d832569f4bef206d50e2a2719312826d65ef7b95da9b008989b5d591195f9799 | Triage™

Analysis

max time kernel
144s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
01/11/2024, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ready.apk
Size 29KB
Sample241101-pfxp4askap
SHA256 d832569f4bef206d50e2a2719312826d65ef7b95da9b008989b5d591195f9799
MD5 5e2d6a7c8bdee0f83c623afd72cf408e
SHA1 98061a731f70f35c0e209696e5dc69232d20dc47
SHA512 f917a43e62f324e610ecd16446e46623680330911e455427f8985aa14dadfd24a6da9a0e7ccad15dbe288c276943e7fe24429ed800e6a476cd109977fdb26949
SSDEEP 768:g1qu/ssH/ZEqynEUsoKivy+apcKE85o0saXT10LOSgLud:XAssf+qyEEha+Aa820saDukq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4746	four.pda.suffix

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	four.pda.suffix

four.pda.suffix
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
PID:4746

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads