tanglebot | e83f32f70ed8b6d83972eac4225d5ab55734deb95d6e094464730f781b215c6d

General

Target

Au Bank.apk
Size

8.0MB
Sample

250324-ppvxvszvbw
MD5

8f565d12c2f974604024a2b5d972e3ad
SHA1

47f4ea058e20d3fb915dfdb87fba60f895441a1a
SHA256

e83f32f70ed8b6d83972eac4225d5ab55734deb95d6e094464730f781b215c6d
SHA512

0ea4eab244097825f5c0d81b39bfa97ded3e4c185fa259fc0c771c204a2137288c0268cc015150137ed4ef49a5feb2c73077a0d8fe952471e6b733d61d14ec2f
SSDEEP

196608:IJc+Nvw7d0mN/jqRd5AdOSChP8Muaq8Wt615UzrzejfD9ccS:D+ml+RdC5ChPR8lt615Oe/9cj

Score

10^/10

Malware Config

Targets

- Target
  
  Au Bank.apk
- Size
  
  8.0MB
- MD5
  
  8f565d12c2f974604024a2b5d972e3ad
- SHA1
  
  47f4ea058e20d3fb915dfdb87fba60f895441a1a
- SHA256
  
  e83f32f70ed8b6d83972eac4225d5ab55734deb95d6e094464730f781b215c6d
- SHA512
  
  0ea4eab244097825f5c0d81b39bfa97ded3e4c185fa259fc0c771c204a2137288c0268cc015150137ed4ef49a5feb2c73077a0d8fe952471e6b733d61d14ec2f
- SSDEEP
  
  196608:IJc+Nvw7d0mN/jqRd5AdOSChP8Muaq8Wt615UzrzejfD9ccS:D+ml+RdC5ChPR8lt615Oe/9cj
Score

6^/10
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  rex.apk
- Size
  
  5.9MB
- MD5
  
  7592b1770a1d0d5e669f8823d7ce6227
- SHA1
  
  afcad66bb5bff1d2398404ff9120b0b0302fa8c8
- SHA256
  
  0b9a995068927a901a45dfc103d707f47615ecac92706ae9169f4329b65569a5
- SHA512
  
  e8f34c11f88a8d13a5f985b753d6e9f91b21be0e3f92aad30daf98205190a221a92b732701ec94ab1c2c0018eac62e358cee09d37198b88f8907f2d64b6bca0d
- SSDEEP
  
  98304:yKd2ZrR7Wa+1Q2EVHlfv0wSZQV6Ipst7YhbDAhtlLxxFKyRbg3O+GCXnmqU:TNY0n9IeZwbDAhtl1eyFImqU
Score

8^/10

collection defense_evasion discovery persistence credential_access impact
- Checks if the Android device is rooted.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the SMS messages.
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral3 behavioral4 behavioral5