e797d286a36d66a8aebd0149172c229c512cb7f2451dea592588e5368ab6bce6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Adobe_Acrobat_Reader_v24.9.1.35566_MOD.apk
Size

166.9MB
Sample

241001-wjef9awgke
MD5

5dd777de25942d327cf6b803c5500cc7
SHA1

75535185b98c5c8071d65e7568db1a19fb5ce92b
SHA256

e797d286a36d66a8aebd0149172c229c512cb7f2451dea592588e5368ab6bce6
SHA512

76011457a06bc81054d53296e755d7f9eb464d92088e0d83972667693edb9ca3f2048a2dfd3f5a836dbe6fe9d9e9462542358912e6a445067924b10784810ef4
SSDEEP

3145728:AOu2Hy0S12zBQTu7SKqnMZMVOrNcraKXJW+ywRUrBybirpk9G7:a2ju2lquTqggOrqr9XJWDrUbUiM

Score

8^/10

android banker collection discovery evasion execution impact persistence

Malware Config

Targets

- Target
  
  Adobe_Acrobat_Reader_v24.9.1.35566_MOD.apk
- Size
  
  166.9MB
- MD5
  
  5dd777de25942d327cf6b803c5500cc7
- SHA1
  
  75535185b98c5c8071d65e7568db1a19fb5ce92b
- SHA256
  
  e797d286a36d66a8aebd0149172c229c512cb7f2451dea592588e5368ab6bce6
- SHA512
  
  76011457a06bc81054d53296e755d7f9eb464d92088e0d83972667693edb9ca3f2048a2dfd3f5a836dbe6fe9d9e9462542358912e6a445067924b10784810ef4
- SSDEEP
  
  3145728:AOu2Hy0S12zBQTu7SKqnMZMVOrNcraKXJW+ywRUrBybirpk9G7:a2ju2lquTqggOrqr9XJWDrUbUiM
Score

8^/10

banker collection discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Process Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Stored Application Data

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Tasks

static1

behavioral1

bankercollectiondiscoveryevasionexecutionimpactpersistence

behavioral2

bankercollectiondiscoveryevasionexecutionimpactpersistence