Extracted

• • Target

    c4ffcc636a0cd535ed86ae31c5311a9da7a0951f62b41f98d229d680a8ba574d

  • Size

    15.7MB

  • MD5

    e2251311fc8acf5de09952fc451a752e

  • SHA1

    f2c651584be93d84f7ea66e2c2c5dc4ebcb1d058

  • SHA256

    c4ffcc636a0cd535ed86ae31c5311a9da7a0951f62b41f98d229d680a8ba574d

  • SHA512

    f31add99459b749071ae7e5e940ac3e440aae5f17dfa335ffbae9f5ee00d434c7cd2448d94c74166a556fb503e56462541313c9861e41e6494dff37448088210

  • SSDEEP

    24576:YoWgP6AWRuEjdpP4V9YeNkA1LJQX0qQxnh:lvYwPY09k0Xxh

  Score

  8^/10

  collectioncredential_accessevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3