Indicators of Compromise (IoCs)  SHA-256 Package name Label 0c4b08bec1251b1ebc715a7ef1a712cdcb4d37ce0093d88f7fa73b0e05bf7b0e com.sas.gplayservices.accesibility GSERVICES 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd com.sas.gservices.accesibility GSERVICES 3bf85d0aff5ddc0c57e43b879631ee692d98d01f5c964336471f1cdfe0d291f8 com.example.rat rat 7cb0eb93de496e2141b6e0541465ca71a84063867381085692885c75aa59cb1b com.pdf.searcher.dd Pdf Searcher 8ad18bd8f5d2f1fd9e00211170e8a540ddf7f51618588fab31b4ddd2b34b75e1 com.pdfd.researcher.resaq_ver1 Caller c8e1a702a27309c22728792c64aad4abc14ec2bfad1b30a4f27b8ebc6bcc68ff com.sas.gservices.accesibility GSERVICES   C&C servers  3.95.71.123:3000  18.206.105.66:3000  40.114.109.69:3000  52.21.5.241:2000  Phishing domain  http://gooogle[.]press/    MITRE ATT&CK Techniques  Tactic Technique ID Description Initial Access Masquerade as Legitimate Application T1444 Used to masquerade as a legitimate chat app Persistence Abuse Device Administrator Access to Prevent Removal T1401