Overview

overview

10

Static

static

10

924e8a1c0d...20.apk

android_x86

10

924e8a1c0d...20.apk

android_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
  • Size 6.8MB
  • Sample220203-hqdxeadfer
  • SHA256 924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
  • MD5 SHA1 SHA512
Score
10/10
filecoderandroidransomware

Malware Config

Extracted

Path

  • res/layout/activity_main.xml

  • filecoder

Ransom Note
  • Current State Information Your personal documents and files on this device have just been crypted.The origion files have been completely deleted and will only be recovered by following the steps described below. Document Decryption Operation Guide 1. To obtain the key which will decrypt files,you need to pay the amount of Bitcoin you see at the top of the screen. 2. After the payment is completed, open %s and enter the userid below, you will get the decryption key. 3. Paste the decryption key in the key inputbox below and click the decrypt button.Reboot the phone,all files will be successfully decrypted. Decrypt Key: paste your key here... Useful Information UserID: BTC addr: 16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy !!!Do not delete this APP,or your files will not be back forever!!!
Wallets

  • 16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy

Targets

    • Target
      924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
    • Size 6.8MB
    • SHA256 924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
    • MD5 SHA1 SHA512
    Score
    10/10
    filecoderransomware

    • Filecoder.C

      A ransomware family that spreads to other victims via SMS.

      ransomwarefilecoder

    • Checks Android system properties for emulator presence.

    • Legitimate hosting services abused for malware hosting/C2

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks