b3cbc9858cf4e0b04ec98b176265fd4a17cdee65625a2595d449fa7c7a8eefd4

Sharing

Copy URL Twitter E-mail

General

Target
a806ddbfc3340f17cf966c47ad0fb0ee.apk
Size 317.6MB
Sample260623-xd334afw3t
SHA256 b3cbc9858cf4e0b04ec98b176265fd4a17cdee65625a2595d449fa7c7a8eefd4
MD5 a806ddbfc3340f17cf966c47ad0fb0ee
SHA1 80b5bb998571c5d1af9c0dbaad7ead85961ef95f
SHA512 3ffcaa4ee1b6b97bbb9ff42018d8ba489886e4061024045a42f9210863cede8c7abe224ed4b406a39b58bf5856c055db82fb23a486045cbd10516bfc34b54afd
SSDEEP 6291456:fEQwy0DgJ0dVaJdH3u6bJxCipgW4mIPKEEkYoaQckXDrb:MQ70DXVa7H3vNxWXXPKEOoVckHb
TLSH
T171F8336AE319E61FD8B7197316A05235161B0C4683836F8B554D3F1CBAB36E40F2E7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  a806ddbfc3340f17cf966c47ad0fb0ee.apk
- Size 317.6MB
- SHA256 b3cbc9858cf4e0b04ec98b176265fd4a17cdee65625a2595d449fa7c7a8eefd4
- MD5 a806ddbfc3340f17cf966c47ad0fb0ee
- SHA1 80b5bb998571c5d1af9c0dbaad7ead85961ef95f
- SHA512 3ffcaa4ee1b6b97bbb9ff42018d8ba489886e4061024045a42f9210863cede8c7abe224ed4b406a39b58bf5856c055db82fb23a486045cbd10516bfc34b54afd
- SSDEEP 6291456:fEQwy0DgJ0dVaJdH3u6bJxCipgW4mIPKEEkYoaQckXDrb:MQ70DXVa7H3vNxWXXPKEOoVckHb
- TLSH
  T171F8336AE319E61FD8B7197316A05235161B0C4683836F8B554D3F1CBAB36E40F2E7CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection defense_evasion discovery persistence banker impact
- Checks if the Android device is rooted.
  defense_evasion
- Checks Android system properties for emulator presence.
  defense_evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
- Declares services with permission to bind to the system
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6
- Target
  launcher-intent.apk
- Size 67KB
- SHA256 b207fd6e54f41621713dae8800762349277244449272d885620c8c414415a606
- MD5 27eb56f2f1f9d0fe51b67634d9c59174
- SHA1 ffab9b2d0f7a28d014e9adc39779dc7eefe4d86e
- SHA512 372b11377584a98caa791a776163417cbd1e809d8e11d3af7be81625ca425b502c1cd5a781721f1d999b0a105d0d1c42f2ac2855546bf064832b7b5dfc1bbed0
- SSDEEP 1536:zqQZFEZiKCGKNFw1/VMOAFmP4HNbMbKXn8wF:u6JKK4VVSmgHNbgq8wF
- TLSH
  T1CC63026AB6660D33E88547351DDC6D6A2E6250050C66FC63E0BDF3E03176F515EC2BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral7 behavioral8 behavioral9
- Target
  launcher.apk
- Size 2.9MB
- SHA256 79470e5d4d5e9ecb033dbfd6f14824110a5a3cf037a6d9e89c53cefe642783f5
- MD5 f697c6b8a18fc459b3c43dda6f222643
- SHA1 3d7a8c3b52b38c372c6eed7f0b0dbd9f88a8d88b
- SHA512 de0b35c9410f5ce8b88896d54e12ca2f6bfdf4ba0f9865db04779e88276abbd56c32a50265e0d8d12c956cb0979fd2d25493061448a55be1823aa20115cecceb
- SSDEEP 49152:rGlKu78w31EbharvUnqVjKHi38ftLhdEg8OOHyqsZiL/TF52sBIOxGrZZzOwrLf+:rGlKu4wGborv3V0ist1S/OG6ULF00B
- TLSH
  T136E50185B298EE12C873D17686186B36648DCC384B43C393580977AD79FFEF44E856CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18
- Target
  romex-framework-plugin.apk
- Size 818KB
- SHA256 849f5509a8e9ef22464c648da2a25f5f2ae8e26b8ae9d27290a55646453407dc
- MD5 cc2c777f48685e3705ad0b82788bb7fd
- SHA1 1fccb544dc6ef5ffbb4a6cfa2704025619baca68
- SHA512 bbda61e00153b16d2dfe0631c9f159ab78f86b54d80d6df36a5f3a869907462af6f9d2eab99e741733342e30c7703135ba92fe0e4b0861f785498cd1488d3196
- SSDEEP 24576:lMUOZsZEG2cdaOR0jqgUFA8R1q5b78498U7Pc69i:lMsZEsB1gU+5b78498U7U6U
- TLSH
  T1CF052353629A0487F8221CFDEFBD2587B95DA623A862F4F5D1CC0E4F02D306537ADA94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22 behavioral23 behavioral24
- Target
  romex_cn.apk
- Size 298KB
- SHA256 0876f88dda0be6ae0a6b4f47a1f5d3792cbed1b94deb6888c39ab321f7d10ec0
- MD5 c372c406f4085ece892be39f6f642d6b
- SHA1 6b041e9bc62d7823e49782142c98ac07e81bc55c
- SHA512 d89efef75279c0bb68f2263867fe8dfb042372e52c49437ec9322ebd025f605810eeb88ce2f40bbc9b15798f3e5578470028d0d2c8e3b72bccade2411bd4080c
- SSDEEP 6144:S+XIDni1W+4Yc+eu+mqpgihLWblNm5UcXhRpbiSMA4dBsR8iJS1jNofnBGQVa:ZIoW+ou+mAh0lNuDc7AMDiJcZofza
- TLSH
  T19A54233A3B25917BCED3C93A3A2030A717761255A2E1AE9FB026B604BD85F41DF537C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28 behavioral29 behavioral30