fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1

Resubmissions

12-05-2024 18:25

240512-w245madb48 10

15-02-2024 22:23

240215-2azcysac4w 10

Analysis

max time kernel
115s
max time network
115s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
12-05-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1.apk
Size

533KB
MD5

9f01767647e2e72f446d374bbcb20c53
SHA1

f6b1adcd7723b525418a05bcede5c671366d7ab3
SHA256

fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
SHA512

4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
SSDEEP

12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ

Score

8^/10

collection evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.elite

pid process

4232 com.elite
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

Contact List
T1636.003

Processes:

com.elite

description ioc process

URI accessed for read content://com.android.contacts/data/phones com.elite
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

com.elite

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN com.elite

pid	process
4232	com.elite

description	ioc	process
URI accessed for read	content://com.android.contacts/data/phones	com.elite

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.elite

com.elite
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Tries to add a device administrator.
PID:4232

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads