| File name: | fotos.apk |
| Full analysis: | https://app.any.run/tasks/6bbec076-6fba-49e5-bcb4-8aca7413fd51 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 11, 2025, 01:55:08 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with AndroidManifest.xml, with APK Signing Block |
| MD5: | 4FBF0A95E46973C60DD2168DC64ACB06 |
| SHA1: | 431D13DC51FBC84309A71A8D84906EFBA126F168 |
| SHA256: | 8827063BC50F32613671CD798D57A0BE469A6E1445C6F474718E1F794F764B27 |
| SSDEEP: | 98304:1HC4sQVxJ626bObN/Y8VJvLxxlnYHMtz7MK0DxQEm7dPSD6WCOmwoBqnwGPbBh8A:3E9szAXcwN |
MALICIOUS
Initiates background APK installation
- app_process64 (PID: 2229)
Uses APIs to record audio and video from various sources
- app_process64 (PID: 2386)
Checks whether the screen is currently on
- app_process64 (PID: 2386)
Determines whether a component is an active device admin
- app_process64 (PID: 2386)
Hides app icon from display
- app_process64 (PID: 2386)
SPYNOTE has been detected
- app_process64 (PID: 2386)
Executes system commands or scripts
- app_process64 (PID: 2386)
SUSPICIOUS
Starts a service
- app_process64 (PID: 2386)
Detects when screen powers off
- app_process64 (PID: 2386)
Retrieves a list of running services
- app_process64 (PID: 2386)
Abuses foreground service for persistence
- app_process64 (PID: 2386)
Overlays content on other applications
- app_process64 (PID: 2386)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2386)
Launches a new activity
- app_process64 (PID: 2386)
Creates a WakeLock to manage power state
- app_process64 (PID: 2386)
Accesses external device storage files
- app_process64 (PID: 2386)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2386)
Checks if the device's lock screen is showing
- app_process64 (PID: 2386)
Requests access to accessibility settings
- app_process64 (PID: 2386)
Updates the value of a system setting
- app_process64 (PID: 2386)
Intercepts events for accessibility services
- app_process64 (PID: 2386)
Prevents its uninstallation by user
- app_process64 (PID: 2386)
Leverages accessibility to control apps
- app_process64 (PID: 2386)
Checks exemption from battery optimization
- app_process64 (PID: 2386)
Retrieves installed applications on device
- app_process64 (PID: 2386)
Collects data about the device's environment (JVM version)
- app_process64 (PID: 2386)
Executes dynamic code using class loader
- app_process64 (PID: 2386)
Connects to unusual port
- app_process64 (PID: 2386)
Accesses system-level resources
- app_process64 (PID: 2386)
INFO
Dynamically registers broadcast event listeners
- app_process64 (PID: 2386)
- app_process64 (PID: 2229)
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2386)
Retrieves the value of a secure system setting
- app_process64 (PID: 2386)
Verifies whether the device is connected to the internet
- app_process64 (PID: 2386)
Dynamically inspects or modifies classes, methods, and fields at runtime
- app_process64 (PID: 2386)
Retrieves the value of a global system setting
- app_process64 (PID: 2386)
Detects device power status
- app_process64 (PID: 2386)
Creates and writes local files
- app_process64 (PID: 2386)
Dynamically loads a class in Java
- app_process64 (PID: 2386)
Returns elapsed time since boot
- app_process64 (PID: 2386)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | 0x0800 |
| ZipCompression: | Unknown (16966) |
| ZipModifyDate: | 2025:04:10 17:49:52 |
| ZipCRC: | 0xd423a580 |
| ZipCompressedSize: | 6510 |
| ZipUncompressedSize: | 18600 |
| ZipFileName: | AndroidManifest.xml |
Total processes
139
Monitored processes
15
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 342 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2229 | xxx.xxx | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2278 | com.android.traceur | /system/bin/app_process64 | — | app_process64 |
User: u0_a53 Integrity Level: UNKNOWN Exit code: 512 | ||||
| 2378 | /apex/com.android.art/bin/artd | /apex/com.android.art/bin/artd | — | init |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2380 | /apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw==/base.apk --oat-fd=7 --oat-location=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context-fds=10 --class-loader-context=PCL[]{PCL[/system/framework/android.test.base.jar]} --classpath-dir=/data/app/~~LXk26uDvzdj8pLGsMpgB7Q==/diana.dh.skip-4bJDcAT8EsmkLiqUwoFpdw== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:29 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:1.0.0.0,app-version-code:1000,art-version:340090000 | /apex/com.android.art/bin/dex2oat32 | — | artd |
User: artd Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2386 | diana.dh.skip | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2447 | com.android.systemui.accessibility.accessibilitymenu | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2708 | ping -c 1 -W 15 gtdfsowh0.localto.net | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2716 | ping -c 1 -W 15 gtdfsowh0.localto.net | /system/bin/ping | — | app_process64 |
User: u0_a109 Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2730 | org.chromium.webview_shell | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
13
Text files
160
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2229 | app_process64 | /data/user/0/xxx.xxx/cache/oat_primary/arm64/base.2229.tmp | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/shared_prefs/diana.dh.skip.xml | xml | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/cache/oat_primary/arm64/base.2386.tmp | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/Config/sys/apps/log/log-2025-04-11.txt | text | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /data/user/0/diana.dh.skip/shared_prefs/diana.dh.skip_preferences.xml | xml | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data0 | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data1 | compressed | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data2 | — | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data3 | binary | |
MD5:— | SHA256:— | |||
| 2386 | app_process64 | /storage/emulated/0/AppData/meta_data4 | dex | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
10
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.185.99:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 142.250.185.99:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
— | — | 142.250.184.196:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.251.18.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2386 | app_process64 | 132.145.75.68:3231 | gtdfsowh0.localto.net | ORACLE-BMC-31898 | GB | malicious |
2759 | app_process32 | 142.250.186.131:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2808 | app_process32 | 142.250.185.67:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2808 | app_process32 | 216.58.206.78:443 | dl.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
google.com |
| whitelisted |
gtdfsowh0.localto.net |
| malicious |
68.75.145.132.in-addr.arpa |
| unknown |
clientservices.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |