antidot | dd4bce9274cabcbcb2f3ea2b00867932399ad0de9b923896a70ac03076231efa

General

Target

dd4bce9274cabcbcb2f3ea2b00867932399ad0de9b923896a70ac03076231efa.apk
Size

21.4MB
Sample

241222-c3p8bazqaj
MD5

8c91dc43f9d4198afb494388737d9a62
SHA1

068e991544580f1bc3e2e44e65ca24b6975d6593
SHA256

dd4bce9274cabcbcb2f3ea2b00867932399ad0de9b923896a70ac03076231efa
SHA512

cd59bc2ecbbac7f75511f612744a93a321912a6bfe1be31e619fc78d14c6d0f3a4f37035b811dc867d4c1dcd662ae9fb323c9bac73d519bb5da06e137644e800
SSDEEP

196608:V1BsqKuxF/a0HoJs1sgAXFNgI7a7YSu33Zu9yzhLrZ4CmJB4iyyVbUr8dCL03+YR:VRlS0Hoss3FNgIuc9zhL9L0FQGVR

Score

10^/10

Malware Config

Targets

- Target
  
  dd4bce9274cabcbcb2f3ea2b00867932399ad0de9b923896a70ac03076231efa.apk
- Size
  
  21.4MB
- MD5
  
  8c91dc43f9d4198afb494388737d9a62
- SHA1
  
  068e991544580f1bc3e2e44e65ca24b6975d6593
- SHA256
  
  dd4bce9274cabcbcb2f3ea2b00867932399ad0de9b923896a70ac03076231efa
- SHA512
  
  cd59bc2ecbbac7f75511f612744a93a321912a6bfe1be31e619fc78d14c6d0f3a4f37035b811dc867d4c1dcd662ae9fb323c9bac73d519bb5da06e137644e800
- SSDEEP
  
  196608:V1BsqKuxF/a0HoJs1sgAXFNgI7a7YSu33Zu9yzhLrZ4CmJB4iyyVbUr8dCL03+YR:VRlS0Hoss3FNgIuc9zhL9L0FQGVR
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1