crocodilus

General

Target
xARGwZe.apk
Size 1.8MB
Sample250528-n9dnmsvxby
SHA256 b9ddc7c5f9adbf012494ab258acd80ab35311b52e3b28f2a78a1d8dad75ab259
MD5 bdbc072887a3a8738798b1deeabd40eb
SHA1 3fb6869199952ffa8c70fb51743a597f1c286802
SHA512 4382613914d0cbc0f2d86848a0fd2df19e511fef4cc0872dac9dd1f91ad247725db661b48385a6abb1c7f52b6b032209fbd251a8205b11d4587fbe356f424e67
SSDEEP 49152:Ugm1ZF1wBfQ2u8lsKxm+YgNZzjySLXlk+gt9vGDqg31474B:O7Sfacm0NJNgt9vGN312q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

crocodilus

C2

http://twtliquidity.pro

Extracted

Family

crocodilus

AES_key

Targets

- Target
  xARGwZe.apk
- Size 1.8MB
- SHA256 b9ddc7c5f9adbf012494ab258acd80ab35311b52e3b28f2a78a1d8dad75ab259
- MD5 bdbc072887a3a8738798b1deeabd40eb
- SHA1 3fb6869199952ffa8c70fb51743a597f1c286802
- SHA512 4382613914d0cbc0f2d86848a0fd2df19e511fef4cc0872dac9dd1f91ad247725db661b48385a6abb1c7f52b6b032209fbd251a8205b11d4587fbe356f424e67
- SSDEEP 49152:Ugm1ZF1wBfQ2u8lsKxm+YgNZzjySLXlk+gt9vGDqg31474B:O7Sfacm0NJNgt9vGN312q
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

crocodilus banker evasion impact infostealer rat trojan
- Crocodilus
  Crocodilus is a banking malware with extensive remote control capabilities first seen in March 2025.
  banker trojan infostealer rat crocodilus
- Crocodilus family
  crocodilus
- Crocodilus payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Crocodilus family

Crocodilus payload

Loads dropped Dex/Jar

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3