antidot | 0af689da84a03383863583dcad6c640ba4ab9762affde3d56c199a9eb08e9f41

General

Target

M-Pajak.apk
Size

22.2MB
Sample

241021-rxexqaxejd
MD5

75faa8e3b2cae0d41561a0e4e63c5eac
SHA1

ec358f63b45940bb8f6675d69391b5ca591bf3f1
SHA256

0af689da84a03383863583dcad6c640ba4ab9762affde3d56c199a9eb08e9f41
SHA512

ee6bc16cd86b4996515aeca347342b1001f313ac4bce514b86a22719c32c3ae63ef616b9804a0b828af549c5d384d1fb21d9bf0305f3e4f4a7bd0d41a803aa0f
SSDEEP

196608:uvc4oayxD6neRJi68tCHH58Js1sgAXFNgI7a7YSu33Zu9yzhLrZPsnFphv1rnFpD:ubumeW6uCHOss3FNgIuc9zhL9pY/+ekC

Score

10^/10

Malware Config

Targets

- Target
  
  M-Pajak.apk
- Size
  
  22.2MB
- MD5
  
  75faa8e3b2cae0d41561a0e4e63c5eac
- SHA1
  
  ec358f63b45940bb8f6675d69391b5ca591bf3f1
- SHA256
  
  0af689da84a03383863583dcad6c640ba4ab9762affde3d56c199a9eb08e9f41
- SHA512
  
  ee6bc16cd86b4996515aeca347342b1001f313ac4bce514b86a22719c32c3ae63ef616b9804a0b828af549c5d384d1fb21d9bf0305f3e4f4a7bd0d41a803aa0f
- SSDEEP
  
  196608:uvc4oayxD6neRJi68tCHH58Js1sgAXFNgI7a7YSu33Zu9yzhLrZPsnFphv1rnFpD:ubumeW6uCHOss3FNgIuc9zhL9pY/+ekC
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Enumerates running processes
  Discovers information about currently running processes on the system
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1