General

  • Target

    Kaap.apk

  • Size

    8.5MB

  • Sample

    240522-pjc5vsad77

  • MD5

    e36bc41209786c568fb2371c824167fd

  • SHA1

    a887f8a0d806aeb723be1680615331b0677e5410

  • SHA256

    ca9872a126ca593117e4474d35473043e7f9c5d6d1713f1bffc313974e4f940c

  • SHA512

    494b5b4f386f54c18576ca28dbafc1b56970d63ba917434f76e3ea1c0c008b8062cd7dee97693afac2cdbe4b36f78aa10532f604ae8da8010ef50c2865c753ab

  • SSDEEP

    196608:pihLG4rpmbcP8cfiDCMVZ44ejnSUYA4WFuOkUBZd:pOLGNIimMVZ44EnSUYAxTBv

Malware Config

Targets

    • Target

      Kaap.apk

    • Size

      8.5MB

    • MD5

      e36bc41209786c568fb2371c824167fd

    • SHA1

      a887f8a0d806aeb723be1680615331b0677e5410

    • SHA256

      ca9872a126ca593117e4474d35473043e7f9c5d6d1713f1bffc313974e4f940c

    • SHA512

      494b5b4f386f54c18576ca28dbafc1b56970d63ba917434f76e3ea1c0c008b8062cd7dee97693afac2cdbe4b36f78aa10532f604ae8da8010ef50c2865c753ab

    • SSDEEP

      196608:pihLG4rpmbcP8cfiDCMVZ44ejnSUYA4WFuOkUBZd:pOLGNIimMVZ44EnSUYAxTBv

    • Checks if the Android device is rooted.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Checks the presence of a debugger

MITRE ATT&CK Matrix

Tasks