Overview

overview

10

Static

static

6

6bdfb79f81...41.apk

android-9-x86

10

6bdfb79f81...41.apk

android-10-x64

10

6bdfb79f81...41.apk

android-11-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341
  • Size 1.1MB
  • Sample260508-n6fc3abw5k
  • SHA256 6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
gustuffandroidbankerdefense_evasionevasionexecutioninfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target
      6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341
    • Size 1.1MB
    • SHA256 6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerdefense_evasionevasionexecutiongustuffinfostealerpersistencestealthtrojan

    • Android Gustuff payload

    • Family: Gustuff

      Gustuff is an Android banking trojan first seen in 2019.

      bankertrojaninfostealergustuff

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

      defense_evasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v16

Tasks