e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73

Analysis

max time kernel
148s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27/03/2025, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73.apk
Size

181KB
MD5

0b9ffb688506065856ff032ca159233a
SHA1

b9549d23bfafd3e1c406611fdaa83b48b523b4cc
SHA256

e2f86dc49b6fa03589035944c83a75e440f9cd040723d9948f0610d3c7db6e73
SHA512

40764719d61c6738b7f9fadf088f52c55e2acc197b08097e1750512f3e3a98e4bb824ef6320f0ea88936b7403e834bdd4d621491f5cccea7ac93f0530df06b17
SSDEEP

3072:ehHS5kbM599UB2xzkNG1HQLHxVzLU1hyxCrUZip5U+vt0mhKdU+R3fGAkzR4Sm1w:e9S5koW2xG0wLRVkMFZedlMdUESmqMj8

Score

7^/10

collection credential_access defense_evasion evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.instagram.lite/[email protected]	4674	com.fsgij.deils
/data/user/0/com.instagram.lite/files/Factory/Plugins/classes.dex	4674	com.fsgij.deils
/data/user/0/com.instagram.lite/files/Factory/Plugins/classes.dex	4674	com.fsgij.deils

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.fsgij.deils
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.fsgij.deils

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fsgij.deils

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.fsgij.deils

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.fsgij.deils

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fsgij.deils

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fsgij.deils

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fsgij.deils

com.fsgij.deils
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
PID:4674

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.instagram.lite/[email protected]

Filesize
185KB

MD5
a917464ddddaaba4fd6c2e0d419ef62a

SHA1
419511f83ac7723ed2b0044621588c90dbfdf9d1

SHA256
5c13bed9bba9f40ea0dff48a37e883bea84cfc87b4f4a3134963b6e8bf9171b5

SHA512
91d6007985aea8c116577ca82fd4f15ccac5e67ee04fe3f5e40cc502809a537103b9c3b650fac6655d1341f447ff81de74c1c89fc610385265afb7781459977f

Download Submit
/data/user/0/com.instagram.lite/files/Factory/Plugins/oat/classes.dex.cur.prof

Filesize
228B

MD5
f2cf3d6865be0f2b1df8316be96d8ab5

SHA1
8916579efc5f72dbd66f30bccff036fe06eda052

SHA256
23f99b75fc50a9382d49e75ad89aa37ff40b6470b135e9aba121555d9bab66db

SHA512
dd5b48560cafadaff14379198d5f586e7cd28511228d5bbf706a319719a87269ad376318307cbe2f2a5d0aa274b99fb8339f6df3d761d4f479c5679871ac0f1d

Download Submit
/data/user/0/com.instagram.lite/oat/x86_64/[email protected]

Filesize
400B

MD5
d6e8ff4e687e84f41baa5fe61fc82422

SHA1
e7d8dbe757bc2a47a2b2dadbf89c007c62cbe6ce

SHA256
087be4b33b05c578afa2d99c0b282742e50dcc70e6b02746fe48c4be6baac364

SHA512
828bcf1cf76b2d80d4fdcd8d0eb6dbaf3b2bc3ad21da336c16c74bc849adae8ac28ddb6644b2fe1f8a8258dbf0c8f4a0decb30e98883e4ed39e80e5296517fba

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads