| File name: | 5G-Ցանցի թարմացում (2).apk |
| Full analysis: | https://app.any.run/tasks/4d043ec8-3bce-4239-bff9-14380737aa35 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 29, 2025, 11:04:29 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.android.package-archive |
| File info: | Android package (APK), with classes.dex, with APK Signing Block |
| MD5: | BBEC1217EE04EFAE3FFBD4C944BC2A3F |
| SHA1: | C0235937F5AF491B7517D23ADD8F62B098C2CA6D |
| SHA256: | D1DCDC16EE692A9349B5A0528EF7E5B6364E7E824F896404041BB75CF1332F11 |
| SSDEEP: | 98304:Y9FxKHYtBYnfEiIY6eFwjTBLbWAK9ja29BH0LOMMZTazRF7Y8Z6RPGg02O2juXaL:t0n6GUI2 |
MALICIOUS
Determines whether a component is an active device admin
- app_process64 (PID: 2282)
Executes system commands or scripts
- app_process64 (PID: 2282)
Hides app icon from display
- app_process64 (PID: 2282)
SPYNOTE has been detected
- app_process64 (PID: 2282)
SUSPICIOUS
Requests access to accessibility settings
- app_process64 (PID: 2282)
Abuses foreground service for persistence
- app_process64 (PID: 2282)
Launches a new activity
- app_process64 (PID: 2282)
Retrieves a list of running services
- app_process64 (PID: 2282)
Accesses external device storage files
- app_process64 (PID: 2282)
Prevents its uninstallation by user
- app_process64 (PID: 2282)
Overlays content on other applications
- app_process64 (PID: 2282)
Checks if the device's lock screen is showing
- app_process64 (PID: 2282)
Creates a WakeLock to manage power state
- app_process64 (PID: 2282)
Updates the value of a system setting
- app_process64 (PID: 2282)
Acquires a wake lock to keep the device awake
- app_process64 (PID: 2282)
Intercepts events for accessibility services
- app_process64 (PID: 2282)
Updates data in the storage of application settings (SharedPreferences)
- app_process64 (PID: 2282)
Performs UI accessibility actions without user input
- app_process64 (PID: 2282)
Attempts to activate device administrator
- app_process64 (PID: 2282)
Accesses system-level resources
- app_process64 (PID: 2282)
Checks exemption from battery optimization
- app_process64 (PID: 2282)
Connects to unusual port
- app_process64 (PID: 2282)
INFO
Retrieves data from storage of application settings (SharedPreferences)
- app_process64 (PID: 2282)
Retrieves the value of a secure system setting
- app_process64 (PID: 2282)
Creates and writes local files
- app_process64 (PID: 2282)
Returns elapsed time since boot
- app_process64 (PID: 2282)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .apk | | | Android Package (62.1) |
|---|---|---|
| .jar | | | Java Archive (17.1) |
| .zan | | | BlueEyes Animation (15.9) |
| .zip | | | ZIP compressed archive (4.7) |
EXIF
ZIP
| ZipRequiredVersion: | - |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:03:18 09:43:42 |
| ZipCRC: | 0xb300ff50 |
| ZipCompressedSize: | 1767 |
| ZipUncompressedSize: | 3496 |
| ZipFileName: | classes.dex |
Total processes
129
Monitored processes
4
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2282 | recommendation.determination.medicines | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2361 | com.android.systemui.accessibility.accessibilitymenu | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2483 | getprop ro.miui.ui.version.name | /system/bin/toolbox | — | app_process64 |
User: u0_a108 Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2487 | com.android.settings | /system/bin/app_process64 | — | app_process64 |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
111
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2282 | app_process64 | /data/user/0/recommendation.determination.medicines/shared_prefs/recommendation.determination.medicines.xml | xml | |
MD5:— | SHA256:— | |||
| 2282 | app_process64 | /storage/emulated/0/Config/sys/apps/log/log-2025-04-29.txt | text | |
MD5:— | SHA256:— | |||
| 2282 | app_process64 | /data/user/0/recommendation.determination.medicines/shared_prefs/recommendation.determination.medicines_preferences.xml | xml | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
28
DNS requests
5
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.185.67:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
445 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
— | — | 142.250.185.100:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.185.67:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 173.194.76.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
579 | app_process64 | 216.239.35.4:123 | time.android.com | — | — | whitelisted |
579 | app_process64 | 216.239.35.8:123 | time.android.com | — | — | whitelisted |
579 | app_process64 | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
2282 | app_process64 | 185.112.83.134:7772 | — | AEZA GROUP Ltd | RU | malicious |
579 | app_process64 | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.google.com |
| whitelisted |
connectivitycheck.gstatic.com |
| whitelisted |
google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |