bde3d81846abd79435187497bb1d52b24c6c1d6fc9047e2dc2be61b23db3bd61

Analysis

max time kernel
149s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
16-09-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19880f372f3bcf059e43129f56978ee3.apk
Size

39.3MB
MD5

19880f372f3bcf059e43129f56978ee3
SHA1

b06cf40b5a7668fbcf3880e3cb5af175fca8a773
SHA256

bde3d81846abd79435187497bb1d52b24c6c1d6fc9047e2dc2be61b23db3bd61
SHA512

1f51ef868e1cccda46cd2661cd51849065d49d01f21a78b86ae3cf270adbfadb0b7b3d065feaa710f5f552894766f983ee47a865b9e0858396d65ace37ce38a6
SSDEEP

786432:Bxh2ou5DO1dZDV1FirhsjXe2j4u+WA0ltQsm3dSxea39WSt2XT60RTTc5M:bhYZsdpTFskXHj4u+B0leZNaea8St2Xf

Score

8^/10

evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4476	package.name.suffix

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	package.name.suffix

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

package.name.suffix
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
PID:4476

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/.apk.apk

Filesize
40.0MB

MD5
9f0eebb9058e61d7b4a7963c9ed85b9d

SHA1
3d2f1c95f63e5276cf9bf820e6ec3e92da6c9d83

SHA256
f6e79d6ecc3b5bdfbf904f2535eed3b28d53d6d486aefb9e56b8cda64b94c3b9

SHA512
a3cc9225f66c5fd41675e00f4113ac522cf53c45ab4cae813497dd4d8d78355e5d595d96ab4c2871d8bdef8b0fcd7e7854ff7449dd264f48f555b310e7d91068

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads