Overview

overview

7

Static

static

7

06bd97deb8...b9.apk

android-9-x86

7

06bd97deb8...b9.apk

android-10-x64

7

06bd97deb8...b9.apk

android-11-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06bd97deb8ffad39178f63920d081c88e507f13782f3aaceac02be252d046fb9

  • Size

    1.8MB

  • Sample

    221126-s2eceseb22

  • MD5

    48eae2e689e87ca4b32136d6022e9a9c

  • SHA1

    f68e74a7833fb0bcaddd8c7f78b04d9624dae971

  • SHA256

    06bd97deb8ffad39178f63920d081c88e507f13782f3aaceac02be252d046fb9

  • SHA512

    244038e1ed02f93945d435fa40dc435c1f3ba1eb53ecaa15c507a2b7b6c2cf3b1951a5678e06c67a6676a39158f2ba2f2e4734de31643839d82dc87f461df6ea

  • SSDEEP

    49152:G4UubVS1ajDu533LWcThB/d9T+x0pUVjKQiQCllw7CiHlOdDHB8molg3L:tUubVgWDc33KAhB1I2pUsQiQCllfhXoK

Score
7/10
androidevasionransomware

Malware Config

Targets

    • Target

      06bd97deb8ffad39178f63920d081c88e507f13782f3aaceac02be252d046fb9

    • Size

      1.8MB

    • MD5

      48eae2e689e87ca4b32136d6022e9a9c

    • SHA1

      f68e74a7833fb0bcaddd8c7f78b04d9624dae971

    • SHA256

      06bd97deb8ffad39178f63920d081c88e507f13782f3aaceac02be252d046fb9

    • SHA512

      244038e1ed02f93945d435fa40dc435c1f3ba1eb53ecaa15c507a2b7b6c2cf3b1951a5678e06c67a6676a39158f2ba2f2e4734de31643839d82dc87f461df6ea

    • SSDEEP

      49152:G4UubVS1ajDu533LWcThB/d9T+x0pUVjKQiQCllw7CiHlOdDHB8molg3L:tUubVgWDc33KAhB1I2pUsQiQCllfhXoK

    Score
    7/10
    evasionransomware

    • Acquires the wake lock.

    • Checks Android system properties for emulator presence.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests dangerous framework permissions

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks