Overview

overview

10

Static

static

10

QHFELN.apk

android-9-x86

8

QHFELN.apk

android-10-x64

7

QHFELN.apk

android-11-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QHFELN.apk

  • Size

    2.0MB

  • Sample

    240508-rr4c5abb48

  • MD5

    866e301e0bfda8d8bcc00f1add5cc50f

  • SHA1

    6abdd8173b6049e609daf1175f7648e950760928

  • SHA256

    8f323a9be85e9f1d8a8889e97d66bb683059e76c2bb3b5cbb25dd891c43b986e

  • SHA512

    2830cd29104e83ba92cc15513fc938dceabe6cdb7113b70df383f5a38fb183b5c6747a714ba0594618a4e30595a442eafb7f76bed00d3c53825f3e91b45ed555

  • SSDEEP

    49152:cPLlqeL9ERuMJb+qu6mlGNnavcSNbEu5Tpli:cPLZqO6naJNbE+i

Score
10/10
888ratandroiddiscoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

Malware Config

Targets

    • Target

      QHFELN.apk

    • Size

      2.0MB

    • MD5

      866e301e0bfda8d8bcc00f1add5cc50f

    • SHA1

      6abdd8173b6049e609daf1175f7648e950760928

    • SHA256

      8f323a9be85e9f1d8a8889e97d66bb683059e76c2bb3b5cbb25dd891c43b986e

    • SHA512

      2830cd29104e83ba92cc15513fc938dceabe6cdb7113b70df383f5a38fb183b5c6747a714ba0594618a4e30595a442eafb7f76bed00d3c53825f3e91b45ed555

    • SSDEEP

      49152:cPLlqeL9ERuMJb+qu6mlGNnavcSNbEu5Tpli:cPLZqO6naJNbE+i

    Score
    8/10
    discoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Tries to add a device administrator.

      privilege_escalationimpact

    • Acquires the wake lock

    • Checks if the internet connection is available

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks