irata | a1a1fbdb6070ff388642974b1616d1955c2a89fbb8702caa02fa6927adbdad6c

General

Target

a1a1fbdb6070ff388642974b1616d1955c2a89fbb8702caa02fa6927adbdad6c
Size

4.6MB
Sample

240516-kxla6sda8s
MD5

5f0ce16fd6fe97db0aad3ccf70c5da82
SHA1

5b002f7ce5d7b12fb72c60a8be998aeada8310aa
SHA256

a1a1fbdb6070ff388642974b1616d1955c2a89fbb8702caa02fa6927adbdad6c
SHA512

bd43b24d0cabf96cfb159ed2adc0ff1bf59d1826332ac51e74aef434782486d552f7db19ee0f7cddb798c14c8c873141089065a6826ad8704a5923a2bd5ed74d
SSDEEP

98304:TFhindhin69hinihinxNhinyhin0hinMhinlNoq+rzQgynvtF9VXCIjuKt5E3KiN:TTC7C6bCUCxLCECqCSClalQnvJYIjubp

Score

10^/10

Malware Config

Targets

- Target
  
  a1a1fbdb6070ff388642974b1616d1955c2a89fbb8702caa02fa6927adbdad6c
- Size
  
  4.6MB
- MD5
  
  5f0ce16fd6fe97db0aad3ccf70c5da82
- SHA1
  
  5b002f7ce5d7b12fb72c60a8be998aeada8310aa
- SHA256
  
  a1a1fbdb6070ff388642974b1616d1955c2a89fbb8702caa02fa6927adbdad6c
- SHA512
  
  bd43b24d0cabf96cfb159ed2adc0ff1bf59d1826332ac51e74aef434782486d552f7db19ee0f7cddb798c14c8c873141089065a6826ad8704a5923a2bd5ed74d
- SSDEEP
  
  98304:TFhindhin69hinihinxNhinyhin0hinMhinlNoq+rzQgynvtF9VXCIjuKt5E3KiN:TTC7C6bCUCxLCECqCSClalQnvJYIjubp
Score

8^/10

collection credential_access discovery evasion persistence impact
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
behavioral1 behavioral2 behavioral3