errorfather | 8de28a862aacf7566acbcea299c237180cf399c6dfaac5659642261181c57c1e

General

Target
8de28a862aacf7566acbcea299c237180cf399c6dfaac5659642261181c57c1e.bin
Size 2.9MB
Sample241107-12nj4azaml
SHA256 8de28a862aacf7566acbcea299c237180cf399c6dfaac5659642261181c57c1e
MD5 5ebe0fc63cbabf06185a6062dd9453fb
SHA1 b6fc5eb56e2e8a6132708a8d3475a686c7af8adb
SHA512 36ab079710a10c93fc40dbeaf56e806fdb6b2ec6127e92c4fa8dd85b19e3d71e3181799b67e2dbb3b47c5f20d8fb4e7f400284c0576e917b6a5ac5ed66ce1cea
SSDEEP 49152:5l2tdATYgKoTAp1fi/VuxgiAmJiE5XMFrGiQNA9+vTxFALN:5lRTBTw1GE5XMeNHvTER
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

errorfather

C2

https://api.telegram.org/bot7779906180:AAE3uTyuoDX0YpV1DBJyz5zgwvvVg-up4xo/sendMessage?chat_id=5915822121&text=

Targets

- Target
  8de28a862aacf7566acbcea299c237180cf399c6dfaac5659642261181c57c1e.bin
- Size 2.9MB
- SHA256 8de28a862aacf7566acbcea299c237180cf399c6dfaac5659642261181c57c1e
- MD5 5ebe0fc63cbabf06185a6062dd9453fb
- SHA1 b6fc5eb56e2e8a6132708a8d3475a686c7af8adb
- SHA512 36ab079710a10c93fc40dbeaf56e806fdb6b2ec6127e92c4fa8dd85b19e3d71e3181799b67e2dbb3b47c5f20d8fb4e7f400284c0576e917b6a5ac5ed66ce1cea
- SSDEEP 49152:5l2tdATYgKoTAp1fi/VuxgiAmJiE5XMFrGiQNA9+vTxFALN:5lRTBTw1GE5XMeNHvTER
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3
- Target
  final-signed.apk
- Size 2.6MB
- SHA256 f43476fc30d1a35b442da198ed66be1dfa9287a0cb01dee79f3a7b33a6f221e8
- MD5 4043f234aee4c67f9a20e315ea9a3332
- SHA1 a3bb1f53978e0f37b17147fa7db57867e88f1159
- SHA512 6b49a58010d67089950d80434133d1428e34ac32d88448fa91b24802c959e0f41aec9b62e535d4adf871cf8cb7096399bb8dc9a10e3da9a0a1f2dd1713bf2bcf
- SSDEEP 49152:7gmmUnGnBs1OiimJwEZpOJrg0QrAx1Lb0XCu+YHU1gwCd:7HmUAEZpOUr+b0SunDd
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion
- Checks Android system properties for emulator presence.
  evasion
behavioral4 behavioral5

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Declares services with permission to bind to the system

Requests dangerous framework permissions

Checks Android system properties for emulator presence.

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5