General

  • Target

    latamAirLines2.apk

  • Size

    14.0MB

  • Sample

    241209-h1392szrdt

  • MD5

    cd5939950d495ac26b4252e0214d0574

  • SHA1

    1fcfaff96a0099d338ad11f5f1d0dd45825ff684

  • SHA256

    1ff6cb1101b94809c6138bf221235469c9690fe45bd844f5c918e61b71db13ef

  • SHA512

    d939312999aefd5c71d3b7226c7c5eaafb94c237c28bdd2c660ed2d015b4956361d70cfc340fb792741ee5e2a3922096c3334b3c446d9c7c3628b84247d8a3a1

  • SSDEEP

    393216:9C9cpMJqxX+4j9TUXJ3hL9cw7h9c8oDVgKww:9COMgpTU2kh9pAVHww

Malware Config

Targets

    • Target

      latamAirLines2.apk

    • Size

      14.0MB

    • MD5

      cd5939950d495ac26b4252e0214d0574

    • SHA1

      1fcfaff96a0099d338ad11f5f1d0dd45825ff684

    • SHA256

      1ff6cb1101b94809c6138bf221235469c9690fe45bd844f5c918e61b71db13ef

    • SHA512

      d939312999aefd5c71d3b7226c7c5eaafb94c237c28bdd2c660ed2d015b4956361d70cfc340fb792741ee5e2a3922096c3334b3c446d9c7c3628b84247d8a3a1

    • SSDEEP

      393216:9C9cpMJqxX+4j9TUXJ3hL9cw7h9c8oDVgKww:9COMgpTU2kh9pAVHww

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries account information for other applications stored on the device

      Application may abuse the framework's APIs to collect account information stored on the device.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

MITRE ATT&CK Mobile v15

Tasks