Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Atributos.apk
  • Size 1.7MB
  • SHA256 bf20ad4fcc9fb6910e481a199bb7da649bcd29dd91846692875a3a2c737b83d9
  • MD5 c0211ef7fbb68a885638d86cbc8b6df5
  • SHA1 eb4cdbdbfb2e72bf3ba9de58812765010d4d4238
  • SHA512 34d656db1afdf1c3a53464491b6154ac31834265e536429ec55ae5eb86bf506378457a72349c974c014f2a0d05e9a7ccc6ccb218aa86bfd64d4a9413f5555111
  • SSDEEP 49152:z12xwGz/ZjAD6esCWSSxCytRaAL4lR6VTfdU:h2x9Zk7sZxCyrZ7C
  • TLSH
    T1138523236B9C8C1EFAF38B33DEA762455A3639950D00E9577254B64D09B2EA08F50F63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  collectioncredential_accessdefense_evasionimpact

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  behavioral1behavioral2behavioral3
• • Target
    BackdooredAPK.apk
  • Size 919KB
  • SHA256 082da5ee11c4a5accb5777fbf00a8029f1bec0b41d23649879371e62f00e37fe
  • MD5 151be02fe0fba2ae9b617e73f11d69d5
  • SHA1 d973b382df68d21a0f68bae187908618aa5f64fc
  • SHA512 edd574559799ec3b7564ab3106ff109b8b49bfeea321de0a425651291bd12551ad9e876c4a7a355c2483bf9609c0d4e26ba764d55f17994d9f7fb27bc49fccb2
  • SSDEEP 24576:5BYoVb9qISjYMWJuT01eZDQIxVcAaPkAjHkcUdNuaFGH:5aoVb9qISjLWJ31MMIxVcAaPktcU7uaK
  • TLSH
    T12415D086B34DF827C8778C3642F58B6B6A994C505656E32305A4B22C9DFB9C04F99FCC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4behavioral5behavioral6
• • Target
    COVID-19 Mobile.apk
  • Size 3.7MB
  • SHA256 7711f2515fa68fcb75459a90b9d0102569435cdfbaacb35b23828ab17d6a0987
  • MD5 b7b6ae08971e111291e2dffe48667c42
  • SHA1 ffd2c09b20809ba853bfa0776ae59447ea82d4b7
  • SHA512 0414838b61f594a12cbab985439ab97194b75117562e2a091c0cbab6c029930a36a2b9b0a3781c4972abf6c39f5d4f6aada2588280eedbc7b3d506a566eee7ae
  • SSDEEP 49152:m9Ss93Y1WHU7hd54MpuvgFm5zHYwqxkpoD7Kq+pj5w4x2I/xemQcOqDIPJjb/PZp:m9S63Y1thdhIrw40CzDAxb5USh
  • TLSH
    T1850633B598778A6EDFB73831F64765818208DDDE32543ECFAC60D06F4627E053A83889
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionevasionanubisinfostealerpersistencestealthtrojan

  • Anubis banker

    Android banker that uses overlays.

    bankertrojaninfostealeranubis

  • Anubis family

    anubis

  • Anubis payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  • Listens for changes in the sensor environment (might be used to detect emulation)

    defense_evasion
  behavioral7behavioral8behavioral9
• • Target
    Correos.apk
  • Size 3.3MB
  • SHA256 2277d20669267bbe9ff8a656258af0a33563c18c45cef3624eab67cf123c29a7
  • MD5 cbcee88707cd523d7f1131f26e9dd4af
  • SHA1 3543f776059502a1ae2b9ab76109efba564f82d0
  • SHA512 3f4c8112b1838c5c44bf1884be2e75e1b9fd1742069a329181835d1a2ebb6d09bc5cccf537a71f82c76492b2f750b499f41f10443c6828aea9f41511836555de
  • SSDEEP 98304:ESu7VS+Gi0UE7Lt3gpepwtfAC7jjZRFJXYvJ:NuBB0UEgXtpjj7FJy
  • TLSH
    T1A3F52266AF8DE11BD213E136E266D843C804095C9D08FA6B5B26879C8DF6CC09717FED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionflubotimpactinfostealerstealthtrojan

  • FluBot

    FluBot is an android banking trojan that uses overlays.

    bankertrojaninfostealerflubot

  • FluBot payload

  • Flubot family

    flubot

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral10behavioral11behavioral12
• • Target
    Device Health.apk
  • Size 3.9MB
  • SHA256 86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d
  • MD5 f428eb0d94bdedc983728a056aca7d27
  • SHA1 9f9244c99a4143100bed3b45ec8a6962c421eede
  • SHA512 2474fa5c3350461e7801fd30130ce8d65df690089b6834e0e3670310aff963e2ab760a96bac331d2cb002333eb21018270cd08ff0c94c55e50849613552fdf6d
  • SSDEEP 98304:0OcVtd8n4x6QAP3ftPq3tE2LV62nGxbsTQ9We2ePdlD2AWy:0TyFQa+c+GhMWVH3Df
  • TLSH
    T19016F143F358A52FD577D1360AB70736A1974C0A8A43D7573A18B26C6EBBAC05F84BC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankerdiscovery

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

  • Queries information about active data network

    discovery
  behavioral13
• • Target
    Flash Player.apk
  • Size 1.1MB
  • SHA256 ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c
  • MD5 1512c3fa688ca107784b3c93cd9f3526
  • SHA1 4140c53e9c5b6215cc9706ba53def170858e7f9b
  • SHA512 417bc07d7486135338b0a6374bc73894ddbbfefee0163cd47e73c01a0217af2e3cbb658d8621c1accc685caa491d8a5c31f10c3ed6b0391c65761b4d55d06021
  • SSDEEP 24576:YpzErttEp6VcY3BX5xBay1hgZlc1tpZgoOZgoOZgoOZgo0I:azMbpNJxB11iZS1jSRSRSRSpI
  • TLSH
    T1053533284BFE6178EBC610A0B537D31F26B423A37B244D5590DA949B046DFC79BF8B60
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasioncerberusinfostealerpersistenceratstealthtrojanimpact

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus family

    cerberus

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral14behavioral15behavioral16
• • Target
    FlixOnline.apk
  • Size 1.3MB
  • SHA256 1d097436927f85b1ab9bf69913071abd0845bfcf1afa186112e91e1ca22e32df
  • MD5 7229dc5304cc5f9f5ec4e2af25512c53
  • SHA1 14e8ef9731417bc562ff46d1b09b2fc66fb65b51
  • SHA512 da0d5da32ce30b116e1ee6079c7fe14dbff43af7b9bdf3bcf8e61ebfacacc829f21b4a313f6b7a8095ed061731bc86bf18d6a1e61222e71840d76690d1335006
  • SSDEEP 24576:bfdXTilRgwBFMYthbITnYKaRkivsqqpsbw4GdgNvg/nOUum:bfdDiRXMom7YrRjELHgZg/nOrm
  • TLSH
    T1B555CF42F3C8BD2FCD7781334BB6063651868C5A8A46D7178565B32C6DBBAC05F86BC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoverypersistencecollectioncredential_accessimpact

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral17behavioral18behavioral19
• • Target
    GSERVICES.apk
  • Size 3.6MB
  • SHA256 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd
  • MD5 b50c0f89f10572444392322b8101dbce
  • SHA1 0e3e17d7761e8fb26c39e1d56b51f5e337bffcd8
  • SHA512 14abf83960e05f9adb0d410ef9bad31acb8f5a15696b75cb9080d0dc4a1eb0ff76b61ad8d83d712d7971ae6b0c2f8f409ca5155d8bf6ddf8a10c8737dbb3389d
  • SSDEEP 98304:oK+GT8nfJwobu3GOhk01n7Eu4SYKQpHKRn:+E8feChX01nAuaKQ92
  • TLSH
    T1B3060282F3D9AC2FCDB7D0320BE5063611568D568642E7439960B36CACBBBD45F85BC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectiondefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationstealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Reads the contacts stored on the device.

    collection

  • Reads the content of the SMS messages.

    collection

  • Reads the content of the call log.

    collection

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Tries to add a device administrator.

    privilege_escalationimpact
  behavioral20
• • Target
    Google Play.apk
  • Size 3.8MB
  • SHA256 0ea5ad07e349e3fa5abfe24f11d8e07281f0c43e185b345160db9bdd2cb047f2
  • MD5 732521d712ae0f158852d40c4544dc8e
  • SHA1 c2cc44d1d83d6b2ad2601b5294f477c5c8303f10
  • SHA512 86984af2d1eca3d52718e73b0ac9f39b9f11402998789a0df5b7ae35b7ac99808814c877ee26d0423733852ff53ed528f47321df38181e2500b439877bc2ee4d
  • SSDEEP 98304:HAYCKwvYI+qkYAQEv8DlcMlJz10Xnerumi7n5fTDx9SBjy6/ofrn5D39JMOp29FX:HUtkYAJ8D5qOrc7nl59sjyxA
  • TLSH
    T1A6060186F309982FC877D5324AB6073216575D0A8D83DB5326AC721C5EBBAC44F99FC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectiondefense_evasiondiscoveryexecutionimpactpersistence

  • Checks if the Android device is rooted.

    defense_evasion

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Checks Qemu related system properties.

    Checks for Android system properties related to Qemu for Emulator detection.

    defense_evasion

  • Checks known Qemu files.

    Checks for known Qemu files that exist on Android virtual device images.

    defense_evasion

  • Checks known Qemu pipes.

    Checks for known pipes used by the Android emulator to communicate with the host.

    defense_evasion

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral21
• • Target
    Gutscheine Kostenlos.apk
  • Size 81KB
  • SHA256 7c39c96688b3d95e920035bc0217047a0a4629e42052d9d5ed655ccddabb42ee
  • MD5 851e6e47e8647d259b2bb37584a1ae87
  • SHA1 a800a2623a257a053872d0e0c55615b30ddc14c4
  • SHA512 462aad6cef86643e50f8b45e0ed279c48b1ee24d169c70c3e72e49bf3f8b85a6cc7694a19535389ca18b2bfc77d8f7553611037ae69a932fe1ca984264e2bdb2
  • SSDEEP 1536:bx5WLoe3qW4WuQ7cUkysYOrx734J9R5TKlYjx4uOje5Ub8wx2uXvxZ96VtH:bx5WLogL3LcxNE5+lYjKfjeEFx2oJbQ5
  • TLSH
    T1A98302269FC0AA3BC0F7FB7587D55061F25C60485B8B7233681178289E5F6E23B984DC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  evasionstealthtrojandiscovery

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Acquires the wake lock

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral22behavioral23behavioral24
• • Target
    MainActivity.apk
  • Size 10KB
  • SHA256 65cd2182badf2ce031e9728927c3ccb035f8c5e65905f23ea4de45d4d68b268a
  • MD5 9aac926bc2a513294477e13064e6a71b
  • SHA1 850c554dff0df1908bb4452bbe72b520404d149f
  • SHA512 7fc05f7faf44437c7ea98fa59cbb372ad8473bd88e7245163d8519bee104566a2f1217d1025db558556b976ecfdc2b4f276f4dc3e0335448910bad890dd7a8d7
  • SSDEEP 192:WLt7+5N8D80K5X45RsJsEF8DY0rlBa5GT6yx+fqkWXhUrZ6Aq7Zq:WLt/D8ZX45RXY0rlBPjJXhUrZ6Aqdq
  • TLSH
    T13E22CF3C0AA9C1A0D19FB1B0D2BF3A875F281850B848AF569C1D2269CF37C81E747661
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  • Acquires the wake lock

  behavioral25behavioral26behavioral27
• • Target
    Master Scanner Live.apk
  • Size 3.1MB
  • SHA256 74407e40e1c01e73087442bcdf3a0802121c4263ab67122674d9d09b3edf856e
  • MD5 a13bc7fedb3b0a4d50165c5aeaa626ed
  • SHA1 0c2e6d05d92c15d4ccda62b568906b15e8a22b92
  • SHA512 87d714f79edacb600b35c16147db4e491a76ba49da3622d1075a0af983eb2de4879fb7860896ac009143d63caedb05aa695670d85e3ad4df4b6d932c9ac8f81c
  • SSDEEP 98304:4Jylrkrscnfw67bHolPeN6siRiVN5/CnIHSi:4ur8scn4GbHoReN6FYzp
  • TLSH
    T1D3E533B4EF04595CE0176D79B37762C320165F4886A0EA3F6165B0905BF7FB0A902E6F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionalienbotcerberusinfostealerpersistenceratstealthtrojanexecution

  • Alienbot

    Alienbot is a fork of Cerberus banker first seen in January 2020.

    bankertrojaninfostealeralienbot

  • Alienbot family

    alienbot

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Cerberus family

    cerberus

  • Cerberus payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries account information for other applications stored on the device

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery
  behavioral28behavioral29behavioral30
• • Target
    Postbank.apk
  • Size 54KB
  • SHA256 642da73bc4c78004304dfed2e6e704ebb352ff9f1db19a19cc2296c86164e723
  • MD5 2287daf7c2c7bb6c7af35ee21dd37a5b
  • SHA1 6bb21263290cc0c6d76d01965b8e00af93bb4c89
  • SHA512 807734b76b9898f5a9f9f7337b9ad709ef54a5fcd08eb6a1247c81243d60338409be65c9b1869ddcecac272d06ff784ecd43ee56358b7687a9d2a692d1805a49
  • SSDEEP 768:Rtfi0AqME+vkhEhN5BMqVRX31RtZ+/SbxHBL9ZXzABkgNbIBfLJKvFVw2gTQM:XfgEVEhBDb1RL+/IImghIlJKt+h3
  • TLSH
    T19143E076DB84F85ED037B6B8DA72CBB71ADCA7D403B1763E5100F518885EB88662118F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryevasionstealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Acquires the wake lock

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral31behavioral32