antidot | a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04

General

Target

Identitas Kependudukan Digital.apk
Size

21.8MB
Sample

250310-kjjkesypy2
MD5

5d0a191d649631ec71b3fac157170201
SHA1

c32f47dc40985a3d6d6c47310e06b7b462d5c711
SHA256

a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04
SHA512

d61af45593a2b934c01d7a7742e69da881ca6474017a78e91683652c2c3e698b9da4be17c5d397ac407df31e00ddaa5da2692e75f9d39c0f16097deda11d8bfe
SSDEEP

196608:26eMt/k6ss4Lmos1sgAXFNgI7a7Yt3Zu9yzhLrZYGlQ1ZXY1uk53A3+j:3eucLLys3FNgIuQ9zhL9BgZXgtMO

Score

10^/10

Malware Config

Targets

- Target
  
  Identitas Kependudukan Digital.apk
- Size
  
  21.8MB
- MD5
  
  5d0a191d649631ec71b3fac157170201
- SHA1
  
  c32f47dc40985a3d6d6c47310e06b7b462d5c711
- SHA256
  
  a2a9fb573c9f39e3654467efd78c9b5424de3033303facad972df1a5f8b2fa04
- SHA512
  
  d61af45593a2b934c01d7a7742e69da881ca6474017a78e91683652c2c3e698b9da4be17c5d397ac407df31e00ddaa5da2692e75f9d39c0f16097deda11d8bfe
- SSDEEP
  
  196608:26eMt/k6ss4Lmos1sgAXFNgI7a7Yt3Zu9yzhLrZYGlQ1ZXY1uk53A3+j:3eucLLys3FNgIuQ9zhL9BgZXgtMO
Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Enumerates running processes
  Discovers information about currently running processes on the system
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1