Hatching Triage

Reported Context (4)

Figure 7: 'Device Shield' landing page presented to victim (Source Hatching Triage).The APK prompts the user to initiate a scan of their phone before moving forward and accessing the bill information. The app makes use Researchers uncover Canis cross-platform surveillance framework targeting Japan
Our research began with an APK file uploaded to Hatching Triage, an online malware sandbox, named com.hdphoto.wallpaper4k.apk (SHA-256: SSL Certificate Analysis Uncovers 77 Servers Linked to Joker Android Malware
tools abused by threat actors. These tags are derived from dynamic analysis performed using Hatching Triage, providing high-confidence categorization based on observed behaviors and attributes of the files. Open Directories Reveal XWorm Disguised as Legitimate Software
and files that caught our attention. (Take a look here)We decided to dynamically analyze the file in Hatching Triage to learn more about the executable. Our suspicions were confirmed as the EXE scored a 7 out of 10 and Malicious Chrome Extensions Use Scheduled Tasks and Decoy Documents to Target Networks

Malware (4)

People (3)

Threat Actors (1)

MITRE ATT&CK (19)

Vendors (4)

Products (12)

Tools (5)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.