General
- Target ZoogVPN-4.1.3.apk
- Size 179.2MB
- Sample260508-rtatlah16s
- SHA256 4807a71a28b296ae0b02056cef4a17ce6316257c2933a99633baf494264dcbff
Score
8/10
Malware Config
Targets
-
- Target ZoogVPN-4.1.3.apk
- Size 179.2MB
- SHA256 4807a71a28b296ae0b02056cef4a17ce6316257c2933a99633baf494264dcbff
Score8/10-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Acquires the wake lock
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
5System Checks
5