General

  • Target

    cc80278ed980926ee76e1ea6a33f76572d5548980f869adf2ef6cca8b861d6ab.apk

  • Size

    4.4MB

  • Sample

    241119-nprprsvpcz

  • MD5

    7d60bf170580084431701212e24a8670

  • SHA1

    9691de6021724450c5e804560528334ae9254548

  • SHA256

    cc80278ed980926ee76e1ea6a33f76572d5548980f869adf2ef6cca8b861d6ab

  • SHA512

    5e5d2d5d968d957603a12dd5b37df33cb52128347df477c185149109ed99b11316ac0ecf857743098cb47fae29702bbda73cd57c635c7ff8a53ac300a29d410d

  • SSDEEP

    98304:QAhKercbmvSMRI3w5S71pEFYUvD0eYD0MD0ZD0ESD0nA6D0+D0xD0md/:FgyvSMB5SnEFYkDiD9DEDEDCnDvD4DD5

Malware Config

Targets

    • Target

      cc80278ed980926ee76e1ea6a33f76572d5548980f869adf2ef6cca8b861d6ab.apk

    • Size

      4.4MB

    • MD5

      7d60bf170580084431701212e24a8670

    • SHA1

      9691de6021724450c5e804560528334ae9254548

    • SHA256

      cc80278ed980926ee76e1ea6a33f76572d5548980f869adf2ef6cca8b861d6ab

    • SHA512

      5e5d2d5d968d957603a12dd5b37df33cb52128347df477c185149109ed99b11316ac0ecf857743098cb47fae29702bbda73cd57c635c7ff8a53ac300a29d410d

    • SSDEEP

      98304:QAhKercbmvSMRI3w5S71pEFYUvD0eYD0MD0ZD0ESD0nA6D0+D0xD0md/:FgyvSMB5SnEFYkDiD9DEDEDCnDvD4DD5

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests accessing notifications (often used to intercept notifications before users become aware).

MITRE ATT&CK Mobile v15

Tasks