Resubmissions
17/04/2026, 08:38
260417-kj61qacz3w616/04/2026, 17:33
260416-v474mabs8x1016/04/2026, 17:05
260416-vmcamafy5j10Analysis
- max time kernel
12s - max time network
17s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
- submitted
16/04/2026, 17:33
General
- Target 7af5b0d8ce4f436fc408305317bc42df96be82fb21e88dccb14602470c778ab7.apk
- Size 1.9MB
- Sample260416-v474mabs8x
- SHA256 7af5b0d8ce4f436fc408305317bc42df96be82fb21e88dccb14602470c778ab7
Score
10/10
Malware Config
Extracted
Family
-
crocodilus
AES_key
AES_key
Signatures
- Family: Crocodilus
Crocodilus is a banking malware with extensive remote control capabilities first seen in March 2025.
- Crocodilus payload 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
- Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
humorist.preschool.majestic1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information