e362a037e70517565d28ab85959e6c9d231b2baf0c2df3b87dfaa1451278e80c

Analysis

max time kernel
148s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
27/03/2025, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e362a037e70517565d28ab85959e6c9d231b2baf0c2df3b87dfaa1451278e80c.apk
Size

230KB
MD5

cbd1c2db9ffc6b67cea46d271594c2ae
SHA1

a65f80a623269307067416225ce2a6cfc0557ac4
SHA256

e362a037e70517565d28ab85959e6c9d231b2baf0c2df3b87dfaa1451278e80c
SHA512

a24795269af017df635f5ff742e9dc3a5c5389ede70890b575aac41a5a12215ddd2f2750080018a345171dfa7ddd2fbe8fb85a6e894ba45ad47800a96acf19fa
SSDEEP

6144:QhU7h0EKLlHx46Qbzu0rspN/8EgZwL1uahIxs:iwWdx46mPrSJuCI6

Score

8^/10

discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5071	it.phonetre.androidv1
5071	it.phonetre.androidv1

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	it.phonetre.androidv1

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	it.phonetre.androidv1

it.phonetre.androidv1
1⤵
- Removes its main activity from the application launcher
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5071

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact