Extracted

Extracted

• • Target
    - Память Вирус.apk
  • Size 618KB
  • SHA256 fa503f37815c493bf69151fe4dcc8277e1314f58ec547a60723bfe4909a9d717
  • MD5 82be366e786cc2cc44c3f050ae41a0fa
  • SHA1 d4161f037d49d5188e598ddbe3e759c51da0d082
  • SHA512 9b795dd5ce40d82133d39a9f1f81b9fb991072725b8db0d9d9ef9c8107f463b33d29161f6dd8f2bc4b0fe91c49f8e7708938d9c2f05460f603146795ac90446d
  • SSDEEP 12288:A/gEtp5LpaFD3uRNhCV+tuzyyPeUCiKc9J59GFmgF4xVbUrUmygYHXA9pbU:CNtJaFiRuUtueYVGc9JCIgFkVbUrvy3f
  • TLSH
    T12BD423C371EB9F2EE61251FD4F22313DA1A8F968B492CC0B175B36123542EAE54D9F21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2behavioral3
• • Target
    1_1176770182396248092.apk
  • Size 488KB
  • SHA256 03fdc546d08dadab6d83194ccd0348aaa917d375367fd514faaeb8b5d5c2c620
  • MD5 2d3809d0ee53106847c070fa8505aaad
  • SHA1 f77cb0c887452522aa0b1867dab0d531e1850d15
  • SHA512 88be7eef97458cf38aed92e1fc5fd85c53261e7cd5e1ebc7a4699121ce556726cedb5ece49c0eaca46acde88fe0cdc81ef04c1765032dbb396e726149f4e3899
  • SSDEEP 12288:3x7Oox5k6Fx2StRceR9JzWWJysSNAncO6bi6/PLutsTlfATPUDa:38ox70Srce8WJaicO8i6PKtsTqPl
  • TLSH
    T1B5B42314CE9CFF92E1F797B9AA731511FB0F94528902F303909A714D09B992335B63AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discoverypersistence

  • Acquires the wake lock

  • Queries the mobile country code (MCC)

    discovery
  behavioral4
• • Target
    2_5267499572879431632.apk
  • Size 2.6MB
  • SHA256 2fa3229fe01e0615861cd8f4d03aa64ed6640b4c9f84dc395e25c91002c07a12
  • MD5 aa82c709f5863c5e167d419d45e11670
  • SHA1 b3e81da648b43c581f7374e1a54a20b9c6831e13
  • SHA512 820cbf2a667b82e7826685e173a4c134534c7d4b69a477960d7796e6d9f2c66e57a1eb8dc8daee33491847d65f6fbb68a0daba8bcc4c6fdfcfeca999ccc0da34
  • SSDEEP 49152:AA+VHmypbx2Pc4tdrqok6vFIRjTg3RLsM1CjwBoAyC9a0W07zPNywYV7KHe:AAEGylmtdr93vFmvgZsHcbyhSzah
  • TLSH
    T1C6C51276BAADE01AD953E4399061B50BC808301C454AFAD71FB5C78C8FEBD889746ECD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryimpactpersistencecollectioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery
  behavioral5behavioral6
• • Target
    Dilshod.apk
  • Size 2.8MB
  • SHA256 41752e7b3d8374ec74b94ebc258a0fefd3d41a44bb07a43d85546701afb50e36
  • MD5 84e73c6c1a69ac3f3dedd5119080f19d
  • SHA1 65fffa7ab8f7a3ff5154b6c69a3ee31186c9d012
  • SHA512 ed3678dab2f80bafcf4c80bd095829cf54088c72e6f32bac58031b0270e06d32e4729898fab250f194113bb3046c47f97965f8f728f292d33ba8e9acf6fe0e30
  • SSDEEP 49152:0V1yqxc7abNLn7WvcWgEhaj+10GbHr9wzWhcAqL4iR9YO791fWFwGOLV31+snp4N:m1yqxOabNLn7RkKw0GbazjL4ZOOFwGO2
  • TLSH
    T17FD50182F3D9BC2BCC73C03353AA063625568D158E46E7472954B36C9DFBAE44A85FC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasiondiscoverytruthspyinfostealerspywaretrojan

  • Truthspy

    Truthspy is an Android stalkerware.

    trojaninfostealerspywaretruthspy

  • Truthspy family

    truthspy

  • Checks if the Android device is rooted.

    defense_evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Checks the presence of a debugger

    defense_evasion
  behavioral7
• • Target
    Telegram Sirlari.apk
  • Size 310KB
  • SHA256 7d878638b3460f064148c74f94e79f4b224c25f68e19736d77505cf9e11ab304
  • MD5 d62fe6a51cd012f5872687ae3b17108f
  • SHA1 6de386e2a9fe5d75a0854d71ba67678c34f195aa
  • SHA512 9936e8232a89d0f4e127717b6b1c815097fc6feb66055bd51b15c13e738ad281319c589cd63af27ed5f83a251420cfa0c85fe9b9ab5ba9fee8ab271b2a8738ee
  • SSDEEP 6144:iWqa4Beu2KbvguZymBGL3bJB+bJBHbJB7bJBx:itXeuBbvgu/gjbT+bTHbT7bTx
  • TLSH
    T15C64121308682A97C25A8F7901753A87DBF43A06EF00724B9D67B5F0EDF5BE60D1E264
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  persistence
  behavioral10behavioral8behavioral9
• • Target
    Zarina Nizomidinova.apk
  • Size 3.4MB
  • SHA256 f3fcd84b4e92a52ae5b30df003b911f21b2ea4325f788d5a5decc08582d3fd40
  • MD5 bc61ea3a7c3514ea6980bd1d696e5f47
  • SHA1 a96397e81b3d1e0a4b87f78875b7f398cffba582
  • SHA512 a2b6764ad1897f8318ef9da86009a1b7ea7ed1231f8cf917673d344d12238f1027b81fdeef40ef540cbf1c4d4f0a0296c32d05be2d089fd0ffdf29453377f089
  • SSDEEP 98304:zozciV9hN6Ixq5n0j5XYz+hYz+EYz+cYz+w:zSciV9hN6Id6dKqR
  • TLSH
    T1A3F50192B3EA461AF2BB8F36A77100412C797D856A35D78E0351717C1DB3F808AA1F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  persistence
  behavioral11behavioral12behavioral13
• • Target
    gen_signed.apk
  • Size 184KB
  • SHA256 8ec195cd1f5c9f66c75000f26120832d7e1a9044fe3699d18d676bd5739b8518
  • MD5 69119c73ed5417445b2d24952ff428e7
  • SHA1 4694bc2e23eac8acbb501220c2a722ae6ce90610
  • SHA512 45b25cddfb0424998714e65f1595fbfca89b70cc5a4abb7fae6297aaf9b811b03f46f8148f81af3b7311f352d3db6ed441186cfd612824b813fe3c75202678a0
  • SSDEEP 3072:Yulq8duqQqj7yVtIw3Ng5kQi3PJg7u3sw6ou64UU/U7Xji02U9ziqJH6/h9uYL:YGQqPyVtT3Cu/RguZwxUUui02U9zbaJj
  • TLSH
    T10D0412CC85F39622EED751FF113F197372E95B6AFF9BE10264075810C8A7A9E8465032
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  persistence
  behavioral14behavioral15behavioral16
• • Target
    Андроид Краш.apk
  • Size 1.6MB
  • SHA256 46394f86e0a698c8f35408637eb3260db7643bf50c70d9fe2532b24b24f5aa2f
  • MD5 6535dc47906013368ec74d3d5cad2037
  • SHA1 57a5181ee1f9edb7de583ceef3a56cb2a1a0ae49
  • SHA512 238c993df475126056d68620493a07eb127b8cc919fc6c398e5449119eab7622b2dd64919d9729857d5ce4474218f4586d17a8c8e99dc7f833f301d54e8e9880
  • SSDEEP 49152:crHVlxJlkGeEIyqBhDy+UwHH9Vgv6JrFbOnJD:crHVl/lkGJ3Io+UwJJrFAD
  • TLSH
    T1CC75F181F3D87C2FCCB784364BB64B6A155A8C5ACA46D35345A4B12C9EBBDC08E81FC5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18behavioral19
• • Target
    Блокирует и просит пароль вирус.apk
  • Size 182KB
  • SHA256 570e2811e8c87f714eb3485c271ec03b9de699c6b7f67e858a24396ce5f7b69e
  • MD5 0acc9de2781b08b37c9021d2bdd53276
  • SHA1 48b7a37baa148c7eb89ce12dc205a0c986accf11
  • SHA512 91bd7f46917646835468160c0697710009f211236141b5a2efcc3f91229755e8f3dde6ed4fda5cfd5587ae69bbd0942f467f430fbe9037990073bfaa8bd5e57a
  • SSDEEP 3072:IqlIqa4yubjFrQ9ejSu25k9mi31Jg7u3sw6oJNY3RcB8dFbgmP1zh99QU:I7qa4Beu2KbvguZymBGLYU
  • TLSH
    T1640413D64DF76781C74A6B3CD76D2F827BF8656F1701F2066912E0B0E8337898589B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  persistence
  behavioral20behavioral21behavioral22
• • Target
    Заморозка и фотка лайка.apk
  • Size 478KB
  • SHA256 ead9b166d2a8d50ba3f20f04ff85a9b0ec39d3347d4d0e98d53c2d0e2daa4d18
  • MD5 7b8182a16b38eb8d31947bbf08943d22
  • SHA1 491936b697a89e5f073e214374ca30e9161e639d
  • SHA512 83a1ae09c90d0deda2196c248422e7b5cb7865dea7c0a4e4ac86a15bc589f02578a92270af74aab0e00e9c3ab1b06d443eebac4de179617e6e3d322a314b0be2
  • SSDEEP 12288:+DmFY0LDuuqgEsu7ULmTBeOk7s9773AO49VQ2IFFZFn:+b0LPc6LCBeOxDAXTQ2IZ5
  • TLSH
    T152A423660D0AF32FC20C46FB8F137D0A79B534A871AD5AE98334757B089F6991484FE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24behavioral25
• • Target
    Телефон_удалится_ядро_через_24часа.apk
  • Size 5.0MB
  • SHA256 0c41a6b7c502d2b21d3a42817339dcb64f4d00ce94941d7b951cef899bb9e68e
  • MD5 8e782cf1cbffcb2ea98eb149377dd588
  • SHA1 fc342d3ebaec088b8b42bc15cd9f84c17d631aec
  • SHA512 81f5fc7b9426ea8657d9b01aa5605e828142a7eba8b0849730ed372213b727a53152707c80efe1dbad0bbc73e41f45416b1f3323b0c9b094f6b11264321946e5
  • SSDEEP 98304:j4fvPqeKs1v5txtqM+W7v1sPQjep2+A6YmnzGF8DQZo:1MuWmK+dA6YyGykG
  • TLSH
    T175363321ADBA20A2EC456B358DC40519CC1783D7CAD2FCEAF98D6ACC2F11794DDB7099
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistence

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery
  behavioral26behavioral27behavioral28
• • Target
    заморозка и одна картинка.apk
  • Size 573KB
  • SHA256 4432ad819fc2a2628c90ec43cb746ca515e37c0413960f8598d1507d847eae20
  • MD5 1fb77a81e134d732d70d2743d5e754d1
  • SHA1 92dd3f53d8e437e6e3bfd89a19f8c5c5b7c86898
  • SHA512 435c731b0357c23cb37d7a758ca5568421e8b6f89db05e302c1d6df4555993c2a1e59f5133037c5a6ffdbe8ecea7eef4a59dfa874c84d05e278b1039dc41d761
  • SSDEEP 12288:4Ix2hbcdRIsyMEuYq2hbcE2hbcxoyK6TjoX371SQZ:18hIjIsyMHYfhI1hIxG6071So
  • TLSH
    T1B4C4221B54E2C307E426D3FC79A31F5001A31B9A5A8DBECF6197658F2DD0CA398E825D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30behavioral31
• • Target
    سکس ایرانی.apk
  • Size 3.0MB
  • SHA256 52b11991a7f54f351fdc2d6bb80564840671c1d82f2b2d0c4df038f51708a62c
  • MD5 aea3978f165fe143d60e2eb5d7f663fe
  • SHA1 445a53c4246ed06a3aa58cf2eec17340dd223b46
  • SHA512 2707316c9930f406a8090fc5313b49fb390e6f1385a143e046c220031a4cb619fff61e315be47c04d009a553a6ba369b224567532899199e9d846528cd887925
  • SSDEEP 49152:xu7YWUcB/5d8wctdFUyBIcxmvPqO2HF4z29HKJyOTSgd5gMi9LBiNgfVVBD6+:2UcJ5dnKQy6wQPqOKA2vqSgd5gMKysp
  • TLSH
    T174E5F252B3FA9A28F2F76F35E975519259B9FD829E35C11E0200B11C0DB7E809B50FA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  bankercollectiondefense_evasiondiscoveryevasionexecutionpersistencestealthtrojan

  • Checks if the Android device is rooted.

    defense_evasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests cell location

    Uses Android APIs to to get current cell location.

    collectiondiscoverydefense_evasion

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery
  behavioral32