General
-
Target
RetiredTraveller.apk
-
Size
4.4MB
-
Sample
241125-gfwtss1qgx
-
MD5
5cd7a204d8d9c0dfe4bab9ecab644789
-
SHA1
eb30b0ab26b89e2abf6993662da3702e60e72a6b
-
SHA256
4cd686cd4783d2d3c15b92cb32cd44d135e5265b57249474c84db3648f07221d
-
SHA512
76dbda9a5a27ec19550f1cd74d7304d1c5c262166a200b512ca7587056a7f5742d60bebf522c212f668ef9b690a287bd52c3937f3ec987fa07df6d9bb76ba1b1
-
SSDEEP
98304:iBkPJzBrTbmzwj0tLsl5EokSawsMzFHWe9vdlRmOb/:4mKz/LsRkMsMz99rYOb/
Malware Config
Targets
-
-
Target
RetiredTraveller.apk
-
Size
4.4MB
-
MD5
5cd7a204d8d9c0dfe4bab9ecab644789
-
SHA1
eb30b0ab26b89e2abf6993662da3702e60e72a6b
-
SHA256
4cd686cd4783d2d3c15b92cb32cd44d135e5265b57249474c84db3648f07221d
-
SHA512
76dbda9a5a27ec19550f1cd74d7304d1c5c262166a200b512ca7587056a7f5742d60bebf522c212f668ef9b690a287bd52c3937f3ec987fa07df6d9bb76ba1b1
-
SSDEEP
98304:iBkPJzBrTbmzwj0tLsl5EokSawsMzFHWe9vdlRmOb/:4mKz/LsRkMsMz99rYOb/
Score7/10-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-