150cab3cb5c83f71d896dc6849b78d043db7b585585d93915e15d763940af76e

Sharing

Copy URL Twitter E-mail

General

Target
Ultimate_USB_10.1.10_1001010_150cab.apks
Size 137.6MB
Sample260620-kpw3psd13m
SHA256 150cab3cb5c83f71d896dc6849b78d043db7b585585d93915e15d763940af76e
MD5 98976d3dd81bf70ee042f5e00e46725e
SHA1 5a01f063a4ca233c5b047055a5817d74ba7afa12
SHA512 a47f1216d4e7350894f0ca035096049c03c948644415960690363a0db45aea376a6c7c333ba7a6de9b67da3164b08a35fc905563cc0c0f4ae8c2813da262bfcb
SSDEEP 1572864:7cmqWvf3q/V686+VIGp9vlkrO3B2iNfUjSuy6Pcv1:wmxfa/B6+vyrOciNfxuy60
TLSH
T18268BF52A7524D36D5BE933AA8F687007B316E86B74317872201F5B8AEB33C1AF543C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  com.mixapplications.ultimateusb.apk
- Size 131.0MB
- SHA256 cda0798913b03a4b140a23436723df56d3bd2374c3bd383516ab8a3f1bd9e575
- MD5 ff0e03317fe80528ebf0cc78bd488b24
- SHA1 d63d05834be8de459c647c4a28565e6548ff4209
- SHA512 e5dd36192357e0a085ed464ac8cf859fb91176fbd74155759ac2f65c87b0aa2614992686f5a8b95cd0e32c21e634a70823529eee38e9043432adac0d2da6305a
- SSDEEP 1572864:hcmqWvf3q/V686+VIGp9vlkrO3B2iNfUjSuyU:emxfa/B6+vyrOciNfxuyU
- TLSH
  T1CE68BF52A7524D36D5BE933AA8F687007B316E86B74317872201F5B8AEB33C1AF543C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  config.ar.apk
- Size 104KB
- SHA256 23c2baee7fa60977bf4b21d58bbeff0f2474e63b2dbf71e9a68c94c5fd6066ba
- MD5 f63f466bd273ade96d05f1710f43e227
- SHA1 4d513e6164eb4e664775306aa948d3ba7e16e6b1
- SHA512 db8f790da1d28b518c0fc8c59897a7daf0858c0193e8abe7178f7eb890d7c62f084f818ade6c57f6f05067584a109a0d643ec2fa773d1d20e7647f8c538279ef
- SSDEEP 3072:jLVPUlEGA8MQR8qiPEw7Cui2Azet6oZu1MvZ17mI747cIj:j8C17mI747cC
- TLSH
  T179A3B6521925A433CA76CA3ED1E1F65CD1719D239B47FA2328423A2444FB6D2DB8F3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  config.armeabi_v7a.apk
- Size 4.2MB
- SHA256 203bc21f94a5cf5aae36234017185aa480eb84b3bdab87aee883215d2f357557
- MD5 b9d2c837bfa7e55d50c56fd8dbed5a87
- SHA1 d718392d2d7383daeddcfb502ef3e2ad23e66fea
- SHA512 35c2e9559c3804e9ded2c53d4affa6fbd011e17332a7e30ae12486547319732c7be258e8a1dd93db653c14b8d93fa9eaa540ef5964de2c6ee8bd882d9815aa81
- SSDEEP 98304:NX5eo2pfGv+YPyWPjT+TVjYeqG2+eu4epwHQix00RkYHvrRYlYWF:N4o4S+YPyEjT6VEeqGx4Phx0yvNYv
- TLSH
  T16716331E24BCABDFDDE0B1B78BAF113AC4E8A278107F9D55AD0DB3D765205044829BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  config.de.apk
- Size 108KB
- SHA256 907c5553bfe55e3f5d2b8c1864fe7828f53c01a1b081443b0891380d6e551d9e
- MD5 60775c9fedb153c90254990cdc03114a
- SHA1 16ba51f9ebbdac50ed7e331271543d8abf08b5d7
- SHA512 a035807e619dc27033818e3f238b1b5a8cf1da96dca9a509532a85f18b791b1f3b56790a8d6e47a45a62efee0addaa5838b28ffea3d7eb223b60fbd9c231c6a8
- SSDEEP 1536:rqAWCNewMbIks0llPpAdnIIsqwmI7F7cmEfHDuW6fGvHlw1:+rSMuI7mI7F7cMp
- TLSH
  T1F5B33906A8A67927CA7BD33D2960D65A2236DF420F9317079940B97C017F7E28F9E3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  config.en.apk
- Size 116KB
- SHA256 01f027cfa6f2cc82f27a121e02df8ad502324399b33fdc48c064d077c6c1bf9a
- MD5 21e1e69f5e375e7b830cb2916e534f28
- SHA1 69c2dddc73be9a24616d06f46b72f328a9140624
- SHA512 e40bab1e88447bb5ef19a2f2c95bc7473de74aff0b6a994da5c0455439f391cd2a2310f479ad3fc0351658959928fa8635f3f327d1fa731d8862286c1f92b746
- SSDEEP 768:TGWhTxZf7JsqC9hprn7cLvQ9PHDRUvcXTLd5:PTZf7Jsq8hF7ccdHOvcj
- TLSH
  T1A4C3E756EB529A1ECD7784392C9792401039FE03DD438B07E5707A1C25BFAE19F5A2F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  config.es.apk
- Size 116KB
- SHA256 48ebe2bad9d94e72c7c30430aab37aebdb58870b49e846c8dce196b7fe38877b
- MD5 45393e38a2fb4c1ff5aff22d3650ebaf
- SHA1 02e889ea4d43e01cb57e20d05bf553d980a83b2a
- SHA512 3784073d33ea69646ecc1465c8d670c3e96dc8be82a004688a354a10a87b0f29fad8f826aa7d8763e14b145567ca1dec802c838f7f2b2b5c74d2e1f151885ae3
- SSDEEP 1536:TETv4mxgD5l5rWNY1r+5zfnjD3r1dbIIsqwmI747cmEfHDtFXq3lSc8:wG5rrxytPjDbnI7mI747cpwl0
- TLSH
  T136C3F706A9D57E23CC77C2796A83D22B61A8CE412E47C7079950B63C10BFBD89F876C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  config.fr.apk
- Size 116KB
- SHA256 2c3b3074dc628d2f75ff8d4bac3443d150eb8b419af581629ff4ca53d0c275ca
- MD5 1a28da312fc36cbc21bfc1a24d4c9008
- SHA1 fe98ea31d817244737022f809a31c21f59a68321
- SHA512 0badc147dcacc7201ee05d6fb6f304729722ae8a515cc159aba44510dcf6192c96036ad3ce75c6fba47a08f4d55b6c551192b7b669c322533b0c47be37e1cc12
- SSDEEP 1536:VaDpZ+V2xQo2XqkQbinY+fyGxMIIsqwmI747cmEfHDN2UijBYn:gbnW1nQbYY+fypI7mI747c6zan
- TLSH
  T1B6C3170BA8C23853C9B6C17A6A63E21A9534CE44AB47D7039C50726C15BFBF49F8B7C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  config.hdpi.apk
- Size 218KB
- SHA256 26f0e8aa8d6f132b8ca44fdd07ad13b2d846ddfcafbfb741413eaa2bdfe1c6fb
- MD5 1ed98311bd82b13161118a0448132a7c
- SHA1 437eef02481278fe8a036ad61dff1938d97b0902
- SHA512 3b9757f4c6e20e56dc6caf7c15c4df2c8b10241855c084916b53ba15b0586e363d63941571b4a7fa1ee0089d5465b38d969112ada6f8eaf28cab1ebb76472507
- SSDEEP 3072:xM1MG3P7wwNGxFaMkZChrU+WAuliXdelsOEm1Pk7NTJRg:x03PE1xU+WAtGvKNDg
- TLSH
  T18F247CE3D36DA807D973C43B47BD159664A54D902924EB62252AF21CAFF7E82CB04FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  config.hi.apk
- Size 128KB
- SHA256 00df18f0d79342c06f30234ab182acd1d4bbd76141cf551c2d903bb3d1167600
- MD5 75d4a3cd492c5d10fde8d0ddc1fba8aa
- SHA1 55e8f9171dd9b57e82a19b99be335668d12740d7
- SHA512 ebb62809165d52103395ba6b4c54e252106d8a0af535036e23ad81003a0ed123bf914eb534624cfa72523fdf5869fcb6c9969e4728299f8ddbb45304ab5523fd
- SSDEEP 3072:vh78P9FvoaaWT/0nGqr9rHJOCJNQOjheSPbmS2bW1zjZyJI7mI747cLz:NMWqJI7mI747cX
- TLSH
  T16AD3220DEBBEF3A3CCBC78B936458D3B84686E7067A54353488073EA4476DF0595A2D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  config.in.apk
- Size 100KB
- SHA256 c8093bb309051c73014e50ca66c407213a84600b6094d010355b8bfde70e6a4a
- MD5 185a4af356c61043a7a5285e7374cab6
- SHA1 02cd16a34aeacd52a88e2fa835e6d71d28fa287d
- SHA512 2ca925a20f7d85833e4b44a9201ffaecebb4a90b28cf6c826e1b26703c0876f735e85a8e9b5ff6c402572da3b05338b757daf4dd5c7acbcaa0b423e2410310e9
- SSDEEP 1536:9eNyM5Zb7sfiJMYB9reewPS7IIsqwmI747cmEfHD5RGRE/dg:9e5xsffYB961S7I7mI747cgb
- TLSH
  T12FA3280A9D967427C87AC6B919A5E60E29799F121F43531B9A007F3C00BFBE05F8B7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  config.it.apk
- Size 100KB
- SHA256 637545ca014eff1c3e2cc7b4da1243c9845dd1d836a913e716a5eb248b2f075f
- MD5 d8a1f9d7a24204feade84787606d89d4
- SHA1 1e825aa5422cb21b5f53f9e2e39dfa43511af45b
- SHA512 5ec319d628144db373706773d8e95a95c2b15053e414e69f3174c22e37c4b96293beb5893f827792aa71d0c9d1b1c3c30516152362da5c26ff393383336c1f7e
- SSDEEP 3072:qwqh7HnGl6rAC+o+KU0XyVI7mI747cfcXF:qwqh7HGl69++QI7mI747cEV
- TLSH
  T131A3292698927423C87BC37D59A1F2096671CD857F47671B9940362C11FFBC0AF8ABCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  config.ja.apk
- Size 108KB
- SHA256 e7814cfced7979efc55375485ca9f7a40119639a721305e4f553caa89643fb5d
- MD5 c55d9d46d03252cbc28387180c1edd5f
- SHA1 ec13822530e3f007317f258041849ea39de51127
- SHA512 1f18790d5f337090dcd64f51673e18f9788e709550c86ef34170d7a1eb1fb7052058ac2c0a644a3b364a0dc197093f2a45b0bc98c992bdce2ae3c2380824f4c9
- SSDEEP 1536:e35PaczN+KTIroo9TTvUuCIIsqwmI7J7c5fHYm+xjqnXkd:e35PaczNyr3TbU3I7mI7J7coN8kd
- TLSH
  T148B3F81ED7967827C832C277585AE28422619C46EE933723442CF43C19BB7DDEE46AF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  config.ko.apk
- Size 100KB
- SHA256 59830cb4ae2a47350b7125bba8d50700454d86e203b5a559dd852729400b5e91
- MD5 3b0f93a79c0982289d10590f54a0da18
- SHA1 fa1d07267a55d23cf354abc02d4662ebb5edba13
- SHA512 18ad354516d9c1ad0ef9d8f0097a57974daada1977ba9ebf46de8c03265bc642074e80353d67ef088ab6b0458af00a0e4e5ae6878867d4ae4cab1b8bb7cc7f03
- SSDEEP 1536:hd7Dc+Ffc1OZ0i/azcLGIIsqwmI7c7c5fHY3lw83cF:374EfcAWi/azciI7mI7c7ckNK
- TLSH
  T193A3289268A73557C8BBC9792DE4E70502A0CE519B930707ED40BD6C48BF7C24F8B6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  config.my.apk
- Size 124KB
- SHA256 6bb180c7618973b7fa6d15d0cd479ad88272dfe82e035e084b0c22fb2b8a0c67
- MD5 e54e01c1eb8101ef25d57bb919e6b1c1
- SHA1 73f05fb18aa0f67fd0072fcab85dbfbc56904a28
- SHA512 c31efc895a3cdfea0e312e497afcc9a3a40c8eb26602764b3f990d0fb61b59240d95d8ef531b2b252de0027d08a019a9aef983fcfec880d11aaf38d6926d1c0e
- SSDEEP 3072:ijF9AtQB9pxx8cKc6rRuRGcIemI7c7c79up:izxz76r8McIemI7c7cgp
- TLSH
  T18CC3720C9B7EF217E8FCF43A3A4D8E3A58A95D30179146825B9031EA083FEF057557A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  config.pt.apk
- Size 116KB
- SHA256 dbafdd74ee4ad87519d21ca85b4e91afa0adccaa5e52483bef8434c5bf36aae9
- MD5 a4a15b49eac3efc03e523ada83b4929b
- SHA1 d796913264445014ef0f8eea8ce08293f56f6278
- SHA512 19d015c74a99fe7c8d16fe9f86adb5afc5abbfa635e31004b7797fd7a28ebff5d2d253c08f24d3dd704689bbdde8c6d492650ccc69311c45a8e9cddda4eabc79
- SSDEEP 1536:BiAZMSVp0EesmgK3sHyBEkN7WGIIsqwmI747cmEfHDeouGvfhKKT:NWEesVGsHyBEkN7WGI7mI747caGBKY
- TLSH
  T110C31A0A69927A23CC3BC3792A92D71A11688E411F47CB0B9A50776C20FFBD19F977C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  config.ru.apk
- Size 124KB
- SHA256 11b9db0fd2a285304fe16b16e84a2e9237529e5a3f21bc53391da57f33b0c5a6
- MD5 f6fd01afaada345b403375226b96bab7
- SHA1 6ec0559a11545cf15722da48f5a25d05d31d0647
- SHA512 d78f2cab2c7f74b154f42c07b9c6a12d460cdddb1362967928ff95dd16c26f344ae754537cbda3f45a46c0e25be31519e02c7f43f0aacf9d384395fdd3b3066b
- SSDEEP 3072:T6a45nQau4Yl63DodqDyMnnI8KN1s7cPao:ma45nQj4p3DyqDyMnnI8KN1s7cd
- TLSH
  T14DC36121559A749BC535E43EDC04EE0938A68DFE3F6B531319603D7D30FB2E08B6A689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries information about running processes on the device

Reads information about phone network operator.

Checks the presence of a debugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32