Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
-
submitted
08-05-2024 14:26
General
-
Target
QHFELN.apk
-
Size
2.0MB
-
MD5
866e301e0bfda8d8bcc00f1add5cc50f
-
SHA1
6abdd8173b6049e609daf1175f7648e950760928
-
SHA256
8f323a9be85e9f1d8a8889e97d66bb683059e76c2bb3b5cbb25dd891c43b986e
-
SHA512
2830cd29104e83ba92cc15513fc938dceabe6cdb7113b70df383f5a38fb183b5c6747a714ba0594618a4e30595a442eafb7f76bed00d3c53825f3e91b45ed555
-
SSDEEP
49152:cPLlqeL9ERuMJb+qu6mlGNnavcSNbEu5Tpli:cPLZqO6naJNbE+i
Score
8/10
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.example.dat.a8andoserverx1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).