Extracted

• • Target

    17cf95ba7c320703392d85ade1c11f2d8c2d8d0bd02ff68e062450f1341c9ac0.bin

  • Size

    4.7MB

  • MD5

    a345903a787e8baf81dd928dd792b82c

  • SHA1

    bb6b2eb4a372eed635b53e7e9ecc2db1c78b77b5

  • SHA256

    17cf95ba7c320703392d85ade1c11f2d8c2d8d0bd02ff68e062450f1341c9ac0

  • SHA512

    b3b888344e8ffa04be85e207f69ecb5b7656336f7d7469428630dcc3aed41086ea2023a41d7b623dc42734fde9fe1af41ec075e107f449d79a267b5e60bc9e5b

  • SSDEEP

    98304:17pGxZ9t0bZ0KIHWlM1nedIod7d9hLMcm/rnEwzCw4zH5:1FGxZspIHWOwy+NQcSrnEwC7zH5

  Score

  6^/10

  impact

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3

• • Target

    i.apk

  • Size

    3.7MB

  • MD5

    3b8ce99f1c395ed9384fdd1d0b096104

  • SHA1

    7a4132b21003b1cc3cdf5a306cf956df87e7c978

  • SHA256

    856e5326e78fafaa75bdbb550a680ad8e6eb88c67c477e09d6a45d9804eac7fa

  • SHA512

    2548564dea13bff2d57b833733a2e2ea26f140675425ee6b54dbcd889b59962fd82f035117efc710bc02debaef5d3cdd4900ba145185dcdbe0d95861ad6e624e

  • SSDEEP

    98304:XC6kUn6DX8C+Smco1FnrDJexQ1z7qsWgYoOWz4:0UnQs4wXUxQz7qujOWM

  Score

  8^/10

  collectioncredential_accessevasionimpactpersistence

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Acquires the wake lock

  behavioral4behavioral5behavioral6