General
-
Target
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
-
Size
3.5MB
-
Sample
250108-dv4amstqdm
-
MD5
4defa7e71f97180dd679875060b2188a
-
SHA1
351c7ed45a11b9fea142c40484d51b56a7084061
-
SHA256
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676
-
SHA512
53e7d453799ca9457bafa0643c6fa36f6f2095a81f081286c714545084328bdc5b3f7e23c511465f5886689bbb673f7ef4646287b76c1021eab226d24f31f6d3
-
SSDEEP
98304:21y8VlJ8f7H8/jRRb4A1RtZLrqOfLDcjzm:ay8V38zH8PbptZL3zDc/m
Behavioral task
behavioral1
Sample
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Targets
-
-
Target
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
-
Size
3.5MB
-
MD5
4defa7e71f97180dd679875060b2188a
-
SHA1
351c7ed45a11b9fea142c40484d51b56a7084061
-
SHA256
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676
-
SHA512
53e7d453799ca9457bafa0643c6fa36f6f2095a81f081286c714545084328bdc5b3f7e23c511465f5886689bbb673f7ef4646287b76c1021eab226d24f31f6d3
-
SSDEEP
98304:21y8VlJ8f7H8/jRRb4A1RtZLrqOfLDcjzm:ay8V38zH8PbptZL3zDc/m
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1