antidot | 07da124f1f4ba891e7917082bdfa74c580e78543164df2fec86e8b0c3ab0211e

General

Target

07da124f1f4ba891e7917082bdfa74c580e78543164df2fec86e8b0c3ab0211e.apk
Size

22.1MB
Sample

241222-cf29csyphn
MD5

aa57a4376d3a165d9d0aafc23caa77da
SHA1

f3c1542c62835ff06efca5bb46c7d38ce3a6eecf
SHA256

07da124f1f4ba891e7917082bdfa74c580e78543164df2fec86e8b0c3ab0211e
SHA512

dcf859a43bbb9d67417c4d4b43f7c72a501725ee76ff64aa5a4c42c55039aa8ced59851615281e08fc20fb8c7c8f65e6196866809bc05e2bad872cd98dae893f
SSDEEP

196608:OPhoZrDqlTa83cxUJs1sgAXFNgI7a7YSu33Zu9yzhLrZIsnFphv1rnFphvwnFph8:OPyqlTa8MKss3FNgIuc9zhL9bY/+eaB

Score

10^/10

Malware Config

Targets

- Target
  
  07da124f1f4ba891e7917082bdfa74c580e78543164df2fec86e8b0c3ab0211e.apk
- Size
  
  22.1MB
- MD5
  
  aa57a4376d3a165d9d0aafc23caa77da
- SHA1
  
  f3c1542c62835ff06efca5bb46c7d38ce3a6eecf
- SHA256
  
  07da124f1f4ba891e7917082bdfa74c580e78543164df2fec86e8b0c3ab0211e
- SHA512
  
  dcf859a43bbb9d67417c4d4b43f7c72a501725ee76ff64aa5a4c42c55039aa8ced59851615281e08fc20fb8c7c8f65e6196866809bc05e2bad872cd98dae893f
- SSDEEP
  
  196608:OPhoZrDqlTa83cxUJs1sgAXFNgI7a7YSu33Zu9yzhLrZIsnFphv1rnFphvwnFph8:OPyqlTa8MKss3FNgIuc9zhL9bY/+eaB
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Enumerates running processes
  Discovers information about currently running processes on the system
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1