44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6

General

Target

المساعدات النقديه.apk
Size

2.9MB
Sample

240520-3zvxhabf58
MD5

7bf7be6fe91a26626818b7a00c7b25e4
SHA1

537f5248e5c2670ea9f16c42ece3c044fcf1eeee
SHA256

44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6
SHA512

96654fce8604d535a62707fe5ee8a68184bd708e0bcffbd8727d7fe95052cefb3904040669c3ea0dcee1b33c5c38bf58734f2e8f7c34003cbc028329a305cce4
SSDEEP

49152:7SoctcwrcGCxGgAyseVnN4zN41jxpSb5c7rS217Z2V+H82szeTuGHfY:7SYwrcGCxGgAys2Gzu1jx4F+S217sV9Z

Score

8^/10

Malware Config

Targets

- Target
  
  المساعدات النقديه.apk
- Size
  
  2.9MB
- MD5
  
  7bf7be6fe91a26626818b7a00c7b25e4
- SHA1
  
  537f5248e5c2670ea9f16c42ece3c044fcf1eeee
- SHA256
  
  44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6
- SHA512
  
  96654fce8604d535a62707fe5ee8a68184bd708e0bcffbd8727d7fe95052cefb3904040669c3ea0dcee1b33c5c38bf58734f2e8f7c34003cbc028329a305cce4
- SSDEEP
  
  49152:7SoctcwrcGCxGgAyseVnN4zN41jxpSb5c7rS217Z2V+H82szeTuGHfY:7SYwrcGCxGgAys2Gzu1jx4F+S217sV9Z
Score

8^/10

banker collection credential_access discovery evasion execution persistence stealth trojan
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Makes use of the framework's Accessibility service

Prevents application removal

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3