Overview

overview

8

Static

static

7

0892942b07...08.apk

android-9-x86

8

0892942b07...08.apk

android-10-x64

7

0892942b07...08.apk

android-11-x64

8

Resubmissions

08-01-2023 07:12

230108-h1hy4sgd3s 10

30-08-2022 07:07

220830-hxmswsddgq 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0892942b07717a4fdef6639d02c56ce6ddb8e599529d299facaeda1c0cb16808.zip

  • Size

    3.6MB

  • Sample

    220830-hxmswsddgq

  • MD5

    4d291ffddce396d078d16f10c35d5e2e

  • SHA1

    1d9727aaf55191c9876e7c4b376dc2a6dd027a06

  • SHA256

    0892942b07717a4fdef6639d02c56ce6ddb8e599529d299facaeda1c0cb16808

  • SHA512

    1157293368632554da526e7795b1761877333e9d8eba34ccb21a45305aa88d58781ab42e5a7dfcd279ed23cc6317c6edf0609a175927551919ef60994da02452

  • SSDEEP

    98304:cN6uQZn8I4hoe+t+wgBxtxvAoJ+g2EtoAO2:cEcoft7kL1AdEtoA7

Score
8/10
androidbankerevasionransomware

Malware Config

Targets

    • Target

      0892942b07717a4fdef6639d02c56ce6ddb8e599529d299facaeda1c0cb16808.zip

    • Size

      3.6MB

    • MD5

      4d291ffddce396d078d16f10c35d5e2e

    • SHA1

      1d9727aaf55191c9876e7c4b376dc2a6dd027a06

    • SHA256

      0892942b07717a4fdef6639d02c56ce6ddb8e599529d299facaeda1c0cb16808

    • SHA512

      1157293368632554da526e7795b1761877333e9d8eba34ccb21a45305aa88d58781ab42e5a7dfcd279ed23cc6317c6edf0609a175927551919ef60994da02452

    • SSDEEP

      98304:cN6uQZn8I4hoe+t+wgBxtxvAoJ+g2EtoAO2:cEcoft7kL1AdEtoA7

    Score
    8/10
    evasionransomwarebanker

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries the unique device ID (IMEI, MEID, IMSI).

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks