General
-
Target
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b
-
Size
123KB
-
Sample
231003-e7w8jaaa94
-
MD5
39074c61fffeccf21907cd3dbf3ffffe
-
SHA1
329c2e94e8c95a0d588fed72ea7e53fe21ea7837
-
SHA256
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b
-
SHA512
119ec034f5286a2f7b5e78ed563ee18cbb6b8f602abb9001e4fa0248f6ae9bb259998591bc2b839bbad9b1e5412b8425a26f0ff45ec6e4beec1cd54084f5de66
-
SSDEEP
3072:xKoSoUSoJh/U99KFdlvgDG14p4aG7O48SKZxKSp6ZF:xNjAJW6YDQozAOuKZ/a
Static task
static1
Behavioral task
behavioral1
Sample
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral2
Sample
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral3
Sample
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b.apk
Resource
android-x86-arm-20230831-en
Malware Config
Extracted
coper
https://4-u.wtf/
https://fitnessstyle.xyz/
https://sportsstyle.club/
Targets
-
-
Target
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b
-
Size
123KB
-
MD5
39074c61fffeccf21907cd3dbf3ffffe
-
SHA1
329c2e94e8c95a0d588fed72ea7e53fe21ea7837
-
SHA256
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b
-
SHA512
119ec034f5286a2f7b5e78ed563ee18cbb6b8f602abb9001e4fa0248f6ae9bb259998591bc2b839bbad9b1e5412b8425a26f0ff45ec6e4beec1cd54084f5de66
-
SSDEEP
3072:xKoSoUSoJh/U99KFdlvgDG14p4aG7O48SKZxKSp6ZF:xNjAJW6YDQozAOuKZ/a
-
Coper
Coper is an Android banking Trojan with a multi-stage infection mechanism first seen in July 2021.
-
Coper payload
-
Makes use of the framework's Accessibility service.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
-
Acquires the wake lock.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Uses Crypto APIs (Might try to encrypt user data).
-