| File name: | fotos.apk |
| Full analysis: | https://app.any.run/tasks/6bbec076-6fba-49e5-bcb4-8aca7413fd51 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 11, 2025, 01:55:08 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with AndroidManifest.xml, with APK Signing Block |
| MD5: | 4FBF0A95E46973C60DD2168DC64ACB06 |
| SHA1: | 431D13DC51FBC84309A71A8D84906EFBA126F168 |
| SHA256: | 8827063BC50F32613671CD798D57A0BE469A6E1445C6F474718E1F794F764B27 |
| SSDEEP: | 98304:1HC4sQVxJ626bObN/Y8VJvLxxlnYHMtz7MK0DxQEm7dPSD6WCOmwoBqnwGPbBh8A:3E9szAXcwN |
MALICIOUS
Initiates background APK installation
- app_process64 (PID: 2229)
Uses APIs to record audio and video from various sources
- app_process64 (PID: 2386)
Hides app icon from display
- app_process64 (PID: 2386)
Checks whether the screen is currently on
- app_process64 (PID: 2386)
Determines whether a component is an active device admin
- app_process64 (PID: 2386)
Executes system commands or scripts
- app_process64 (PID: 2386)
SPYNOTE has been detected
- app_process64 (PID: 2386)
SUSPICIOUS
Launches a new activity
- app_process64 (PID: 2386)
Retrieves a list of running services
- app_process64 (PID: 2386)
Starts a service
- app_process64 (PID: 2386)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2386)
Abuses foreground service for persistence
- app_process64 (PID: 2386)
Detects when screen powers off
- app_process64 (PID: 2386)
Leverages accessibility to control apps
- app_process64 (PID: 2386)
Overlays content on other applications
- app_process64 (PID: 2386)
Executes dynamic code using class loader
- app_process64 (PID: 2386)
Creates a WakeLock to manage power state
- app_process64 (PID: 2386)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2386)
Checks if the device's lock screen is showing
- app_process64 (PID: 2386)
Accesses external device storage files
- app_process64 (PID: 2386)
Updates the value of a system setting
- app_process64 (PID: 2386)
Requests access to accessibility settings
- app_process64 (PID: 2386)
Intercepts events for accessibility services
- app_process64 (PID: 2386)
Prevents its uninstallation by user
- app_process64 (PID: 2386)
Checks exemption from battery optimization
- app_process64 (PID: 2386)
Accesses system-level resources
- app_process64 (PID: 2386)
Collects data about the device's environment (JVM version)
- app_process64 (PID: 2386)
Connects to unusual port
- app_process64 (PID: 2386)
Retrieves installed applications on device
- app_process64 (PID: 2386)
INFO
Dynamically registers broadcast event listeners
- app_process64 (PID: 2229)
- app_process64 (PID: 2386)
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2386)
Dynamically loads a class in Java
- app_process64 (PID: 2386)
Creates and writes local files
- app_process64 (PID: 2386)
Returns elapsed time since boot
- app_process64 (PID: 2386)
Retrieves the value of a secure system setting
- app_process64 (PID: 2386)
Dynamically inspects or modifies classes, methods, and fields at runtime
- app_process64 (PID: 2386)
Detects device power status
- app_process64 (PID: 2386)
Retrieves the value of a global system setting
- app_process64 (PID: 2386)
Verifies whether the device is connected to the internet
- app_process64 (PID: 2386)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | 0x0800 |
| ZipCompression: | Unknown (16966) |
| ZipModifyDate: | 2025:04:10 17:49:52 |
| ZipCRC: | 0xd423a580 |
| ZipCompressedSize: | 6510 |
| ZipUncompressedSize: | 18600 |
| ZipFileName: | AndroidManifest.xml |
Total processes
139
Monitored processes
15
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 342 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2229 | xxx.xxx | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2278 | com.android.traceur | /system/bin/app_process64 | — | app_process64 |
User: u0_a53 Integrity Level: UNKNOWN Exit code: 512 | ||||
| 2378 | /apex/com.android.art/bin/artd | /apex/com.android.art/bin/artd | — | init |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2380 | /apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw==/base.apk --oat-fd=7 --oat-location=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context-fds=10 --class-loader-context=PCL[]{PCL[/system/framework/android.test.base.jar]} --classpath-dir=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:29 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:1.0.0.0,app-version-code:1000,art-version:340090000 | /apex/com.android.art/bin/dex2oat32 | — | artd |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2386 | diana.dh.skip | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2447 | com.android.systemui.accessibility.accessibilitymenu | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2708 | ping -c 1 -W 15 gtdfsowh0.localto.net | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2716 | ping -c 1 -W 15 gtdfsowh0.localto.net | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2730 | org.chromium.webview_shell | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
13
Text files
160
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2229 | app_process64 | /data/user/0/xxx.xxx/cache/oat_primary/arm64/base.2229.tmp | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/shared_prefs/diana.dh.skip.xml | xml | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/cache/oat_primary/arm64/base.2386.tmp | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/Config/sys/apps/log/log-2025-04-11.txt | text | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/shared_prefs/diana.dh.skip_preferences.xml | xml | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data0 | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data1 | compressed | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data2 | — | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data3 | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data4 | dex | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
10
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.185.99:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 142.250.185.99:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
— | — | 142.250.184.196:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.251.18.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2386 | app_process64 | 132.145.75.68:3231 | gtdfsowh0.localto.net | ORACLE-BMC-31898 | GB | malicious |
2759 | app_process32 | 142.250.186.131:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2808 | app_process32 | 142.250.185.67:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2808 | app_process32 | 216.58.206.78:443 | dl.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
google.com |
| whitelisted |
gtdfsowh0.localto.net |
| malicious |
68.75.145.132.in-addr.arpa |
| unknown |
clientservices.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |