General

  • Target

    Instagram_src.apk

  • Size

    5.5MB

  • Sample

    240927-rnsr8awfql

  • MD5

    3c2332b53bdb1c8f766d3fb98902b10a

  • SHA1

    7b21a68ac09a27e2d5ba6c4f7f9e9d4c59a29ecd

  • SHA256

    1fdcdd2a042fc37b1755fcd3f4bac408d04f783cbde840a2d3c346561b32b49e

  • SHA512

    822f784253d4b6b983877514a4f843159d83fc9ee2d715f00d6cad051c3e19786e75d31b66c35b718ec0718a572220c436f487af1f53e68c2dd585e56ffed82d

  • SSDEEP

    98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL3188UofrFF3NPfw:NrXZJ6nicQHNaf8/IXrJaD1R3Vfw

Malware Config

Extracted

Family

airavat

C2

https://roblox-38872-default-rtdb.firebaseio.com

Targets

    • Target

      Instagram_src.apk

    • Size

      5.5MB

    • MD5

      3c2332b53bdb1c8f766d3fb98902b10a

    • SHA1

      7b21a68ac09a27e2d5ba6c4f7f9e9d4c59a29ecd

    • SHA256

      1fdcdd2a042fc37b1755fcd3f4bac408d04f783cbde840a2d3c346561b32b49e

    • SHA512

      822f784253d4b6b983877514a4f843159d83fc9ee2d715f00d6cad051c3e19786e75d31b66c35b718ec0718a572220c436f487af1f53e68c2dd585e56ffed82d

    • SSDEEP

      98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL3188UofrFF3NPfw:NrXZJ6nicQHNaf8/IXrJaD1R3Vfw

    • Checks if the Android device is rooted.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks