f6d53d4a98a8d40f8d8dad1fc6502767d8a52ed956820d7bcecedc08e4f4798e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6d53d4a98a8d40f8d8dad1fc6502767d8a52ed956820d7bcecedc08e4f4798e.apk
Size

22.2MB
Sample

240720-qc2ejszbmn
MD5

c2e4ee18898bd519f156940930289b09
SHA1

dfd736b78b5d5c816bb47cf190ceb5859c6fca81
SHA256

f6d53d4a98a8d40f8d8dad1fc6502767d8a52ed956820d7bcecedc08e4f4798e
SHA512

33b912cf25383c9dd3a26f41299fbfadbe756ecf673f379a0c4fb4ad8204339344cfabf15dbeb93410cb142210cdfc0c7a55f2b08c020d7d98c35b0b517bc660
SSDEEP

393216:awhvPxIEeCr0jbNZsgaUnWQUz3x86Ttt6QIgVBMBqWXKysikEJ80709C:Tles0sRuF6TtqYBMXKysiDO9C

Score

9^/10

android discovery evasion impact persistence ransomware

Malware Config

Targets

- Target
  
  f6d53d4a98a8d40f8d8dad1fc6502767d8a52ed956820d7bcecedc08e4f4798e.apk
- Size
  
  22.2MB
- MD5
  
  c2e4ee18898bd519f156940930289b09
- SHA1
  
  dfd736b78b5d5c816bb47cf190ceb5859c6fca81
- SHA256
  
  f6d53d4a98a8d40f8d8dad1fc6502767d8a52ed956820d7bcecedc08e4f4798e
- SHA512
  
  33b912cf25383c9dd3a26f41299fbfadbe756ecf673f379a0c4fb4ad8204339344cfabf15dbeb93410cb142210cdfc0c7a55f2b08c020d7d98c35b0b517bc660
- SSDEEP
  
  393216:awhvPxIEeCr0jbNZsgaUnWQUz3x86Ttt6QIgVBMBqWXKysikEJ80709C:Tles0sRuF6TtqYBMXKysiDO9C
Score

9^/10

discovery evasion impact persistence ransomware
- Renames multiple (51) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks if the Android device is rooted.
  evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Tasks

static1

behavioral1

discoveryevasionimpactpersistenceransomware