General

  • Target

    0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791.bin

  • Size

    653KB

  • Sample

    240530-21jeeseb52

  • MD5

    4eba04659822ba905fb6824a2b9ceb87

  • SHA1

    a9799bf79a6873d0f8a6ed62beb91a1a4dae1958

  • SHA256

    0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791

  • SHA512

    eb37783a88b580f00c8b6699808b500b86999af0150cec861b76ffbcdf560efba085721697feaa14a5c6676c314586e94ef888f325f76b97f313b41340efb909

  • SSDEEP

    12288:6ZvKYorI1lIFwcA+Dh9lhjEjdU1L94mXu1vU8+F2:k2OlIFwcbB1EjUGmXQvt+F2

Malware Config

Targets

    • Target

      0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791.bin

    • Size

      653KB

    • MD5

      4eba04659822ba905fb6824a2b9ceb87

    • SHA1

      a9799bf79a6873d0f8a6ed62beb91a1a4dae1958

    • SHA256

      0944febd5263fa81bff929a5a42cc2936a7040c91e50a274434a620db228f791

    • SHA512

      eb37783a88b580f00c8b6699808b500b86999af0150cec861b76ffbcdf560efba085721697feaa14a5c6676c314586e94ef888f325f76b97f313b41340efb909

    • SSDEEP

      12288:6ZvKYorI1lIFwcA+Dh9lhjEjdU1L94mXu1vU8+F2:k2OlIFwcbB1EjUGmXQvt+F2

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Prevents application removal

      Application may abuse the framework's APIs to prevent removal.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks