General
- Target SBI Cards (1)_sign (1).apk
- Size 5.1MB
- Sample260511-kv8npahs5p
- SHA256 2cd9e4201a7801bfe950744fa49180140f74508616acd33b27cd509c0d61d550
- MD5 d9eb9413c59255b7b962454f371183a7
- SHA1 a21b948ebdc5924faf449878d843fa95301a2217
- SHA512 ff74c70d6a8ebcfd0d3460a91856aef8d01a406f1febd7a0e12561280fb65047180f1dbecd0cba1b380e442331a41fa26eb56957ea2e69ea0022dd5f7e9bd61e
- SSDEEP 98304:VdN8NTHWhR+cF6HXMg7lwSZGpvv1E/xTXnmAyRbktBsKsx:V1hR+HxpnAd1WrmAy0SKsx
- TLSH T11736E086FB84A92BC4F7933A457A5632014B4C068F83D7C76948733C68BB9D41F99BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x86-arm-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x64-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
SBI Cards (1)_sign (1).apk
Resource
android-x64-arm64-20260325-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target SBI Cards (1)_sign (1).apk
- Size 5.1MB
- SHA256 2cd9e4201a7801bfe950744fa49180140f74508616acd33b27cd509c0d61d550
- MD5 d9eb9413c59255b7b962454f371183a7
- SHA1 a21b948ebdc5924faf449878d843fa95301a2217
- SHA512 ff74c70d6a8ebcfd0d3460a91856aef8d01a406f1febd7a0e12561280fb65047180f1dbecd0cba1b380e442331a41fa26eb56957ea2e69ea0022dd5f7e9bd61e
- SSDEEP 98304:VdN8NTHWhR+cF6HXMg7lwSZGpvv1E/xTXnmAyRbktBsKsx:V1hR+HxpnAd1WrmAy0SKsx
- TLSH T11736E086FB84A92BC4F7933A457A5632014B4C068F83D7C76948733C68BB9D41F99BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks if the Android device is rooted.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Queries the phone number (MSISDN for GSM devices)
Reads the content of the SMS messages.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Queries the mobile country code (MCC)
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Tasks
static1
ratarsinktrojaninfostealerghostbat
Score
10/10
behavioral1
collectiondefense_evasiondiscoverypersistence
Score
8/10
behavioral2
collectioncredential_accessdefense_evasiondiscoveryimpactpersistence
Score
8/10
behavioral3
collectioncredential_accessdefense_evasiondiscoveryimpactpersistence
Score
8/10