Extracted

• • Target

    e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673.zip

  • Size

    8.5MB

  • MD5

    ff748bdc4fcb780b1b70236b7d8bf539

  • SHA1

    35e580c0e3c1859a8cad0fe61f02643b71d0194c

  • SHA256

    e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673

  • SHA512

    d8487c3a738e5d867c7d4e24607fe0cac2093fea09e218786bf95633a73854acc9aa8f8dc3a53d7c3e8ca077bbcb3869a7bc4c10c5305e14ae987d5ec029b393

  • SSDEEP

    49152:km1m+8pMrS90PP+u5f1M8tlGKO5dtVd6QK3PP9Mzy/S7KmzHzdGGyQTOOZwUgYqz:vm+Qx2blgIQUX2zy/fmzHzBdTv0twj0

  Score

  8^/10

  bankercollectioncredential_accessdiscoveryevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Legitimate hosting services abused for malware hosting/C2

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3