Extracted

• • Target
    24e5ff6361c001a4cca066d93c7f446b4de89548c263e1a3d6420d0bd424bdd6
  • Size 10.4MB
  • SHA256 24e5ff6361c001a4cca066d93c7f446b4de89548c263e1a3d6420d0bd424bdd6
  • MD5 7e8c0cbc609a634209a755fba19c9ef5
  • SHA1 71533a04c8111ab28479cb4fbc92859caf01f7f3
  • SHA512 725fe1cf01ab8ceb497037e426246036d925dc62c3bb00d163f278040274603a8e22bf7571ddacba292caa7246aed0941f43dd2740791751ee8a28cef22c3c72
  • SSDEEP 196608:H1OUEdARJ4wSM1ROtz+14WAxmHYQHKcUQA:H1CAROw9RPUmucw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistence

  • Checks if the Android device is rooted.

    defense_evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Reads the content of SMS inbox messages.

    collection

  • Reads the content of the SMS messages.

    collection

  • Acquires the wake lock

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Checks the presence of a debugger

    defense_evasion
  behavioral1