antidot | 518f74277c26b9ca91a2fe4aeabb26ae9b675a5e2e1bc6bdbe53067183477071

General

Target

518f74277c26b9ca91a2fe4aeabb26ae9b675a5e2e1bc6bdbe53067183477071.apk
Size

22.2MB
Sample

241106-c4zhdatbjc
MD5

6c931cd859ff33219517e0fd82623e5f
SHA1

2034bc66a0e51216ec9a384e0a7c45d1a5b233d7
SHA256

518f74277c26b9ca91a2fe4aeabb26ae9b675a5e2e1bc6bdbe53067183477071
SHA512

ac2d1f80d1d6ce181601d167ac3d7b1fe3253b2ccc2f43382537d89cf1b2ed2c04372661be4f296592aeb88722d809729b765f5e7f85da61fb645ad69d184b33
SSDEEP

393216:JfC89x5Ta6Lnass3FNgIuc9zhL9fY/+ekl:J9v5OW7sFitchHfi+Hl

Score

10^/10

Malware Config

Targets

- Target
  
  518f74277c26b9ca91a2fe4aeabb26ae9b675a5e2e1bc6bdbe53067183477071.apk
- Size
  
  22.2MB
- MD5
  
  6c931cd859ff33219517e0fd82623e5f
- SHA1
  
  2034bc66a0e51216ec9a384e0a7c45d1a5b233d7
- SHA256
  
  518f74277c26b9ca91a2fe4aeabb26ae9b675a5e2e1bc6bdbe53067183477071
- SHA512
  
  ac2d1f80d1d6ce181601d167ac3d7b1fe3253b2ccc2f43382537d89cf1b2ed2c04372661be4f296592aeb88722d809729b765f5e7f85da61fb645ad69d184b33
- SSDEEP
  
  393216:JfC89x5Ta6Lnass3FNgIuc9zhL9fY/+ekl:J9v5OW7sFitchHfi+Hl
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Enumerates running processes
  Discovers information about currently running processes on the system
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1