d832569f4bef206d50e2a2719312826d65ef7b95da9b008989b5d591195f9799 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
01-11-2024 12:16

Sharing

Report Analysis Logs

General

Target

ready.apk
Size

29KB
MD5

5e2d6a7c8bdee0f83c623afd72cf408e
SHA1

98061a731f70f35c0e209696e5dc69232d20dc47
SHA256

d832569f4bef206d50e2a2719312826d65ef7b95da9b008989b5d591195f9799
SHA512

f917a43e62f324e610ecd16446e46623680330911e455427f8985aa14dadfd24a6da9a0e7ccad15dbe288c276943e7fe24429ed800e6a476cd109977fdb26949
SSDEEP

768:g1qu/ssH/ZEqynEUsoKivy+apcKE85o0saXT10LOSgLud:XAssf+qyEEha+Aa820saDukq

Score

8^/10

evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4746	four.pda.suffix

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	four.pda.suffix

four.pda.suffix
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
PID:4746

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads