f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6

Target
NosTV.apk
Size 7.0MB
Sample260129-mrx4wsgs2e
SHA256 f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6
MD5 742bd30969e47f290c4081c2c1e58386
SHA1 da372ed626ba7bfe4ae22c988daabfa403ecce93
SHA512 221ccd1265b502070f55bc93e30fc99980d1d55bd6000cebc2b8a02e490aad90e9088f97391b748207e4dec5e9a96f83e86d727a3d06c2cdd2aa6de330bb062f
SSDEEP 196608:6/s+5mg+lnrv/K6bJZhKw0sf130AMOSfNDb:6//g/ZoE1kC8F
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  NosTV.apk
- Size 7.0MB
- SHA256 f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6
- MD5 742bd30969e47f290c4081c2c1e58386
- SHA1 da372ed626ba7bfe4ae22c988daabfa403ecce93
- SHA512 221ccd1265b502070f55bc93e30fc99980d1d55bd6000cebc2b8a02e490aad90e9088f97391b748207e4dec5e9a96f83e86d727a3d06c2cdd2aa6de330bb062f
- SSDEEP 196608:6/s+5mg+lnrv/K6bJZhKw0sf130AMOSfNDb:6//g/ZoE1kC8F
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection credential_access defense_evasion impact
- Checks if the Android device is rooted.
  defense_evasion
- Checks Android system properties for emulator presence.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Declares broadcast receivers with permission to handle system events
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
behavioral1
- Target
  1.apk
- Size 8.0MB
- SHA256 54d4cb45fb7a18780ff2ccc7314b9b51ae446c58a179abbf9e62ce0c28539e8e
- MD5 68299b87c2dd7178c1d9096f4c8da77c
- SHA1 9bfe0d5e97d5fbe526ca43e62acb91bdc833526d
- SHA512 84294753604abf2b820e416cf6f43be129cb1f8d5f9b483f13f4812aeee52b2fc8b7fac1c6adbb260b08a23cc4b188e44bdb7dde1f9b71aff9e8dd9a75eed219
- SSDEEP 49152:4Icyh0tKFD88p6ilZ0Io82vf+xGSJSJIt4+kfWRcBl7om5AgVw43MW60KtxUqFY:52ET0b80NPKnkxW43MHFY
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection credential_access defense_evasion discovery evasion
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2