oblivion | fa2a7e4f080ce26715e69732901e80ef2d44f0666fa25c41ee52da9e7c2c4388

General

Target
khrum.apk
Size 933KB
Sample260616-w7kceads9p
SHA256 fa2a7e4f080ce26715e69732901e80ef2d44f0666fa25c41ee52da9e7c2c4388
MD5 023ec2bcfcb3480eeb68726671ff1ce8
SHA1 95c0d163fa2e3eadfb08cb6e5eaa0f8993ef601c
SHA512 ab46201827cfe7528e031548831cdf65fa079534eca9f588c7acd0fa7f091e61d247d393f4fc89b458ea175824b2fe9a5f242d0c61db51973e8d0d06ae8a092b
SSDEEP 12288:jGLT/7gLM2n3qUUu8MM+QAM+tPi/chqk3L3K7AGXrJIW0rS0uhfmXytl2o3q0AwZ:4/FDu8MM+QArPhqsLaUoqnrS79XLGHc
TLSH
T1601533D7A7A2DAB7C20BB77D03C8C37BE730558A82AD952BA154D8725C3147EBF00654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  khrum.apk
- Size 933KB
- SHA256 fa2a7e4f080ce26715e69732901e80ef2d44f0666fa25c41ee52da9e7c2c4388
- MD5 023ec2bcfcb3480eeb68726671ff1ce8
- SHA1 95c0d163fa2e3eadfb08cb6e5eaa0f8993ef601c
- SHA512 ab46201827cfe7528e031548831cdf65fa079534eca9f588c7acd0fa7f091e61d247d393f4fc89b458ea175824b2fe9a5f242d0c61db51973e8d0d06ae8a092b
- SSDEEP 12288:jGLT/7gLM2n3qUUu8MM+QAM+tPi/chqk3L3K7AGXrJIW0rS0uhfmXytl2o3q0AwZ:4/FDu8MM+QArPhqsLaUoqnrS79XLGHc
- TLSH
  T1601533D7A7A2DAB7C20BB77D03C8C37BE730558A82AD952BA154D8725C3147EBF00654
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
behavioral1
- Target
  payload.apk
- Size 701KB
- SHA256 62f841f620cea0ce084274878184808bd346da7195edb079a81ceb7fe346bb75
- MD5 9f53dceee7e9e285f93e75ca1a2fe023
- SHA1 e726bfd40b6a6276d748eaf4cdad491f3907625d
- SHA512 cf79f6e12441a318b94bd822bd992b0a98629524e6a144129c6b22a962230e917469c8b1a1c52ac16250f7b3c8c48a63daffcb5225e4d0bfe15e3b5a11d28856
- SSDEEP 12288:tKE4wR+t7i/KhgS3Lfy7AEbxJII0ry00hPwZCtl2U3Q0qwvOjNDHLuC:ZG75gmLaUuqNryZ/b1SHz
- TLSH
  T1AFE42397A38ABE37D51F363B05C4C333B7310264E1E8D63B54B5E4929CA26B46F25688
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion evasion oblivion impact persistence rat stealth trojan
- Android Oblivion RAT payload
- Family: Oblivion
  Oblivion is an Android RAT first seen in 2026.
  rat oblivion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks the presence of a debugger
  defense_evasion
behavioral2