massiv

Target
NosTV.apk
Size 7.0MB
Sample260310-wc44bse13v
SHA256 f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6
MD5 742bd30969e47f290c4081c2c1e58386
SHA1 da372ed626ba7bfe4ae22c988daabfa403ecce93
SHA512 221ccd1265b502070f55bc93e30fc99980d1d55bd6000cebc2b8a02e490aad90e9088f97391b748207e4dec5e9a96f83e86d727a3d06c2cdd2aa6de330bb062f
SSDEEP 196608:6/s+5mg+lnrv/K6bJZhKw0sf130AMOSfNDb:6//g/ZoE1kC8F
TLSH
T10276CF87EB818C6AC4FF533AA876036127335D5597838F831949B278BCB75C45E89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NosTV.apk
- Size 7.0MB
- SHA256 f9a52a923989353deb55136830070554db40f544be5a43534273126060f8c1f6
- MD5 742bd30969e47f290c4081c2c1e58386
- SHA1 da372ed626ba7bfe4ae22c988daabfa403ecce93
- SHA512 221ccd1265b502070f55bc93e30fc99980d1d55bd6000cebc2b8a02e490aad90e9088f97391b748207e4dec5e9a96f83e86d727a3d06c2cdd2aa6de330bb062f
- SSDEEP 196608:6/s+5mg+lnrv/K6bJZhKw0sf130AMOSfNDb:6//g/ZoE1kC8F
- TLSH
  T10276CF87EB818C6AC4FF533AA876036127335D5597838F831949B278BCB75C45E89BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion massiv impact infostealer rat trojan
- Massiv
  Massiv is a banking trojan first seen in February 2026.
  banker trojan infostealer rat massiv
- Massiv family
  massiv
- Massiv payload
- Checks if the Android device is rooted.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Declares broadcast receivers with permission to handle system events
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
behavioral1
- Target
  1.apk
- Size 8.0MB
- SHA256 54d4cb45fb7a18780ff2ccc7314b9b51ae446c58a179abbf9e62ce0c28539e8e
- MD5 68299b87c2dd7178c1d9096f4c8da77c
- SHA1 9bfe0d5e97d5fbe526ca43e62acb91bdc833526d
- SHA512 84294753604abf2b820e416cf6f43be129cb1f8d5f9b483f13f4812aeee52b2fc8b7fac1c6adbb260b08a23cc4b188e44bdb7dde1f9b71aff9e8dd9a75eed219
- SSDEEP 49152:4Icyh0tKFD88p6ilZ0Io82vf+xGSJSJIt4+kfWRcBl7om5AgVw43MW60KtxUqFY:52ET0b80NPKnkxW43MHFY
- TLSH
  T119862B07BE017F6BC0DDBA3515678A45B7318C8B7767037AE604BA6CBCB2085C7A5B84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests enabling of the accessibility settings.
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2