antidot | da7b254cb8877278ec38c674b922d54c2af67405694823c2a35f12ebf920891b

General

Target

da7b254cb8877278ec38c674b922d54c2af67405694823c2a35f12ebf920891b.apk
Size

21.8MB
Sample

241106-ea9scstkfv
MD5

2b3ca08304c0da91c95ed3061d247b89
SHA1

fea4c385130a23519a9a6b7cd47a47446482f2d5
SHA256

da7b254cb8877278ec38c674b922d54c2af67405694823c2a35f12ebf920891b
SHA512

4d1ad08c8386f9784bbb132dd59d2da0c94898799bfde17794846da61db4bca9c1f528c656ec56cbacd9644099c29fa57e649dbff946f10217bfc56f0e707e3d
SSDEEP

196608:Ybz6tYtiua3o1hfJs1sgAXFNgI7a7YSu33Zu9yzhLrZ3OZ3mJB4iyyVbUr8hCLDq:Ybz/1aEss3FNgIuc9zhL9+Z30Fkn6

Score

10^/10

Malware Config

Targets

- Target
  
  da7b254cb8877278ec38c674b922d54c2af67405694823c2a35f12ebf920891b.apk
- Size
  
  21.8MB
- MD5
  
  2b3ca08304c0da91c95ed3061d247b89
- SHA1
  
  fea4c385130a23519a9a6b7cd47a47446482f2d5
- SHA256
  
  da7b254cb8877278ec38c674b922d54c2af67405694823c2a35f12ebf920891b
- SHA512
  
  4d1ad08c8386f9784bbb132dd59d2da0c94898799bfde17794846da61db4bca9c1f528c656ec56cbacd9644099c29fa57e649dbff946f10217bfc56f0e707e3d
- SSDEEP
  
  196608:Ybz6tYtiua3o1hfJs1sgAXFNgI7a7YSu33Zu9yzhLrZ3OZ3mJB4iyyVbUr8hCLDq:Ybz/1aEss3FNgIuc9zhL9+Z30Fkn6
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1