irata | cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84

Resubmissions

16-05-2024 13:59

240516-ravpnagc75 10

16-05-2024 08:38

16-05-2024 08:34

16-05-2024 08:28

15-05-2024 07:41

Sharing

Copy URL

Twitter E-mail

General

Target

cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84.apk
Size

4.6MB
Sample

240516-ravpnagc75
MD5

f54c526d2937c59a44577fdb9852e793
SHA1

10a9ec85a15c0653cbdd368dafa71527825c4f4e
SHA256

cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84
SHA512

71c5b163c0fab875b79485a6eb42ea52aec0ca0c38b3eab4ffa52638e8b26a99edc26d8a689bb6d5b762807e8099891c3e33a1eb74e215b9519c7769c6801891
SSDEEP

98304:CkKdcW23OljvSyC28qG1VNBD0eoD0YD0ND0E+D0nAmD0aD0BD0HWW:ydcW23O56b28qGTNBDmDZDYDUDCjDrDf

Score

10^/10

Malware Config

Targets

- Target
  
  cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84.apk
- Size
  
  4.6MB
- MD5
  
  f54c526d2937c59a44577fdb9852e793
- SHA1
  
  10a9ec85a15c0653cbdd368dafa71527825c4f4e
- SHA256
  
  cad56908abd1508451a5af4a5304de092f0342ec6a24bbbeb9b3988683483c84
- SHA512
  
  71c5b163c0fab875b79485a6eb42ea52aec0ca0c38b3eab4ffa52638e8b26a99edc26d8a689bb6d5b762807e8099891c3e33a1eb74e215b9519c7769c6801891
- SSDEEP
  
  98304:CkKdcW23OljvSyC28qG1VNBD0eoD0YD0ND0E+D0nAmD0aD0BD0HWW:ydcW23O56b28qGTNBDmDZDYDUDCjDrDf
Score

8^/10

collection credential_access discovery evasion persistence impact
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
behavioral1 behavioral2 behavioral3