Extracted

• • Target
    3cde7fbacfa3d9384f8600e7836cdeca.apk
  • Size 14.9MB
  • SHA256 c49f5ff0ff3626a4352ac6a56b074f3cdd744f80b376b9363ad62741da85e6be
  • MD5 3cde7fbacfa3d9384f8600e7836cdeca
  • SHA1 3ca2a2a11f326f3787b8ca95d71f8e7b687713e4
  • SHA512 1629b62a956af732cba9c1fe2caee064c0de2e9378754c6aff83f9f7df6d3870d510b536b0eb94a5b516f31f11313150a361cdc65a5a20eb8ec3bdb9af5694b0
  • SSDEEP 393216:Yv7PIgzb3W1n8X6lwjHBI7ZgHQ92Dvl+fJs:yAFTwbB2ZIi2Dvl+hs
  • TLSH
    T184F6230AFF44796EC9F7523754BA99294C434C0447C3DD87A9A9B41C1CBB6F0AB29BC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryevasionpersistencecollectioncredential_accessimpact

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2behavioral3
• • Target
    base.apk
  • Size 9.5MB
  • SHA256 cbef3531aa8704fd14170849702afb0ac97cdb17b4e147b84f37cc8c69958ceb
  • MD5 29851c4002e3b9cb0cd5b63d75a7b30b
  • SHA1 8fec80c2c2e32a181f59f21eed56a15ce3d49e9f
  • SHA512 cefed97e6d95076a98b196581a311f1cbc87d3f8261ac64ef36a432473aee48baf642cc15c46f25d9eadcd8bf9f4b7fef34b09c1e6620bf9898d71ec11f34ed2
  • SSDEEP 196608:Du1wWwPLCLH+QN4ut1eMS10vurkwu7pBwYao4tVHtRnS2ODMs5yziB3:a1xwPmLH+luHeF/rkXHlKHO2M5yziF
  • TLSH
    T13DA63313B343EE8AD473AA310D60A7D081792E28CF83425BB666727D6CFA9D44F13E55
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Listens for changes in the sensor environment (might be used to detect emulation)

    defense_evasion
  behavioral4