c7ecfc9b6b617442ed4569104113d470f8afda0da41993a125c01792209c2d3e

General

Target
Mparivahan.apk
Size 11.3MB
Sample260602-appcrahx9s
SHA256 c7ecfc9b6b617442ed4569104113d470f8afda0da41993a125c01792209c2d3e
MD5 e108db0630f52a0fa5335737755c2f3a
SHA1 cf127e4bfe70237dfdc21c51954feaa4ad5861f8
SHA512 fd12ef5d078d11e990b67cc7be017840d3ca27d77290436749ca083715d8c34d4b99caf411b8269ba6bb027a7cc480c680c8925ca9d17f9a19c79ebc11e8c35d
SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K/:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgm
TLSH
T198C633ADB231335DD677A23061841DE34E02C574AB0E34B1B8A0277E4DDB6F69369B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Mparivahan.apk
- Size 11.3MB
- SHA256 c7ecfc9b6b617442ed4569104113d470f8afda0da41993a125c01792209c2d3e
- MD5 e108db0630f52a0fa5335737755c2f3a
- SHA1 cf127e4bfe70237dfdc21c51954feaa4ad5861f8
- SHA512 fd12ef5d078d11e990b67cc7be017840d3ca27d77290436749ca083715d8c34d4b99caf411b8269ba6bb027a7cc480c680c8925ca9d17f9a19c79ebc11e8c35d
- SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K/:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgm
- TLSH
  T198C633ADB231335DD677A23061841DE34E02C574AB0E34B1B8A0277E4DDB6F69369B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Subvert Trust Controls

2

T1632

Code Signing Policy Modification

2

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped Dex/Jar

Checks the application is allowed to request package installs through the package installer

Contacts third-party web service commonly abused for C2

Requests allowing to install additional applications from unknown sources.

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3