35527af0bfbed07700fd9865deaa045c0fb3d65a35e237b78b603812709e0c6c

Analysis

max time kernel
128s
max time network
149s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
10-06-2024 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_15d70a1a68405c9a58efbab9946222c0.apk
Size

1.5MB
MD5

15d70a1a68405c9a58efbab9946222c0
SHA1

495d0749e4aad68ec4f10f52b3713f3aa3d2dfae
SHA256

35527af0bfbed07700fd9865deaa045c0fb3d65a35e237b78b603812709e0c6c
SHA512

7c80dac9ce6e63cebf6bd62225ef1e03ee1237f25e8f24dc9034448636d58246f8d47ad4249ab379b7225ef91f9472f87829199ce370c91ed6651f1ec9b5ffcb
SSDEEP

24576:XkOWSDweBSCO+whKuFYxdv+bkefxeC/35eshIKH86q9G/pdgSdG:XkB5ewX+Vz+bLZeCoyIeqEcSdG

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4224	com.adobe.sklasse

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.adobe.sklasse

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.adobe.sklasse

com.adobe.sklasse
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4224

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.adobe.sklasse/databases/init.db

Filesize
28KB

MD5
9fec7fc5219bc6228224a4c1d4c3888a

SHA1
7468dfa9c028725b8eb46f14188c96d747622033

SHA256
e02ce52371af6b53bab40b106b0c8f220d434bc4d536907fbc4b44a147042198

SHA512
a337f608c385ec3edda7f46d985c061302fafa9a2c29901bff7adfe8e462afc0fa839c72d42b2c54f4466868ad0f9a487191216a5ea2bb31fb6bdec879376e90

Download Submit
/data/data/com.adobe.sklasse/databases/init.db-journal

Filesize
512B

MD5
6f89e8e7bb32d831e8119f6c1b65030b

SHA1
90d52d98526582849aa525fe47934eabfc1dcef3

SHA256
0737d8567ea7d361732eacd757c7ed539eb7cbaa097664ccb3b7d4b2ff6ecbd7

SHA512
de1237c929b292b7c062e373a703ed2746ee8c2e4c9521ab81675db332f474284780c2bef7015cdb671422f26abd2bbabaee9b37659fe55d63ac8d067f31944b

Download Submit
/data/data/com.adobe.sklasse/databases/init.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.adobe.sklasse/databases/init.db-wal

Filesize
40KB

MD5
e8f5375c05c73c1ab95598d0f74cb9d9

SHA1
f79fd93e9387a48c7f29969abe93abf3a2ed0f46

SHA256
18723833373da65e27da0c3afb6b0be4527f68a0779455e43f838016b394a271

SHA512
e8b526db92de5e4dc407e24eeaa6d165fcc6e3488a639bbf2dc87e4d9216bb47a900cf42d91e9fd978fcaad68eb4bcf11afd1f7480fa55977f0d6b38dd0f5965

Download Submit