3c79d1b528e2d540fcee4f4d5af2998931283e161837877479c5dd0bfecbff03

General

Target
BuSung-dev_SpoofMyDevice v1.4.apk
Size 5.8MB
Sample260620-vkpg6sht2w
SHA256 3c79d1b528e2d540fcee4f4d5af2998931283e161837877479c5dd0bfecbff03
MD5 9c01539d51caaa85889acf9d936c2dd9
SHA1 f1e43afb94a21db87ef034e1efdaf7149d1fa6f6
SHA512 c7f672590ef67d4c5f715233dcd1e526bd7b7ca5cea894bbbeeae52580b98b59c3f120326f8f3df662733454290020c7a43d57c1e7229103a4f5d274bdf4ab6d
SSDEEP 98304:Sqx4pg4PNo/KrF0WnJUZ9+DQBY5SSGjXlQcbPO/Z9mle+6WuNK0XChZ9O5NDNKeV:Pwg4q2C4Dh5peVW/yAauNPXCGDNL
TLSH
T136560186F79CA92FC47350778DB652B6454A8C168A43CF53A918770C2CBB6D84F89FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BuSung-dev_SpoofMyDevice v1.4.apk
- Size 5.8MB
- SHA256 3c79d1b528e2d540fcee4f4d5af2998931283e161837877479c5dd0bfecbff03
- MD5 9c01539d51caaa85889acf9d936c2dd9
- SHA1 f1e43afb94a21db87ef034e1efdaf7149d1fa6f6
- SHA512 c7f672590ef67d4c5f715233dcd1e526bd7b7ca5cea894bbbeeae52580b98b59c3f120326f8f3df662733454290020c7a43d57c1e7229103a4f5d274bdf4ab6d
- SSDEEP 98304:Sqx4pg4PNo/KrF0WnJUZ9+DQBY5SSGjXlQcbPO/Z9mle+6WuNK0XChZ9O5NDNKeV:Pwg4q2C4Dh5peVW/yAauNPXCGDNL
- TLSH
  T136560186F79CA92FC47350778DB652B6454A8C168A43CF53A918770C2CBB6D84F89FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker discovery
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

3

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Contacts third-party web service commonly abused for C2

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6