75d91cf6cb077a57f862d8ce0f08896fa458b3d6d92926f4483b768cf8ac4297

Sharing

Copy URL Twitter E-mail

General

Target
Manok+Na+Pula+-+Multiplayer_8.2_APKPure.xapk
Size 109.7MB
Sample260625-vmd48ady6l
SHA256 75d91cf6cb077a57f862d8ce0f08896fa458b3d6d92926f4483b768cf8ac4297
MD5 1811570b855f073c5d6cf91ee0614300
SHA1 d4fb0df694d6301d1ad39587df54e3e440e54477
SHA512 96cf403ddcfe84c83a3c2e12f2282e1496c3cbe1c58f78002e1cfeb9e55e220654b25f282295a8f848bc31911ac8b0cef0a6d5a3e3f449175a554b2b4416ec8f
SSDEEP 3145728:AhB3JincydFtTAzXInWNSY5ogfuvtaVYI7gmfAh:Av3JNydFtTfWNgg2vCXQ
TLSH
T172482322D9814946D1EA0071B5D61A3CFD738F455B120B1E8B67B73D28FFBCC9AA1B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Manok+Na+Pula+-+Multiplayer_8.2_APKPure.xapk
- Size 109.7MB
- SHA256 75d91cf6cb077a57f862d8ce0f08896fa458b3d6d92926f4483b768cf8ac4297
- MD5 1811570b855f073c5d6cf91ee0614300
- SHA1 d4fb0df694d6301d1ad39587df54e3e440e54477
- SHA512 96cf403ddcfe84c83a3c2e12f2282e1496c3cbe1c58f78002e1cfeb9e55e220654b25f282295a8f848bc31911ac8b0cef0a6d5a3e3f449175a554b2b4416ec8f
- SSDEEP 3145728:AhB3JincydFtTAzXInWNSY5ogfuvtaVYI7gmfAh:Av3JNydFtTfWNgg2vCXQ
- TLSH
  T172482322D9814946D1EA0071B5D61A3CFD738F455B120B1E8B67B73D28FFBCC9AA1B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  com.tatay.manokNaPula.apk
- Size 91.3MB
- SHA256 b541a171f25943c0d4f85b9aa36f9a4e5695463b15b7cf78dfe2708189cd16ea
- MD5 689fd012932cc7e0e6aebc4694cbe379
- SHA1 6f96d1392eaefcc8cf0975ec2d565451978261d5
- SHA512 3a7e542a29f9e3dc6990c38c25fd4eb0047a3e3e2872eb93ad692c5908065c2ea2eab9b42026e599df4cbd5c4d400cb14fee8ff37afac9f5e7135245fe51f6f7
- SSDEEP 1572864:Kh7t3JaVReW7B2mZddKKt4YAU0XWpyhwWNv6Y5eiSFj0fus4ta:KhB3JincydFtTAzXInWNSY5ogfuvta
- TLSH
  T175282322D9814946D1EA0071B5D61A3CFD738F455B020B1E8B67B73D28FFBCC9AA1B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

persistence
behavioral3 behavioral4 behavioral5
- Target
  config.arm64_v8a.apk
- Size 18.3MB
- SHA256 7596667020d95304d3ab945d495ddd24c55b2b5ac559a7839fe5f716280157dd
- MD5 3a136a04c5ffd0fb9af9f9816361193a
- SHA1 07ef1fad8f8ff74b89438fd893eaa390a9d19a5f
- SHA512 c08ca1448cd806d26b062a9194288a19a2e9e7cafb2f2d9c05d190f01877aab242057437412103622490bc44e9f5ad2612e91b73fdc74a11bbf03785f983cb73
- SSDEEP 393216:B0wWmDgf45AIdc/NU4lZYp9V2btkw4Dhd78KwCXD++Rq87Ibl4F:hRDgf45AICVUx2bWdhdImDjvUx4F
- TLSH
  T12617339EE19A8E49D57380313D8FFA0A864FB09CEEBD9CD6F45244E7830DC6C66D1A41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  icon.png
- Size 31KB
- SHA256 9537d15584a6653672151e269366672224f7bcff642bd7d110f428464bcb4009
- MD5 7eb82c8192ca40c3250e311925a8117e
- SHA1 a901e9eb87e50a6d5a3eae9a2af1c865bac1371d
- SHA512 f78f3b42ddee7b475c70a3209f805bc74b017a1fbd7631bbcc22707ad7c161a84ef7a8a74a24fb58ebabd59d1387f96a2398659507e721e6bd5af7a62722a877
- SSDEEP 768:fQ5nEmdukatf79/XqaC15bNzn9yLhSVznT0A+vNhZ:fmIf99fqaEtl9VZ4AYNb
- TLSH
  T141E2E1E339F83691A77CE2F9504CF421BA579CB02F3079A64B1E95BF9800D21B95570B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  manifest.json
- Size 2KB
- SHA256 7cbfa065496f5d05b838dedc0a5f0698a4a58357fdc00da24ee80b2a1e94fc2a
- MD5 6e1b55325e1917cbfb36d1eb565c5270
- SHA1 1cd1f06c4dfeb2f9517636806cb9df9d22e77eaf
- SHA512 3df2d65877b2dbfb7d528e854f7a48d557a83b1fdc9c3b2d896b677ff4400e867717f61ede60940bbd263252c5651e497371bbe14ae770274609b567cbc48a0a
- TLSH
  T1B55160934E3806EAD98C72CFE4A808E8C49819F61F56B7C48F955D702A4BBD43005FBD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11