General
- Target SBI Cards (1)_sign (1).apk
- Size 5.1MB
- Sample260511-kv8npahs5p
- SHA256 2cd9e4201a7801bfe950744fa49180140f74508616acd33b27cd509c0d61d550
- MD5 d9eb9413c59255b7b962454f371183a7
- SHA1 a21b948ebdc5924faf449878d843fa95301a2217
- SHA512 ff74c70d6a8ebcfd0d3460a91856aef8d01a406f1febd7a0e12561280fb65047180f1dbecd0cba1b380e442331a41fa26eb56957ea2e69ea0022dd5f7e9bd61e
- SSDEEP 98304:VdN8NTHWhR+cF6HXMg7lwSZGpvv1E/xTXnmAyRbktBsKsx:V1hR+HxpnAd1WrmAy0SKsx
- TLSH T11736E086FB84A92BC4F7933A457A5632014B4C068F83D7C76948733C68BB9D41F99BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x86-arm-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x64-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target SBI Cards (1)_sign (1).apk
- Size 5.1MB
- SHA256 2cd9e4201a7801bfe950744fa49180140f74508616acd33b27cd509c0d61d550
- MD5 d9eb9413c59255b7b962454f371183a7
- SHA1 a21b948ebdc5924faf449878d843fa95301a2217
- SHA512 ff74c70d6a8ebcfd0d3460a91856aef8d01a406f1febd7a0e12561280fb65047180f1dbecd0cba1b380e442331a41fa26eb56957ea2e69ea0022dd5f7e9bd61e
- SSDEEP 98304:VdN8NTHWhR+cF6HXMg7lwSZGpvv1E/xTXnmAyRbktBsKsx:V1hR+HxpnAd1WrmAy0SKsx
- TLSH T11736E086FB84A92BC4F7933A457A5632014B4C068F83D7C76948733C68BB9D41F99BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the SMS messages.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Tasks
static1
ratarsinktrojaninfostealerghostbat
Score
10/10
behavioral1
collectiondefense_evasiondiscoverypersistence
Score
8/10
behavioral2
collectioncredential_accessdefense_evasiondiscoveryimpactpersistence
Score
8/10
behavioral3
collectioncredential_accessdefense_evasiondiscoveryimpactpersistence
Score
8/10