db66c2f19f9daec9daee98c69c7f079851edd141255d6f36051d613d875c2a27

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
28-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db66c2f19f9daec9daee98c69c7f079851edd141255d6f36051d613d875c2a27.apk
Size

2.7MB
MD5

6596fb7acb84d2504ea745d154504774
SHA1

063a172e35877da4cd333b181a4f6250d08a9dd0
SHA256

db66c2f19f9daec9daee98c69c7f079851edd141255d6f36051d613d875c2a27
SHA512

4ac100d49dab8742c09b6e6a3797034b2bb3e59c8e78ac569fe740e8ad1eae4f6ed04f7957e87a71b0738c9e5668d8d52976a64b9d6215d6082f052489d69d77
SSDEEP

49152:NDEnq/W9aV8puallO1FdKOQI0VgZSeo/KrmH:NDEnq/c8FdKOQmo/KrmH

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.gogo.post

pid process

4613 com.gogo.post
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.gogo.post

ioc pid process

/system_ext/framework/androidx.window.sidecar.jar 4613 com.gogo.post
/system_ext/framework/androidx.window.sidecar.jar 4613 com.gogo.post
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.gogo.post

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.gogo.post

pid	process
4613	com.gogo.post

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4613	com.gogo.post
/system_ext/framework/androidx.window.sidecar.jar	4613	com.gogo.post

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.gogo.post

com.gogo.post
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4613

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gogo.post/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Filesize
8B

MD5
bc46c887a6d78e4272d47c930863008e

SHA1
49fe3501b3fc6c7d836ba6ceb1428605b53c97a9

SHA256
c26e6c644e3fb3f00542ae1be81281dcb65dfbafb748791dd0b710abcc2e25e5

SHA512
ecf3c1acfc3e67eae005277aeee334671c5fa868e56de6d9ec193aeef1dbae002b212e3ece56dc8c338f60218aa507023178cd86a80f310fb9776b026597a5f4

Download Submit
/data/misc/profiles/cur/0/com.gogo.post/primary.prof
Filesize
875B

MD5
aad30caaaf88d4ecdd2dd73056b5af9b

SHA1
aa40fe4ef130173ffa241194a467be7122ac492b

SHA256
67f8da9b5376be56d7842977ff1e2b5fe4f16448ac2124f85d2a02d7652e8f70

SHA512
df8307e7ab401f12b3bf8e3af21d402a70723e0d4e3b0ec9722bcd426750b73043b9512f5246a965ac922e4c721cb3ce4f87eb8e928192b5a156b21334d51e6f

Download Submit
/system_ext/framework/androidx.window.sidecar.jar
Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit