Extracted

• • Target

    c7411c0daff520468c3accff4318076a66034b2d14cbae08a5d3ecec2c6ce9ed.apk

  • Size

    262KB

  • MD5

    c7f7f2541de29ec01eadcbe8351c4652

  • SHA1

    2efc433d4a9a9491b59d0a3eff30a15c4f5bf589

  • SHA256

    c7411c0daff520468c3accff4318076a66034b2d14cbae08a5d3ecec2c6ce9ed

  • SHA512

    582805862a0d2ab5af8e01f2207e3681d6f61cc2171d39fc74e22e5455cce9b1608319d28fc66174e6278d8fbdf14142e987dc8309dceaf6cd498e93433b17e9

  • SSDEEP

    6144:f00p82jt82jU82je82jU82jDxpw9E+y9ED5lS2NWVa:fXjJjgjajQjMv5D5k2Nd

  Score

  8^/10

  collectioncredential_accessdefense_evasiondiscoveryevasionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    defense_evasion
  behavioral1behavioral2behavioral3