antidot | c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16

General

Target

c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16.apk
Size

23.4MB
Sample

250220-em6w8swmaz
MD5

9b4aaaebca0f904234d371475d3dcc6a
SHA1

fdbd2957048a9564a923bda70d68ab292bcb7540
SHA256

c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16
SHA512

d8ad4d4d10747264e2ef960dcef5e70049ca7eab102fbd02ea07982e01b6af2130f95856694a9ebe0f3bcc3e2512a8bca92f944b1b5aa9f54a0cf5e34ecd67cd
SSDEEP

393216:HehX6Cksss3FNgIuc9zhL9XmENEuEyIlRrU:+hXedsFitchHXT+U

Score

10^/10

Malware Config

Targets

- Target
  
  c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16.apk
- Size
  
  23.4MB
- MD5
  
  9b4aaaebca0f904234d371475d3dcc6a
- SHA1
  
  fdbd2957048a9564a923bda70d68ab292bcb7540
- SHA256
  
  c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16
- SHA512
  
  d8ad4d4d10747264e2ef960dcef5e70049ca7eab102fbd02ea07982e01b6af2130f95856694a9ebe0f3bcc3e2512a8bca92f944b1b5aa9f54a0cf5e34ecd67cd
- SSDEEP
  
  393216:HehX6Cksss3FNgIuc9zhL9XmENEuEyIlRrU:+hXedsFitchHXT+U
Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1