7bf12ce87f1be65f14289fe4f9a7fe4c79b145ec8dd8b1d88ce3faf9036b1836

Resubmissions

07/05/2026, 09:18

07/05/2026, 07:33

03/06/2022, 06:18

Target
e88867956017bbe5b633811885c87018.apk
Size 793KB
Sample220603-g2vtmafcep
SHA256 7bf12ce87f1be65f14289fe4f9a7fe4c79b145ec8dd8b1d88ce3faf9036b1836
MD5 e88867956017bbe5b633811885c87018
SHA1 90f91c525ffe9b41ae325fd47d708ea48a55dd24
SHA512 3cc7d68c1c9d135c05442d1e68de7c502e7c28748ec50af74231e6c8bcaeb8b89c419fad56504d4a7f3b58585d8dab249c6d8b862ef0d1c1729c4f13b7a028d2
MD5 SHA1 SHA512

Score

8^/10

banker ransomware

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	khjjhkghkg.yulyuuyklyuky
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	khjjhkghkg.yulyuuyklyuky

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 3 IoCs

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	khjjhkghkg.yulyuuyklyuky
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	khjjhkghkg.yulyuuyklyuky:cproc
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	khjjhkghkg.yulyuuyklyuky:cproc

Uses Crypto APIs (Might try to encrypt user data). 2 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	khjjhkghkg.yulyuuyklyuky:cproc
Framework API call	javax.crypto.Cipher.doFinal	khjjhkghkg.yulyuuyklyuky:cproc

khjjhkghkg.yulyuuyklyuky
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
PID:5135

khjjhkghkg.yulyuuyklyuky:cproc
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Uses Crypto APIs (Might try to encrypt user data).
PID:5184

khjjhkghkg.yulyuuyklyuky:cproc
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Uses Crypto APIs (Might try to encrypt user data).
PID:5437