General
-
Target
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564.bin
-
Size
4.5MB
-
Sample
240612-24x2zsyaln
-
MD5
a1f36b2ada4b63b50eeb482777b44e90
-
SHA1
3e8d8e074202ba2c2f49f83c094a85a761cc6b29
-
SHA256
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564
-
SHA512
addbb9e51b1ae4bd30bd5e491be8feb28d8bea361f35e97cb24676d32bae0c5f0646dcb33cfa7c908ebe5d8772860292d104ecd81d18864a21ec5bf89c44627e
-
SSDEEP
98304:MLUhinlhin6Vhinahinx1hin6hinshinUhinlOLxs2GpMIpW5OUHFvhTDvKSMoR6:MLKCzC6DC8CxjCcCyCKClOu2GaUUlBwj
Behavioral task
behavioral1
Sample
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564.apk
Resource
android-x64-arm64-20240611.1-en
Malware Config
Targets
-
-
Target
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564.bin
-
Size
4.5MB
-
MD5
a1f36b2ada4b63b50eeb482777b44e90
-
SHA1
3e8d8e074202ba2c2f49f83c094a85a761cc6b29
-
SHA256
6b15d8508e6782c25dc48618bbbe9b53c8c9a822655a8e52b7370e034fae7564
-
SHA512
addbb9e51b1ae4bd30bd5e491be8feb28d8bea361f35e97cb24676d32bae0c5f0646dcb33cfa7c908ebe5d8772860292d104ecd81d18864a21ec5bf89c44627e
-
SSDEEP
98304:MLUhinlhin6Vhinahinx1hin6hinshinUhinlOLxs2GpMIpW5OUHFvhTDvKSMoR6:MLKCzC6DC8CxjCcCyCKClOu2GaUUlBwj
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1