antidot | f3dfed0600935c66c5cb48ca9c4d0caa65e01545a63cf9256964af06aa4665ad

General

Target
f3dfed0600935c66c5cb48ca9c4d0caa65e01545a63cf9256964af06aa4665ad.apk
Size 22.1MB
Sample241106-ejvpssvejk
SHA256 f3dfed0600935c66c5cb48ca9c4d0caa65e01545a63cf9256964af06aa4665ad
MD5 b2dff4dee788ee2a57f6ba1fb5d911f2
SHA1 fbbe749bf8d26260d8e2971b0ea31d530227a00b
SHA512 dbb46d154e3be377c48ed10333764e39cd4be6947678499a22df0c643505efef92e3350d007151b7adfadc9f3363774c1e76c35994f038b1dd2b4b40ea22e991
SSDEEP 393216:7o5wd0pc0EPSvsDrLCss3FNgIuc9zhL9xKNuKCEBf0ok:WwGcVD7sFitchHx9Ed0ok
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  f3dfed0600935c66c5cb48ca9c4d0caa65e01545a63cf9256964af06aa4665ad.apk
- Size 22.1MB
- SHA256 f3dfed0600935c66c5cb48ca9c4d0caa65e01545a63cf9256964af06aa4665ad
- MD5 b2dff4dee788ee2a57f6ba1fb5d911f2
- SHA1 fbbe749bf8d26260d8e2971b0ea31d530227a00b
- SHA512 dbb46d154e3be377c48ed10333764e39cd4be6947678499a22df0c643505efef92e3350d007151b7adfadc9f3363774c1e76c35994f038b1dd2b4b40ea22e991
- SSDEEP 393216:7o5wd0pc0EPSvsDrLCss3FNgIuc9zhL9xKNuKCEBf0ok:WwGcVD7sFitchHx9Ed0ok
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

banker collection credential_access discovery evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1