Extracted

• • Target

    9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.bin

  • Size

    4.7MB

  • MD5

    250bb2e19a5201b2f94c58bade583a48

  • SHA1

    16ed757e508f2b50319479ecadd09bb913b4fc48

  • SHA256

    9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385

  • SHA512

    119dee2a72200bf65f9f835b60cb6e4f1b4e5ae9c188c51bdf3405adc082f46f43593a8bc089c8d99f1dc73b8f82c011c70525e8b77001009630747d7ea657fc

  • SSDEEP

    98304:vB8IlBYuV0wIO3Ca9Vbley/tarfPh+zkYB3XWNTyqOEMK3jQ1:vf7FIO3mYt9q26Q1

  Score

  6^/10

  impact

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3

• • Target

    i.apk

  • Size

    3.7MB

  • MD5

    f8540764ac58575f150cc992ad241a5d

  • SHA1

    eccc50efe5dd4d494b572433a39efa08d8092482

  • SHA256

    594d6694bf83657b974cc4ac6c6fbec14c84680f343d7547f000423dbd5f957d

  • SHA512

    1ac4e29275a3aa70990c26973333e36b5d62b22ca854642fc8295a36f8a9f0e8dcc0cb9ae372f0c49c3b715516af4eefc0bbba87d9bbb22ba59f72f2e0f8f2a9

  • SSDEEP

    98304:ry/wVk+PJgvJQ4boVqLcIJVryNaalQ1szWsUxJ:ry/8YU2PryrJKsUT

  Score

  8^/10

  collectioncredential_accessevasionimpactpersistence

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Acquires the wake lock

  behavioral4behavioral5behavioral6