bc8ec6e99170b001ec97f7498aa0c27004664ee13962ab7fd7817f9b4eab68043c21a2

Download Submit