General
- Target jbapk
- Size 4.5MB
- Sample260623-vgzhzaew5t
- SHA256 fbd38ff21a766cbd10b5b2b88bc954fb001a0fcc991abe0fa58336f15ac75c4c
- MD5 588f22bf3968406ea63632139d95a5c2
- SHA1 a071a9e15ba4a8772738b0fc9ec90dfdf7331473
- SHA512 6f458ca46f3033619155bcf92c00211805e3658d815825dd80e2318e7e97d10335b414f421faf6e4eca277d20c2b641477916b9d5944ad98d27264f871660aaa
- SSDEEP 98304:bZOnUZg5rmJzw+c+CNNAm+dc8PD2wLI4uEzoZfZxRvMlzwIw:knug5iK+8NCFdcWD2wk43zoZRxOqj
- TLSH T1E92622229ACE604EE0B3F63D55E6DADB981B0C6CD607A30B4F4576E849738C60F7658C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
jbapk.apk
Resource
android-33-x64-arm64-20260325-uk
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
jbapk.apk
Resource
android-34-x64-arm64-20260325.1-uk
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
jbapk.apk
Resource
android-35-x64-arm64-20260325-uk
0 signatures
300 seconds
Malware Config
Targets
-
- Target jbapk
- Size 4.5MB
- SHA256 fbd38ff21a766cbd10b5b2b88bc954fb001a0fcc991abe0fa58336f15ac75c4c
- MD5 588f22bf3968406ea63632139d95a5c2
- SHA1 a071a9e15ba4a8772738b0fc9ec90dfdf7331473
- SHA512 6f458ca46f3033619155bcf92c00211805e3658d815825dd80e2318e7e97d10335b414f421faf6e4eca277d20c2b641477916b9d5944ad98d27264f871660aaa
- SSDEEP 98304:bZOnUZg5rmJzw+c+CNNAm+dc8PD2wLI4uEzoZfZxRvMlzwIw:knug5iK+8NCFdcWD2wk43zoZRxOqj
- TLSH T1E92622229ACE604EE0B3F63D55E6DADB981B0C6CD607A30B4F4576E849738C60F7658C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Checks the application is allowed to request package installs through the package installer
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests allowing to install additional applications from unknown sources.
-
Requests enabling of the accessibility settings.