General

  • Target
    Instagram_src.apk
  • Size 5.4MB
  • Sample241027-ta25vazelp
  • SHA256 dbbe8bb40f158a4a9cb0cbfbdf6f08b08301dfcc88e02352d54583d8770baef2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • airavat

C2
  • https://andronix-551b0-default-rtdb.firebaseio.com

Targets

    • Target
      Instagram_src.apk
    • Size 5.4MB
    • SHA256 dbbe8bb40f158a4a9cb0cbfbdf6f08b08301dfcc88e02352d54583d8770baef2
    • MD5 SHA1 SHA512 SSDEEP
    • Checks if the Android device is rooted.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

    • Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v15

Tasks