16fa07dcfb58275bbeac8f395cb587b95b57772cf0385c4c8a2f00957883d323 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16fa07dcfb58275bbeac8f395cb587b95b57772cf0385c4c8a2f00957883d323.bin
Size

4.5MB
Sample

240914-1wt5payfjj
MD5

8b6e60b6a1ac0b8f2cda0a2b40df3397
SHA1

e3a13bebe94caf3a4ce3418c4ffb5497c579f536
SHA256

16fa07dcfb58275bbeac8f395cb587b95b57772cf0385c4c8a2f00957883d323
SHA512

727d8880ae2b1777861831b37b05c922544c962caf6d3d67a08734db3abe0c0a3501ca0c243a9aa15a5e8d210f3ed7afbf9a2fc4c5cdf16e6b3781c824b99cb0
SSDEEP

98304:7AV3U+EYdg+qQvgkqFzfruo/C0X9KecWDjt4SszJ9LVvu1yeWIsbojY:7AxU0P/vdqR/CyhcWDjySszXhU9WIVk

Score

8^/10

android banker collection credential_access discovery evasion impact persistence

Malware Config

Targets

- Target
  
  16fa07dcfb58275bbeac8f395cb587b95b57772cf0385c4c8a2f00957883d323.bin
- Size
  
  4.5MB
- MD5
  
  8b6e60b6a1ac0b8f2cda0a2b40df3397
- SHA1
  
  e3a13bebe94caf3a4ce3418c4ffb5497c579f536
- SHA256
  
  16fa07dcfb58275bbeac8f395cb587b95b57772cf0385c4c8a2f00957883d323
- SHA512
  
  727d8880ae2b1777861831b37b05c922544c962caf6d3d67a08734db3abe0c0a3501ca0c243a9aa15a5e8d210f3ed7afbf9a2fc4c5cdf16e6b3781c824b99cb0
- SSDEEP
  
  98304:7AV3U+EYdg+qQvgkqFzfruo/C0X9KecWDjt4SszJ9LVvu1yeWIsbojY:7AxU0P/vdqR/CyhcWDjySszXhU9WIVk
Score

8^/10

banker discovery evasion persistence collection credential_access impact
- Checks if the Android device is rooted.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Declares services with permission to bind to the system
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

behavioral1

bankerdiscoveryevasionpersistence

behavioral2

bankercollectioncredential_accessdiscoveryevasionimpactpersistence

behavioral3

bankercollectioncredential_accessdiscoveryevasionimpact