xamalicious | cfb7b0548c5e87ad9393e4d4184c87f86ca5342dc983ed8c0acf48334cf9e473 | Triage

Sharing

General

Target

cfb7b0548c5e87ad9393e4d4184c87f86ca5342dc983ed8c0acf48334cf9e473
Size

97.3MB
Sample

240920-f3naha1akb
MD5

b7c4139cbe91d892949d991c711463b5
SHA1

172617717c0cabb381795e3238b14e030f9a86d2
SHA256

cfb7b0548c5e87ad9393e4d4184c87f86ca5342dc983ed8c0acf48334cf9e473
SHA512

ed0fb3977c5792f8a297ac29dd338b018545b78cb1608194851666ade3f4caac06fd86862df7b13abf74e1d9e6746e4b51a8d8dd5e6cc23aa03c2692911aff72
SSDEEP

1572864:8BP8fhLwdvNQw8QuDUQGSX7BxZRqVyBS7mBKhrkdCMmbBVCYdMPNiY5VMXHB276:MPSmixGKOVyB0mKaUMAd2idY+

Score

10^/10

xamalicious android discovery evasion impact persistence

Malware Config

Targets

- Target
  
  cfb7b0548c5e87ad9393e4d4184c87f86ca5342dc983ed8c0acf48334cf9e473
- Size
  
  97.3MB
- MD5
  
  b7c4139cbe91d892949d991c711463b5
- SHA1
  
  172617717c0cabb381795e3238b14e030f9a86d2
- SHA256
  
  cfb7b0548c5e87ad9393e4d4184c87f86ca5342dc983ed8c0acf48334cf9e473
- SHA512
  
  ed0fb3977c5792f8a297ac29dd338b018545b78cb1608194851666ade3f4caac06fd86862df7b13abf74e1d9e6746e4b51a8d8dd5e6cc23aa03c2692911aff72
- SSDEEP
  
  1572864:8BP8fhLwdvNQw8QuDUQGSX7BxZRqVyBS7mBKhrkdCMmbBVCYdMPNiY5VMXHB276:MPSmixGKOVyB0mKaUMAd2idY+
Score

8^/10

discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Queries information about active data network
  discovery
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Tasks

static1

behavioral1

discoveryevasionimpactpersistence

behavioral2

discoveryevasionimpact