irata | 9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084

General

Target

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084.apk
Size

4.5MB
Sample

240514-pw8gjaff4w
MD5

99c2d9582ecc4a34e466cf71e6054e84
SHA1

bd73f00c40464602f9a16ce6aeb0cbce62fb6451
SHA256

9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084
SHA512

7398dbccf7f84370280d3c6ed342c9f14e49c78a33930ab437e042f8d1baaf702d2da11c95c7430e4155081576307c64cc4db7bbf2718ba21ff68654b5c342db
SSDEEP

98304:+rrhinthin6thinyhinxdhinihinkhin8hin+r4Kx2N4tOUHKt/TFiqa1:+CrC6rCECx7CUC6CiC+r4KYatOUHY5K

Score

10^/10

Malware Config

Targets

- Target
  
  9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084.apk
- Size
  
  4.5MB
- MD5
  
  99c2d9582ecc4a34e466cf71e6054e84
- SHA1
  
  bd73f00c40464602f9a16ce6aeb0cbce62fb6451
- SHA256
  
  9762eba15b893609b9461125c5adbcaf3bac7fea9536ffca72566abfa1bed084
- SHA512
  
  7398dbccf7f84370280d3c6ed342c9f14e49c78a33930ab437e042f8d1baaf702d2da11c95c7430e4155081576307c64cc4db7bbf2718ba21ff68654b5c342db
- SSDEEP
  
  98304:+rrhinthin6thinyhinxdhinihinkhin8hin+r4Kx2N4tOUHKt/TFiqa1:+CrC6rCECx7CUC6CiC+r4KYatOUHY5K
Score

8^/10

collection credential_access discovery evasion impact persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
behavioral1 behavioral2