a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04

Resubmissions

11/03/2025, 04:45

250311-fdp3sssxdv 10

11/03/2025, 04:18

250311-exfg2a1kz8 10

Analysis

max time kernel
146s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
11/03/2025, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04.apk
Size

21.8MB
MD5

5d0a191d649631ec71b3fac157170201
SHA1

c32f47dc40985a3d6d6c47310e06b7b462d5c711
SHA256

a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04
SHA512

d61af45593a2b934c01d7a7742e69da881ca6474017a78e91683652c2c3e698b9da4be17c5d397ac407df31e00ddaa5da2692e75f9d39c0f16097deda11d8bfe
SSDEEP

196608:26eMt/k6ss4Lmos1sgAXFNgI7a7Yt3Zu9yzhLrZYGlQ1ZXY1uk53A3+j:3eucLLys3FNgIuQ9zhL9BgZXgtMO

Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.anydesk.adcontrol.ad1

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.anydesk.adcontrol.ad1

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.anydesk.adcontrol.ad1

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/data/phones	com.anydesk.adcontrol.ad1

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.anydesk.adcontrol.ad1

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
23	raw.githubusercontent.com

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.anydesk.adcontrol.ad1
Framework service call	android.app.IActivityManager.setServiceForeground	com.anydesk.adcontrol.ad1:remote

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.anydesk.adcontrol.ad1
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.anydesk.adcontrol.ad1

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.anydesk.adcontrol.ad1

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.anydesk.adcontrol.ad1

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.anydesk.adcontrol.ad1

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.anydesk.adcontrol.ad1

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.anydesk.adcontrol.ad1

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.anydesk.adcontrol.ad1

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.anydesk.adcontrol.ad1

com.anydesk.adcontrol.ad1
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4374

com.anydesk.adcontrol.ad1:remote
1⤵
- Makes use of the framework's foreground persistence service
PID:4631

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

Contact List

T1636.003

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.anydesk.adcontrol.ad1/app_crashrecord/1004

Filesize
232B

MD5
ad5952e8a01d869b21e246a8c3bb67ac

SHA1
6c4523994b5c4676b8afd1b3c4317c104324a610

SHA256
917540e06074eb450a7432abaca8c642c4594b5b93d9829450baa77a54609652

SHA512
15de322c9e7263ab11e17030579d0d10db7afa525fc3df60d008e310bbce1a65dbce0eec74ba64344e0595b14bd9a850e622c932474a3a1ed76de884be14a666

Download Submit
/data/data/com.anydesk.adcontrol.ad1/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.anydesk.adcontrol.ad1/cache/tomb.zip

Filesize
544B

MD5
13c270aac4729537a802d709b78e561a

SHA1
8449d09d1d3e936b0ce0c04dcf9b0d5abc995271

SHA256
cfdfadd13c2d58da4c1b112221073d041f0ac681529fca072e5bd9973dff60a0

SHA512
bf89919d3943b4c224f2f1e92ff2c7922b261e60dbd56c3c55e445ebc8574dfe678a96b69c5b76f000ac201b7601320231a9ccb5be4c47263a68a3e0c16c1614

Download Submit
/data/data/com.anydesk.adcontrol.ad1/cache/wp.jpeg

Filesize
143KB

MD5
5dc1983554a88c2a224ee046bb7314ec

SHA1
5b09273776014bf32fd8aa7bca9ce151d2c7d98f

SHA256
6a4d32e8ef673e70a8a4963124417be10eb09089f3aa049e1e3c7de515c69f21

SHA512
5ce30ef36c25d33f3416006c103608057a9cc88f2d88fe37de3bd895d68a005644d74aca0abd5bef02f2ed17709a38ae249b0dabeaa16d1c46c8a8c9d85c7e88

Download Submit
/data/data/com.anydesk.adcontrol.ad1/databases/bugly_db_

Filesize
200KB

MD5
c712b6f76cae12491ea88c5fbcdbd94d

SHA1
535a3ad8b6adda9ec13f43de14b440a86c8f46c4

SHA256
1665dd10c7ba5c101e00bb0185384a9e7ba57d279e10844fe699ac32843d76b0

SHA512
93ebf596f3e83b361fcc801febc2a978f7aec66fd4c3536aee9fd96fa0cce9d4ffecc239325991ec97ddb3deb78f9f4b845e8bcda5a8729cf31a97534bbf55a1

Download Submit
/data/data/com.anydesk.adcontrol.ad1/databases/bugly_db_-journal

Filesize
512B

MD5
98557fbd1302d408f6b72aca94273d29

SHA1
192730a00b175099d4c4fcbfa5f3306774c54819

SHA256
34ebf9d5d37505be3670bae4a115be97186c5c51fa00bb30a9cbc61cb0c5fce4

SHA512
6e035b8053e4e9522bfd35694e8842f9a7f21494ad970928f50254b4df30c79171dacc46d4e7a67aadacfb71ee2ddd54ae5a45e95e523662aaca7534eb5e136b

Download Submit
/data/data/com.anydesk.adcontrol.ad1/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.anydesk.adcontrol.ad1/databases/bugly_db_-wal

Filesize
418KB

MD5
04672d1301df10e6aae0dc8c4ae962e8

SHA1
6caa80b705c9ca060667fdacf2469dedfe785f24

SHA256
db713b0eb33fe76995e51145bf7c5bab7f6ff7d07982d7064ff50e1ba45ce166

SHA512
654f9fa8504d87f18116225a78e0267a37a9b355e74c67f1ee7a8c42e92c9f1c37598f43aebf5c99c2b5d83d9af473697fbbd94378231b07e1f1a560ee262493

Download Submit
/data/data/com.anydesk.adcontrol.ad1/files/bugly_last_us_up_tm

Filesize
13B

MD5
8d43556a6ab96937fccd3400fd843837

SHA1
de8947e3fdbe30fb0d5c34638ffc6f7444af5848

SHA256
1075e22e489cebf584164c87cabdf0d9ea59a02e3d98e904d2ca44900576b4ef

SHA512
05d0ddd7e87c7c085407d9cfac83fe3e8808e55c3f061b948bbb5e9339a267ad7e9a5c7f4e59185dc9cb57510796aecda502e245175d577894078daccaa25fef

Download Submit
/data/data/com.anydesk.adcontrol.ad1/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/com.anydesk.adcontrol.ad1/files/profileInstalled

Filesize
24B

MD5
12bd6405729bbccb1ad7dd1e16253b84

SHA1
611b369fc1b0486d7a8bc76b45d456e9f116800a

SHA256
73b72a04c6baf8dc0fe65dd55355724199ca211e69c8a99b586bb129527d18df

SHA512
6b73980be8634b2bd54b6f3e0c9d433da01a87f0d70b422788fe97734f98e5b5aa941081f29dcb89470f715beabc85d65e499df2b218fad14c068abdbfb5c66a

Download Submit
/data/data/com.anydesk.adcontrol.ad1/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d731c275cee367884d64ca239593e12f

SHA1
0a2cd43ebf89129e43f1aeb31f7dd7bf06fa236d

SHA256
3c29727cf98a0b0616683dfcfcb9d2c0762b5b052ce7222c3273c862fc983f19

SHA512
d50cd61687960b482878d75881f74e25ef2bd1fc80fe10f304f932bdb8bc7b7ca3ca4114938189484272d11e37772e65b284da9ed2e1430d143e45f5c63ff5ab

Download Submit
/data/misc/profiles/cur/0/com.anydesk.adcontrol.ad1/primary.prof

Filesize
1KB

MD5
8de5d399c105c57f0b45d5c8f6ed0449

SHA1
cbad34085d55f82a0fa40a37d47641c8a22a1a27

SHA256
38351b9addf6110945f95cdea4ba18cbc47367168dc651a60309abd6778e5930

SHA512
f5a7aa4eddf2b65f57266711ebb8231f9e8283d160cfd3f0267205fbc496938aba29ecf7c454dc81aeaee151089aaf5816d4b1a07a608937289e010b706cf1a2

Download Submit
/data/misc/profiles/cur/0/com.anydesk.adcontrol.ad1/primary.prof

Filesize
13KB

MD5
a3e17a0136723246a3fb968087df9955

SHA1
5034b6d5126a39f58c921db373842adf1c3393be

SHA256
a874ca70c7fcd2c2648c3e923e801b5f954c3ba2a5fad0cdd8948de0b72bd6e2

SHA512
e6eabea4f0e3cb0be11a0df2c291b991cf4648b23b806eed68b25c029c013870fbb6b2c8cae707094dfe7261cfeaaa683f312015a5621dacf8e8a6414d412c41

Download Submit
/storage/emulated/0/Android/data/com.anydesk.adcontrol.ad1/files/log_data.idx

Filesize
1KB

MD5
1a6a4067d3f66e56085f3faab7b3b47a

SHA1
f7e43fbe4de1781f7707927a366638bb1b38054f

SHA256
48f794d9580accc7e8d9758b7f65ad05202049a83d8ec28a30dba4d1de4060fa

SHA512
acb91e1d394655f0f99e730e48abe0cca0172cafcf3b417387926f9b432ec87c1d51a2faff5ca7a0c8adf9b92ce4732be196b58ded459db8b5406d2f0c3c526a

Download Submit
/storage/emulated/0/Android/data/com.anydesk.adcontrol.ad1/files/log_data_000

Filesize
26KB

MD5
09f34624f462597546bb087165432dc2

SHA1
653391ce5133498f28f8e2e8f464501ff4a736f2

SHA256
009993d13ec1bdc4172c21cebd7a47c7be2d4316cced591138654fae097d5764

SHA512
968b635aaee8d403cfacde3e0ab52c20af811290d2624a87284c7e2431acda1039a40ec7c36f7c727d2e119666fa5bad9509a317713d37864b09fd2cded922c8

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads