irata | e097bb08da761ae5780e6c600c79738e36285a59589098dde53c88611c1ac66a

General

Target

CopyBara.apk
Size

4.6MB
Sample

240509-rz96mshg27
MD5

cb8e75a3d907ad22eec1bacafce09265
SHA1

00a890a7a862864dfba02fc14c4a154c7ebb3534
SHA256

e097bb08da761ae5780e6c600c79738e36285a59589098dde53c88611c1ac66a
SHA512

bef4a2e1e981761241646a050acbfa75b5ac074c50c9090ee438eb62fded396365830d9f54645fc7a9f082035cc9d4b44e83cdcc0b2145597f302b75e880bb25
SSDEEP

98304:XJrEr8MWEwYaw30Gu7SXKukuG+D0enD0PD0eD0ElD0nAVD0VD0KD0iu/:ZrErQYt3u73ukz+DpDCDHDnDCcDAD3DM

Score

10^/10

Malware Config

Targets

- Target
  
  CopyBara.apk
- Size
  
  4.6MB
- MD5
  
  cb8e75a3d907ad22eec1bacafce09265
- SHA1
  
  00a890a7a862864dfba02fc14c4a154c7ebb3534
- SHA256
  
  e097bb08da761ae5780e6c600c79738e36285a59589098dde53c88611c1ac66a
- SHA512
  
  bef4a2e1e981761241646a050acbfa75b5ac074c50c9090ee438eb62fded396365830d9f54645fc7a9f082035cc9d4b44e83cdcc0b2145597f302b75e880bb25
- SSDEEP
  
  98304:XJrEr8MWEwYaw30Gu7SXKukuG+D0enD0PD0eD0ElD0nAVD0VD0KD0iu/:ZrErQYt3u73ukz+DpDCDHDnDCcDAD3DM
Score

8^/10

banker collection credential_access discovery evasion impact persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Acquires the wake lock
behavioral1