irata | 868ce8fa932c46b6de18455dfc0935a75029cc10c7b484bc358cdfabf0b0c533

General

Target

868ce8fa932c46b6de18455dfc0935a75029cc10c7b484bc358cdfabf0b0c533.bin
Size

4.4MB
Sample

240416-1xwpxadg93
MD5

88956e2b3ca08e5759a8bf279bf49345
SHA1

f547de6d0b8455d76c6584880f87f7854287984b
SHA256

868ce8fa932c46b6de18455dfc0935a75029cc10c7b484bc358cdfabf0b0c533
SHA512

880986e810f39783d34ff088bec18ef2b4346143dac4c2620944899d3b6c3ad0d46c191977881ddf09f25cc332480650f5f668349fa50354db8765b1bb68f277
SSDEEP

98304:zhinthin6thinyhinxdhinihinkhin8hincrKWJxK4/xD2h/J9AI2uvRMRG:dCrC6rCECx7CUC6CiCcrKW9FIhvec

Score

10^/10

Malware Config

Targets

- Target
  
  868ce8fa932c46b6de18455dfc0935a75029cc10c7b484bc358cdfabf0b0c533.bin
- Size
  
  4.4MB
- MD5
  
  88956e2b3ca08e5759a8bf279bf49345
- SHA1
  
  f547de6d0b8455d76c6584880f87f7854287984b
- SHA256
  
  868ce8fa932c46b6de18455dfc0935a75029cc10c7b484bc358cdfabf0b0c533
- SHA512
  
  880986e810f39783d34ff088bec18ef2b4346143dac4c2620944899d3b6c3ad0d46c191977881ddf09f25cc332480650f5f668349fa50354db8765b1bb68f277
- SSDEEP
  
  98304:zhinthin6thinyhinxdhinihinkhin8hincrKWJxK4/xD2h/J9AI2uvRMRG:dCrC6rCECx7CUC6CiCcrKW9FIhvec
Score

8^/10

banker collection discovery evasion persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about the current Wi-Fi connection.
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Acquires the wake lock
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks CPU information

Checks memory information

Makes use of the framework's foreground persistence service

Queries information about the current Wi-Fi connection.

Acquires the wake lock

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3