6cb701376e36e7f58bdd0c6d06902f52d9e84c0e6d415faff7f20be366e97b04

General

Target
Viber_Messenger_v24.0.1-b.0_MOD_modded-1.com.apk
Size 123.6MB
Sample241113-rzy4datfpp
SHA256 6cb701376e36e7f58bdd0c6d06902f52d9e84c0e6d415faff7f20be366e97b04
MD5 59eaf19b2d9eaf822a480466eb26ce9d
SHA1 e274555fd3cc7ddfa841220b6707ba266ec92cc8
SHA512 f04d9e3363559fd274da342c3b649bcea511045008a50175d7a1213a5ea09178b3aa54ff953cf86c0ce70a6880247feab29c805c908e2bfe3ccb6be676cc0832
SSDEEP 786432:mrylvHF+F0jSY8BkgY+96WI9rMdio8+DTbpTGBkB+rJRlwnipRiAQQQQQQQQQQQN:NlbSY9DCgoDHpThYNp4tfW7xjupAK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  Viber_Messenger_v24.0.1-b.0_MOD_modded-1.com.apk
- Size 123.6MB
- SHA256 6cb701376e36e7f58bdd0c6d06902f52d9e84c0e6d415faff7f20be366e97b04
- MD5 59eaf19b2d9eaf822a480466eb26ce9d
- SHA1 e274555fd3cc7ddfa841220b6707ba266ec92cc8
- SHA512 f04d9e3363559fd274da342c3b649bcea511045008a50175d7a1213a5ea09178b3aa54ff953cf86c0ce70a6880247feab29c805c908e2bfe3ccb6be676cc0832
- SSDEEP 786432:mrylvHF+F0jSY8BkgY+96WI9rMdio8+DTbpTGBkB+rJRlwnipRiAQQQQQQQQQQQN:NlbSY9DCgoDHpThYNp4tfW7xjupAK
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection credential_access discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  evasion
- Checks Android system properties for emulator presence.
  evasion
- Checks Qemu related system properties.
  Checks for Android system properties related to Qemu for Emulator detection.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Reads the content of the call log.
  collection
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  evasion
behavioral1