Extracted

• • Target
    25d40a4e3771a238f3dbc21b5602c022dcddbebb382abe7b0611746b167df4bd
  • Size 10.8MB
  • SHA256 25d40a4e3771a238f3dbc21b5602c022dcddbebb382abe7b0611746b167df4bd
  • MD5 11ca01bd2fd24300c352cc352ca16806
  • SHA1 598d8796872eb183f95ce30789c95ccecf0d7b15
  • SHA512 3662e6f2a98fc1e2f02157ac5e0734e89f0291c1e1c9c981898e1580a7a9c11fe342e8e766690f571497cbc1df09d6a06a807af63d9e00f55a05983f179d1125
  • SSDEEP 98304:WgqUfmyXGDPE2AvxIVd5N1yrWdGIwBEBZrnfrQVCbz2iEwlo/Kr8nH:WgJoPE2+xIfj14WAxmHYQHq9H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  collectioncredential_accessdefense_evasiondiscoveryimpactpersistence

  • Checks if the Android device is rooted.

    defense_evasion

  • Checks known Qemu files.

    Checks for known Qemu files that exist on Android virtual device images.

    defense_evasion

  • Checks known Qemu pipes.

    Checks for known pipes used by the Android emulator to communicate with the host.

    defense_evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Reads the content of SMS inbox messages.

    collection

  • Reads the content of the SMS messages.

    collection

  • Acquires the wake lock

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1