General

  • Target

    or0-tools-v2-best.apk

  • Size

    8.2MB

  • Sample

    250105-1n2vkayqhl

  • MD5

    8c152b84f8d816ee27d9c2dfb1326c4a

  • SHA1

    a332337936c4e8e4a97b0cf6f9a3bfa2a68dd945

  • SHA256

    4fd2360965f4024aad74ffca01dddcc598e2e22a7269b8c106c1b7352c050243

  • SHA512

    6d554458cdd64c0adb0c27d012eca612ee4205c97444d19be830abb70912ac5ee4a31225d64f6722d40a57c6dd2d5b7c8ab4d3c637e1db9099807957a5d80540

  • SSDEEP

    196608:7UWH5mH49NHHqQP8YyD7eOUFAYVgSss4GyjIMi7Lfs4AK9oTp631d:f5mY9NHqQP8YY7nUfmSssTyELk4AQoT+

Malware Config

Targets

    • Target

      or0-tools-v2-best.apk

    • Size

      8.2MB

    • MD5

      8c152b84f8d816ee27d9c2dfb1326c4a

    • SHA1

      a332337936c4e8e4a97b0cf6f9a3bfa2a68dd945

    • SHA256

      4fd2360965f4024aad74ffca01dddcc598e2e22a7269b8c106c1b7352c050243

    • SHA512

      6d554458cdd64c0adb0c27d012eca612ee4205c97444d19be830abb70912ac5ee4a31225d64f6722d40a57c6dd2d5b7c8ab4d3c637e1db9099807957a5d80540

    • SSDEEP

      196608:7UWH5mH49NHHqQP8YyD7eOUFAYVgSss4GyjIMi7Lfs4AK9oTp631d:f5mY9NHqQP8YY7nUfmSssTyELk4AQoT+

    • Checks if the Android device is rooted.

    • Checks known Qemu files.

      Checks for known Qemu files that exist on Android virtual device images.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Checks the application is allowed to request package installs through the package installer

      Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

    • Queries information about active data network

    • Reads information about phone network operator.

    • Checks the presence of a debugger

MITRE ATT&CK Mobile v15

Tasks