Extracted

• • Target
    sohbet-aligned-debugSigned.apk
  • Size 3.7MB
  • SHA256 b3462bfe5adceab334afe1bf8318c0332c023ecf6c6da8edcbc008e1a1f562d6
  • MD5 a9df12268799db5621687dfb857fa882
  • SHA1 f7d2d7e32fc8844e9793f62ef300892d55218f0b
  • SHA512 1d972f5dbb76eafaa179855c85c38dcac039b2fb8d339879181615b46a920c49ed9e6ec75816450a5e50ad451724595c9c35247eaea3e2ece7d9286b09db06a6
  • SSDEEP 49152:uxp1cijpFUgwZcO3v/XK6Sf2oc4ImznzdGGEQTORXUGYqk0cg42oyEWWgmUa:uxpuCpF9wD3XDS/ImznzBTTT0t49yZa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3