antidot | fe4b2b288565cc1a85b7dd23398cc8ab850b0b0c73d46ec9e7c308af86a96d60

General

Target

M-Pajak.apk
Size

22.1MB
Sample

250310-kmmq9ayzhx
MD5

c7dd3e08e9f1d2c16ac9d51aaeb4c1cf
SHA1

db342f35467cad79035f0fa2b77fdb427cf981d0
SHA256

fe4b2b288565cc1a85b7dd23398cc8ab850b0b0c73d46ec9e7c308af86a96d60
SHA512

7b769e0d24a6e6da4801752b5fe5903d671e3ff629dad2daa33fa2c754b84aaa1865643699b170cc11e9a0d72d5c5b51c78e0a3b77afc9749aee3969db5c8b7f
SSDEEP

196608:UPCoCv1HxcjCVWy5RtVUs1sgAXFNgI7a7Yt3Zu9yzhLrZY/snFphv1rnFphvwnFF:UYMjCVWy/Zs3FNgIuQ9zhL93Y/+edD

Score

10^/10

Malware Config

Targets

- Target
  
  M-Pajak.apk
- Size
  
  22.1MB
- MD5
  
  c7dd3e08e9f1d2c16ac9d51aaeb4c1cf
- SHA1
  
  db342f35467cad79035f0fa2b77fdb427cf981d0
- SHA256
  
  fe4b2b288565cc1a85b7dd23398cc8ab850b0b0c73d46ec9e7c308af86a96d60
- SHA512
  
  7b769e0d24a6e6da4801752b5fe5903d671e3ff629dad2daa33fa2c754b84aaa1865643699b170cc11e9a0d72d5c5b51c78e0a3b77afc9749aee3969db5c8b7f
- SSDEEP
  
  196608:UPCoCv1HxcjCVWy5RtVUs1sgAXFNgI7a7Yt3Zu9yzhLrZY/snFphv1rnFphvwnFF:UYMjCVWy/Zs3FNgIuQ9zhL93Y/+edD
Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Enumerates running processes
  Discovers information about currently running processes on the system
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1