51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

max time kernel
179s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
04/08/2024, 12:30 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

antivirus.apk
Size

533KB
MD5

9f01767647e2e72f446d374bbcb20c53
SHA1

f6b1adcd7723b525418a05bcede5c671366d7ab3
SHA256

fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
SHA512

4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
SSDEEP

12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ

Score

7^/10

collection impact privilege_escalation

Malware Config

Signatures

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.elite

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.elite

com.elite
1⤵
- Reads the contacts stored on the device.
- Tries to add a device administrator.
PID:4438

Network

DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A

Response

ssl.google-analytics.com

IN A

142.250.200.40

172.217.16.238:443

tls, https

695 B
40 B
1
1
172.217.16.238:443

android.apis.google.com

tls

6.4kB
9.7kB
27
27
172.217.169.42:443

tls, https

1.3kB
40 B
1
1
172.217.169.42:443

tls, https

530 B
40 B
1
1
142.250.200.40:443

ssl.google-analytics.com

tls

1.3kB
5.9kB
8
9
142.250.187.196:443

tls, https

848 B
40 B
2
1
142.250.187.196:443

www.google.com

tls

11.1kB
10.0kB
30
37

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

ssl.google-analytics.com

dns

70 B
86 B
1
1

DNS Request

ssl.google-analytics.com

DNS Response

142.250.200.40

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Windows 7 deprecation

DNS Request

DNS Response

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.