General

  • Target

    BLACK RUSSIA [ONESHOT].apk

  • Size

    4.8MB

  • Sample

    240810-q7j4rasclm

  • MD5

    ee0d85288097c9a5ee390610ee6d2713

  • SHA1

    97263f1108d7baadcfc9cae12330f4d1f51cebbc

  • SHA256

    7dadfa7cf63f9416d06dcc29978a11e4c7ebc8e9405d906451fc21de366432a4

  • SHA512

    5c82c2300011dbee04c3b175abc562975a2863a8ede28ef8bcae099e4b629474a24d795efed4efda14dd77ee65d33c68dc818afd3e6967410f9d23646732efcb

  • SSDEEP

    98304:YQMVWUKbKLyqK15iegikmzfzB/Tl0tQywPb:3M7KDqf1iDzh6rA

Malware Config

Targets

    • Target

      BLACK RUSSIA [ONESHOT].apk

    • Size

      4.8MB

    • MD5

      ee0d85288097c9a5ee390610ee6d2713

    • SHA1

      97263f1108d7baadcfc9cae12330f4d1f51cebbc

    • SHA256

      7dadfa7cf63f9416d06dcc29978a11e4c7ebc8e9405d906451fc21de366432a4

    • SHA512

      5c82c2300011dbee04c3b175abc562975a2863a8ede28ef8bcae099e4b629474a24d795efed4efda14dd77ee65d33c68dc818afd3e6967410f9d23646732efcb

    • SSDEEP

      98304:YQMVWUKbKLyqK15iegikmzfzB/Tl0tQywPb:3M7KDqf1iDzh6rA

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Launchs application uninstaller.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks