Extracted

• • Target

    8d96e3f4c2a10a6b242b0520f494bd5ad1b0d6fd171dae26a033b63504ed691c.bin

  • Size

    381KB

  • MD5

    318d3e72a9a6a1e09b6ef9ecb95fe827

  • SHA1

    0b6d3d97ffd8ad93648b0ba0096426c90206b108

  • SHA256

    8d96e3f4c2a10a6b242b0520f494bd5ad1b0d6fd171dae26a033b63504ed691c

  • SHA512

    24c81586b2d08e9d4aa88afdc0cabdfc98e3dce441f1b281ea2c1b291cea3497802e51cdbd3cd0df16925c2cd47a2835e49fa47124669ffa938fe90b4baf2154

  • SSDEEP

    6144:qA4K2hj7Q7es4aVrT74sVfMJ4sVfM34sVfMW4sVfMZ4sVfMX:qA4K2hXwnjT74yfm4yfy4yf14yfM4yfE

  Score

  8^/10

  collectioncredential_accessdiscoveryevasionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests enabling of the accessibility settings.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3