Extracted

• • Target
    5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2
  • Size 6.6MB
  • SHA256 5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2
  • MD5 079c14eb237a32c2d7897e46a22fff7e
  • SHA1 e0ddaa8052421451442276b763c797f6fce0339f
  • SHA512 d93503002648c2e40514059635c2ed723d3b49f899ae92ccd628dd68ee21d837aaf4d7165cba7f8010d7a118d2c6fa4c41983a99595613ff7655d3fbf7bb7d22
  • SSDEEP 196608:3kyBaKsrhXLA6cofiiJdrXjqDTjqqLUlu23/uoo4:JaxlAcRtUqeg/uoo4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoorcollectioncredential_accessdefense_evasiondiscoveryevasiondarknimbusinfostealerpersistencetrojan

  • DarkNimbus

    DarkNimbus is an Android backdoor used by the Earth Minotaur threat actor.

    backdoortrojaninfostealerdarknimbus

  • DarkNimbus payload

  • Darknimbus family

    darknimbus

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Reads the contacts stored on the device.

    collection

  • Reads the content of the browser bookmarks.

    collection

  • Reads the content of the call log.

    collection

  • Acquires the wake lock

  behavioral1behavioral2behavioral3