019cd4ca5c50bf4e733bc0bee66b5a0c97cf8b0e297d396ccdeabd697ac8d566

General

Target
019cd4ca5c50bf4e733bc0bee66b5a0c97cf8b0e297d396ccdeabd697ac8d566.apk
Size 12.8MB
Sample260202-s7vxcsdx6b
SHA256 019cd4ca5c50bf4e733bc0bee66b5a0c97cf8b0e297d396ccdeabd697ac8d566
MD5 2178546a8d0aaa12bb3e63d7f012c0ce
SHA1 660439d398e71d91dbc8cfce2fdb271d18cde3cc
SHA512 9a2a46380ca6e73f651271212d64ef65f5239df8748d284e620cdfc751a5bee59517bfd1f4ade7315600dc78baea40e1f56ee7fb1c9b8aabfa7de9ee1de075f9
SSDEEP 196608:fELhac4NWk2ZzZyzZ/MkQ8MxfdPDuIUJDzi7uYgH8PpYxF+Yleb9mRy9eknMhzE7:fENajNbwk6JPxZjUJXbQeYmRyE47
TLSH
T162D62386BBC89E2ECC7340324F5AA7355609AD27C707C343C978365C78BB6E44E856E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  019cd4ca5c50bf4e733bc0bee66b5a0c97cf8b0e297d396ccdeabd697ac8d566.apk
- Size 12.8MB
- SHA256 019cd4ca5c50bf4e733bc0bee66b5a0c97cf8b0e297d396ccdeabd697ac8d566
- MD5 2178546a8d0aaa12bb3e63d7f012c0ce
- SHA1 660439d398e71d91dbc8cfce2fdb271d18cde3cc
- SHA512 9a2a46380ca6e73f651271212d64ef65f5239df8748d284e620cdfc751a5bee59517bfd1f4ade7315600dc78baea40e1f56ee7fb1c9b8aabfa7de9ee1de075f9
- SSDEEP 196608:fELhac4NWk2ZzZyzZ/MkQ8MxfdPDuIUJDzi7uYgH8PpYxF+Yleb9mRy9eknMhzE7:fENajNbwk6JPxZjUJXbQeYmRyE47
- TLSH
  T162D62386BBC89E2ECC7340324F5AA7355609AD27C707C343C978365C78BB6E44E856E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion impact
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  update.apk
- Size 12.0MB
- SHA256 f6867133e103926a1666be7c57dee2827020c4c3200952f1ba75468c076483d5
- MD5 455f962a0555adb2a510cf96bcb7fcd0
- SHA1 f8c07ae255c08b17dc8e9f1ac10bafab0ce31856
- SHA512 a53e5e7257772cb96b590d9bc28a13fd16abf44ff76d6f4baff24861aa60c177459522e0725ed20e1c89811f969100436623bf59650f73a36a8346a0f3896335
- SSDEEP 196608:JRveC75GmFAEeLuf8jYdkT825zgcnnY+rs1OYV8+ZpBCXJgDXnvyTs8zDkV:JRveQ5rFzeZ3YAztlrsNHtVnvyOV
- TLSH
  T1A5C62345F7D89E2ECC7340364F6B663655496D63C74AC343C978325C28BBAE48E81BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral2