6a0eafcf69bdb1f04f28b5bf57ca181b30c3d0ae9069615b358bc72e4b1fc109

Analysis

max time kernel
45s
max time network
129s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
27/03/2025, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a0eafcf69bdb1f04f28b5bf57ca181b30c3d0ae9069615b358bc72e4b1fc109.apk
Size

3.1MB
MD5

42d04a0c4346dbce98a175ae8935c1c9
SHA1

0ba3b3de8235ccef38e0407697672733215a825f
SHA256

6a0eafcf69bdb1f04f28b5bf57ca181b30c3d0ae9069615b358bc72e4b1fc109
SHA512

0c456066d7884b9844e6dcaed3be639ba9b68abfc7858efb780ca15ace7ece9a7bfa3bed492f4278fe76627f7e7624c3707bf2616aa6807959d9a3276010262d
SSDEEP

98304:hiBcUAdk6lQyb3U5oy3DDUNHYA+kOjY+y/pdJ+8x:FUAiKQ+32xDUNH0DjY+yL5

Score

8^/10

discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4382	wifi.access.android
4382	wifi.access.android

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex	4506	wifi.access.android:remote
/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex	4547	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/wifi.access.android/code_cache/oat/x86/mv_update_v2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex	4506	wifi.access.android:remote

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	wifi.access.android:remote

wifi.access.android
1⤵
- Removes its main activity from the application launcher
PID:4382

wifi.access.android:remote
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
PID:4506
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/wifi.access.android/code_cache/oat/x86/mv_update_v2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4547

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/wifi.access.android/files/profileInstalled

Filesize
24B

MD5
3f874f00914be220fa704a15dcbb6b15

SHA1
09dd76ba4a86d9a6d6be032cd50377110c734fb1

SHA256
53c39df08247f722c0af93a34f7176c679d30c245b7c7cc327e558641ded2e46

SHA512
3e2d09e8d403e9706e308f7e3f83410c776b08eadb84a43977797aa0eea785df115011c9f10ff79872bcc2087f33cb66afacaebdf65a0cc8f496961b53ab8ddb

Download Submit
/data/data/wifi.access.android/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
f2aa05c21a466ed030ab21ce9f752e18

SHA1
42ff04c96131d16742082fcb0f370431311bef67

SHA256
f56e774df4cc54b9444b65fdee278bc308ff3ae96ed27483a846b3532bbd63a6

SHA512
2b9b1f126d7d652f29e27efc3be89f42db9c2e1c08cf97ad8ab50b0e9254cc1154177d421fe7ce222122cd29e48fea803d73dcd0a69a23d2c9c363752977932b

Download Submit
/data/misc/profiles/cur/0/wifi.access.android/primary.prof

Filesize
5.2MB

MD5
d300bdb4b3ea87f902fda5bf7bad33f2

SHA1
aa90761dbf400c3a66a28fd0a264fc1aedb491a7

SHA256
c28fc458d8c9545aba71901fc5bf7b1589c74d9bd5ae8817836c274ecae94576

SHA512
81cd2386f35a9a220dd299ece33a9d19f497180b6e69b4bc396ef3b8ae04cd1e9726d02735c85fb9aa5ab0834a369dc811be1b51a4a0b37f776c7e66c5de82cc

Download Submit
/data/misc/profiles/cur/0/wifi.access.android/primary.prof

Filesize
4KB

MD5
03c10f024c0baedd24802d7069d57824

SHA1
36568240fcb4836a89fd2ffcfcbad0f8f11bc86b

SHA256
e2b45844675329f25aec08d66f142130589b63ce77fd0760aa37d3f44d72237a

SHA512
ea574d6977f80c9770c47d783aced5d735cec9a7c2d64397df2567ee73c0b4cf9431209ec711385e4320fae8d475b104e83e47f5487ecc949a15746f571c9b9e

Download Submit
/data/user/0/wifi.access.android/code_cache/mv_update_v2.dex

Filesize
5.2MB

MD5
9aee17535dc0ebad1b2e5a975e88d6fe

SHA1
d85595874b1300c3266731efe2e5f3975c4bfd51

SHA256
3d2910d3857fbbb135c134a56fef5dc573ab6a4154af62849488d7656c8dba66

SHA512
df295575b5e58755e9168d0dfa0f8bc43300ecf1b9651f350f1850538755c36519c4c10279ff36407d72e18afb0931e2f33a070a8c8425bcf68c19bb1921d76f

Download Submit