Extracted

• • Target

    4bafc00c6b5dd6930ec8e91ed757aa313d50859ab7aeab691fcb6d9138f8a69e.bin

  • Size

    286KB

  • MD5

    579a6e476f0d0e5072da9cdf8c4b245d

  • SHA1

    c83ccd95368f820f065c82130b679af50284cd95

  • SHA256

    4bafc00c6b5dd6930ec8e91ed757aa313d50859ab7aeab691fcb6d9138f8a69e

  • SHA512

    5e06a4b38242d4665a8922313fce303ee48e8e497c1a4c4e8e90e7c697fbbacb0e1155363bf98941edfad3297e579c2e1b185630af05413e5bf155e15b760856

  • SSDEEP

    6144:+mw5FwgG3CuoBmCPCHyPL9rJs4aVrT1RKORKyRKtRKgRKTN7EYc:+mwch3YBlCHZjTJZc

  Score

  8^/10

  collectioncredential_accessdefense_evasiondiscoveryevasionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    defense_evasion
  behavioral1behavioral2behavioral3