General
-
Target
instagram.apk
-
Size
5.5MB
-
Sample
240612-nlkgaawfrq
-
MD5
04f4d0c5c669e3a10dd001cce3a33e5c
-
SHA1
f056b0681e4cedd412c1007a9b74ad9832c39460
-
SHA256
22863248801a28d8312ba09fac50a3a9eacddeaf39e1a6fb05e09c8351f81094
-
SHA512
791cacf7c4622e76c4a1a0ba055fe3941b6a692329941ea475111469de6dfd16793333dc7d696eb313aee183d6ea05379872abdde56bbc16f655b91c5d771100
-
SSDEEP
98304:RdgUtVMWIivYb8AptrwAz4/GRA8uNnAlubXWHl8UofrF9JYV6t:RntVDIiQAAptkAc/Ga8uNAKX45V6t
Behavioral task
behavioral1
Sample
instagram.apk
Resource
android-x86-arm-20240611.1-en
Malware Config
Extracted
airavat
https://research-model-8ad6b-default-rtdb.europe-west1.firebasedatabase.app
Targets
-
-
Target
instagram.apk
-
Size
5.5MB
-
MD5
04f4d0c5c669e3a10dd001cce3a33e5c
-
SHA1
f056b0681e4cedd412c1007a9b74ad9832c39460
-
SHA256
22863248801a28d8312ba09fac50a3a9eacddeaf39e1a6fb05e09c8351f81094
-
SHA512
791cacf7c4622e76c4a1a0ba055fe3941b6a692329941ea475111469de6dfd16793333dc7d696eb313aee183d6ea05379872abdde56bbc16f655b91c5d771100
-
SSDEEP
98304:RdgUtVMWIivYb8AptrwAz4/GRA8uNnAlubXWHl8UofrF9JYV6t:RntVDIiQAAptkAc/Ga8uNAKX45V6t
-
Checks if the Android device is rooted.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
Requests enabling of the accessibility settings.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Virtualization/Sandbox Evasion
2System Checks
2