General

  • Target

    243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e

  • Size

    2.9MB

  • Sample

    240410-lz1z3sef3s

  • MD5

    5d892168472ed4a87a60721c02330f15

  • SHA1

    97ead8dec0bf601ba452b9e45bb33cb4a3bf830f

  • SHA256

    243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e

  • SHA512

    e8aa2aecbde4c0385b5027a0920cb4dd3d19267e2ef2155f74d8b90425697c7a5421f31a3d12ee5f6fb904ad82514c9de7f2d1e7d53e43f50aa2b179434ec60a

  • SSDEEP

    49152:x7LP4p94zO8tBKX4wbX447y0duRMQ7NqyuHbEdyqDVMl8aS:xHQF4Y20qNLlzDVeS

Malware Config

Targets

    • Target

      243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e

    • Size

      2.9MB

    • MD5

      5d892168472ed4a87a60721c02330f15

    • SHA1

      97ead8dec0bf601ba452b9e45bb33cb4a3bf830f

    • SHA256

      243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e

    • SHA512

      e8aa2aecbde4c0385b5027a0920cb4dd3d19267e2ef2155f74d8b90425697c7a5421f31a3d12ee5f6fb904ad82514c9de7f2d1e7d53e43f50aa2b179434ec60a

    • SSDEEP

      49152:x7LP4p94zO8tBKX4wbX447y0duRMQ7NqyuHbEdyqDVMl8aS:xHQF4Y20qNLlzDVeS

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about running processes on the device.

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks