e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff

Analysis

max time kernel
1s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
27/03/2025, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff.apk
Size

340KB
MD5

f48122e9f4333ba3bb77fac869043420
SHA1

02cc4cd5fbe40983ce084b9fa92d75c1d3da4954
SHA256

e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff
SHA512

fe6b244a9b84ec76ec8c0c28ae0b30ebd8de4c5aa43a9b6269b1d7358d8ec5c0a8fc8bd99bdbf0f71d2e68fc08e71882731b15eb4141109b3de5fd4b7d90e791
SSDEEP

6144:AVknR9v8MnFle/shzyqEZd5KDixU5YBqukraN5jGh2fQzwETloY:AoUMFlzhzw50iEKKaNWFvTSY

Score

8^/10

defense_evasion discovery evasion stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.example.loader
/system/xbin/su	com.example.loader

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4278	com.example.loader

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
11	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.example.loader

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.example.loader

com.example.loader
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Queries information about active data network
- Checks memory information
PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads