Extracted

• • Target

    4ab2df8a1e6d63b3849b3d10dd0692a4efc26e824e0e30290608f840358bfe63.bin

  • Size

    381KB

  • MD5

    38ce3303fde588f59d3be231acc05a27

  • SHA1

    3c332332438e5331d51cdfb5c91d9caf6ea35a99

  • SHA256

    4ab2df8a1e6d63b3849b3d10dd0692a4efc26e824e0e30290608f840358bfe63

  • SHA512

    842d1c822afba68038a7e5c0b36ebc1627eb057ea425b5cfd0b6cc55a9545f1df327dd97701001d85699bc4529cdf0549b26d74246a6077e340cb1c7f11fefc0

  • SSDEEP

    6144:+5z91fUh9H1aMJghgDjP1xTFs4aVrTr4sVfMV4sVfML4sVfMS4sVfMN4sVfMD:+5zoh9S+ndBijTr4yfy4yf24yfR4yfgY

  Score

  8^/10

  collectioncredential_accessevasionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests enabling of the accessibility settings.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3