Overview

overview

10

Static

static

10

5769ae3cc9...32.apk

android-10-x64

7

5769ae3cc9...32.apk

android-11-x64

7

5769ae3cc9...32.apk

android-13-x64

7

5769ae3cc9...32.apk

android-14-x64

7

5769ae3cc9...32.apk

android-15-x64

7

5769ae3cc9...32.apk

android-9-x86

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    5769ae3cc93943dda4d1743f2febf6cec1282a0a6289da68cb55bb4724ec9332.apk
  • Size 2.4MB
  • Sample260120-kx2cdsev8f
  • SHA256 5769ae3cc93943dda4d1743f2febf6cec1282a0a6289da68cb55bb4724ec9332
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
phantomcardandroidcollectioncredential_accessdefense_evasiondiscoveryimpactpersistence

Malware Config

Extracted

Family

  • phantomcard

C2

  • http://43.157.171.245//api/user_logout

  • http://43.157.171.245//baxi/b/?step=

  • http://43.157.171.245/api/user_config

Targets

    • Target
      5769ae3cc93943dda4d1743f2febf6cec1282a0a6289da68cb55bb4724ec9332.apk
    • Size 2.4MB
    • SHA256 5769ae3cc93943dda4d1743f2febf6cec1282a0a6289da68cb55bb4724ec9332
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    collectioncredential_accessdiscoveryimpactpersistencedefense_evasion

    • Checks Android system properties for emulator presence.

      defense_evasion

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries the mobile country code (MCC)

      discovery
    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6

MITRE ATT&CK Mobile v16

Tasks