General
-
Target
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e.bin
-
Size
3.7MB
-
Sample
250113-w6cwyavmdr
-
MD5
d58d219972f17bb294f45f5a4b8e2ece
-
SHA1
d108988a2b621de10fe4c3400417368760dda771
-
SHA256
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e
-
SHA512
65a83742b04b37e69c841e643557234ff38223571fa74ea0ff8cf7368d73718c83c4e79831b543fa24de53ab37270d34aab9dd482c5a4c0211757b56a6c0d718
-
SSDEEP
98304:B1y8VfJXnGiJJuKFvD78msuex8dE1MrCVwLkci5jq:Py8VxXnGiXuKFnoaOurCokcwjq
Behavioral task
behavioral1
Sample
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral2
Sample
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e.apk
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral3
Sample
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e.apk
Resource
android-x86-arm-20240624-en
Malware Config
Targets
-
-
Target
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e.bin
-
Size
3.7MB
-
MD5
d58d219972f17bb294f45f5a4b8e2ece
-
SHA1
d108988a2b621de10fe4c3400417368760dda771
-
SHA256
955afeef640a6f5b60a086a6aead06e48277fba9d070997ba3d2a52a5e67d04e
-
SHA512
65a83742b04b37e69c841e643557234ff38223571fa74ea0ff8cf7368d73718c83c4e79831b543fa24de53ab37270d34aab9dd482c5a4c0211757b56a6c0d718
-
SSDEEP
98304:B1y8VfJXnGiJJuKFvD78msuex8dE1MrCVwLkci5jq:Py8VxXnGiXuKFnoaOurCokcwjq
-
Tgtoxic family
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Reads information about phone network operator.
-
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1