arsink | e5add2483e4adc6758893da8ee51342c6cc0c82f22fc3074f087a116399776ad

Sharing

Copy URL Twitter E-mail

General

Target
malware.zip
Size 30.5MB
Sample260627-bnw7msf16v
SHA256 e5add2483e4adc6758893da8ee51342c6cc0c82f22fc3074f087a116399776ad
MD5 c6fa340cc2a20d74c611da83662b7841
SHA1 c407f7977567246ee5fd9a0f59778dab51b97f8f
SHA512 6c81b5d046e7f6564ea54e124132e451c90331bf55b6c6f913853ecb5f9dc85aeef7faf84d5f6e352fdb29c93b1b06a067f96e2e36cb3f1536722c3aea2610a4
SSDEEP 786432:CjfaNiJfyxnhWGHMTsnCRa9aMjbJMtU1B3:qyN4ythWGkbKawluU1B3
TLSH
T1486733C4BDF4F97212D0EED2E5B2890AAAF1151072E534DC7E18F201DA3B6556DA223F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AndUnlocker1_0.apk
- Size 4.0MB
- SHA256 11ef87f842857ace314f1ca881cf9834263a79e22752882712a93da186141415
- MD5 3bac8f69369e72bb70be3aaa67b75739
- SHA1 0e78e30d92e4e910b497b135da9d20d1fad49612
- SHA512 13769d90daf185f51aa51c7ed9a04b244c8c1dff877cf5d5ebe6b90deb445f763745f0661bf7f4a7eb1173f58d4608a04ec713eb6aa7e10d736d0d60bf8cc5dd
- SSDEEP 98304:MMPd2ZrM4XKgMPM1aLB49H42+WdCzyxkAi11t+9ehX69j:MGG1ay6cC1g4Kj
- TLSH
  T10616E089BB48AB2FC477543345E65236614B4D4B8E83D6836868720C79B7AF40F5EFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  DeltaRBX(Fix53).apk
- Size 5.4MB
- SHA256 01dcbe196953883b1da0d43f890892b77ae53adc74ebdca41d4b0a8b4ede44c0
- MD5 333c3da130fc50a0ba6e2c06fb192be0
- SHA1 edd54e8af648537adb00c2a725ff929209d16b67
- SHA512 20b655ce7a24545de7d19eb2794a2bef447c1b6da7a9907da71e8d9c0bd150429bcc6b8334357292ecc8f1768a1aae2d50377c63fb1d93adcfa9922e057a4208
- SSDEEP 98304:H4IflWqd2Zr5WKgMPM1aLB49H42+WdCzyxkAi11t+9ehX6riBOQ7WHWSB:YqlkG1ay6cC1g4CiWB
- TLSH
  T19346F185F754AB2BC837913349EA5231558B4D4B8E82D7836918730C78B7AF41F9ABCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

evasion ransomware stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral4 behavioral5 behavioral6
- Target
  Doxgram_New_1 701 (Fix).apk
- Size 424KB
- SHA256 0b47e13b4cb4d8943f45a94f1489294f61e0715a69614bc88c195b01daae6d68
- MD5 894d5a8b8bc28de22969bc44c008716b
- SHA1 2cf46e09d07d35e8373a62b7b22c705606714085
- SHA512 33aad76a7340c631b6c60031187ef6e5a014c57d34895a87db3ef5a2b9d0a8a159cd0b291721409f0e35b8468d3088c8d97886e61fa0539e87acf1e724d56171
- SSDEEP 6144:JxcuhN9CK/xdD5wYFx/i26Bu6VNNDBU3TqiukWk4/XZ/plhUJYWQYd+wpDmm:NhN4axd1wOx/itu0NNznlPZhIWYd+qSm
- TLSH
  T1849423FBD954B5A3D74E5E35F03F9E17FB79938668B58AE6086010E1C5B01A9C0CA80F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8 behavioral9
- Target
  Eternal Hacker Panel Loader _ 1_5(fix).apk
- Size 5.8MB
- SHA256 23d668f31429fe38195087c3f7d9d68ef32fbb7bfa947be3589c08f0975193f7
- MD5 2bcde3d0e2530011f65eaa18716ffd5e
- SHA1 f4488af2339dab83dc6a97adb10547bfc38086a7
- SHA512 b065508db5448baa95cd5f13c74f15484ff92064b19160b5130ee4d5d11558bef3bd3bf84e18131f0acf1e324a9924320cf03e9451811655c31c4b54ae64631b
- SSDEEP 98304:J71lak0b3t88lreBG4PQTDR3Y5XCGl5aG+280+5SwXyEOOCFwmxtrm1gJGhT:Jh0b3HeBG4IHK4GtZ5UoOM41CGhT
- TLSH
  T1E9563312A240B52DFBA69BB48FB742B2F8360FA47455BF357329B3328173136D710A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral11 behavioral12
- Target
  Limbo.apk
- Size 4.7MB
- SHA256 50d8632433d3954b14af9ce7da67f030f1d3dadc2d0be6fc9a06155314682701
- MD5 532e184b94fdcc7c523c2c23bdac827d
- SHA1 d5588c900ab5f9dfe8a2fcd394de162fd8b8e242
- SHA512 3285ac8d973bc343520a8bd2b5163c111ef361012b5b382ccd92ad316f045e7325e0bedd1e5d28019c5f2a233a644f003e7125330091880aed6b34619768ebe1
- SSDEEP 98304:pHG0YBPOlV2WMzao22onlgNP54dylcbM7F99ZXj:AFBPOlZMjwoRZlcb6/Bj
- TLSH
  T15C36336EC366AC9FF2575A344ED70620CF924F59959675DF2208F306E0F322767E2282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15
- Target
  MinvyRatClient.apk
- Size 1.0MB
- SHA256 926d3c5cc0c4f93cd63e1dd0cb7fb7a2da96fce980fce4cf77cdcf69ccca4e6b
- MD5 45c887c11f36570a34291b4ccc7858df
- SHA1 1ef628a54157f6963549a480b8466da39ff78b51
- SHA512 ab2be1699b521f6aecd0db37bce14f7b4b8d46c3ff7fb067bab2390afc18469e5aa619130f6eacb95c0072e8224380ca61ccdbbbf24c8dc35c7f10bc922ca007
- SSDEEP 24576:hkKU0x/fG1vW4IQMxCznkkY2h4iiCDeACsrIICTtp1Vo6U4pH/GhD7rf:hkK7JG17IQMAzn62h4UVMICTth/pfGl
- TLSH
  T12035239B8B9C4C3FF86FAC3A41AADF75C99136197F01C9E650418A12F63B153A3F4A44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

ransomware
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral16 behavioral17 behavioral18
- Target
  PoletDidlo.apk
- Size 1.2MB
- SHA256 a571605812fbd816070e09fce86c2f010673dab8f8a33f8e7de7a89f3ed3ce74
- MD5 8447175e0c37826c2d5d8487d5272700
- SHA1 47e4e2674b86971bbf15640d20e0da9c92194d1a
- SHA512 7c01aa66aa3962487b7beea1c8d786a1b12b449f28cfbc162391bb901e42bbd410eda27e4f5393ba6601ac9eb0b35b6e98adde384db80690887efb3d30291bdf
- SSDEEP 24576:17KsyH4/Mk69S9nQq5iUH9vI/2rkgHyoLiqmYLLOI307ASTKLhVJHf:Zd1Xjdzc2jL+YLYAfhzf
- TLSH
  T1D5453365A7B6C14DFA1F367DFC4F1104EDC222388F39E7144C168E21847CAA5B6AAD0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

ransomware
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral19 behavioral20 behavioral21
- Target
  SheetCrypt.apk
- Size 1.6MB
- SHA256 fbfab254dc250f89c58a5eed9c0233d0a0afdb029da1bba9537cfe359e2e4794
- MD5 474c199ff6f0f72cc2445595a3fff96d
- SHA1 c43dc3e9dfc223dcdafbe15684177edece78680d
- SHA512 0df8b54e51bdfa208cfec7a522e24283bbf8b1df7ea41a42a34ab55a5405be1afe22c9eac352101ce2f9aa1dba04df936526ccdda12b8599a8193483b9e81b5a
- SSDEEP 24576:qwmEcM28Dpn5Uoo7lZR3aubqMXfbWFMBKrUd5rhik31rGR4ESveTL/GRD8QpZRiI:OMdFalZYub4oKQ7VJ3Fjve/2wQpiBqZx
- TLSH
  T1A58523AB87F97525ED31AAB6D0D16331FE776371D687A3C3169AC12D0C243AB08B50C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23 behavioral24
- Target
  SimpleMiner_XMR.apk
- Size 104KB
- SHA256 bede3630686cc90e359bc52567d72198ca97c527d5ebadda922208b93b7cf94e
- MD5 fdd029dee2aed15be39de35afb848c78
- SHA1 5302b8feea5707371e5b0ba616e1591151048951
- SHA512 26f18a5c331c0491838e5698639b2ea9268be016da6586f85d277ac30652f7ac972df4aec299c1d08fb5db7e9e39abfd638a158c0933fdbd0232f9866c6b3d5a
- SSDEEP 1536:zZL05NUSUwBx84E4uAXQlcWrZvS00eV688DANSct9eIKRXnkijnD1LYQamKz:1JwBMAghNZV68C69/kfjhraX
- TLSH
  T1E6A302D3BF18F8A7D95F5C79C8B5E636FFB06B62A5A0C74F1B12911028A50B00DA095E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27
- Target
  Stealer.apk
- Size 424KB
- SHA256 906896b11849040c03a0260dd290320c08b1df19d0bc5e885abf2f99de0daebc
- MD5 30456e5840b3e0b2ba8b17536f9dd267
- SHA1 4a13b036480b509264a5c89eb58f1ae2f90c84ce
- SHA512 628b0d970d66d70a8c95823f114abb6de47d608e92c6aae71f92eed629e227e662d59569fffa1351474bfeccf1246dac5d2b1fce6ce0bb7d1bc3ec598a7b6656
- SSDEEP 6144:JhN9CK/1dD5wYFx/i26Fu6VNNDBU3TqiukWk4/XZ/plBUJYWZ9NiU3:JhN4a1d1wOx/ixu0NNznlPZh0L9NV3
- TLSH
  T1BB9423FBE918B5A2D24E6C76903F9D1BFB79D38378B4C9EA18A050D0C670595C19AC0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral28 behavioral29 behavioral30
- Target
  apktool_1_0.apk
- Size 112KB
- SHA256 590c3fd1f5355493a62d7432c5a7721e6338137daf32f03d27cd89973990040f
- MD5 89d84449956abd71561184417393e44f
- SHA1 c3ad4c45053435fb82066ceab69ab6b340659543
- SHA512 30992a9fab5891ff9223e051bc6e4821d4da48b26830de76cce8408ce2290f755b60be3a9d4015b97d213aa64acd62361e5c69913ad0d66cd14e59678bc833c1
- SSDEEP 1536:BGvFCdJeUwBx84E4uAXQlcWrZvS00eV688DANSct9eITxhwUDLRak:BGqwBMAghNZV68C69/Tnwy4k
- TLSH
  T1A8B302E2AB44DC9BCE6F58B5C8F8E436FFE3636280F0DB0B1A1291215D955F108A112F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Removes its main activity from the application launcher

Changes the wallpaper (common with ransomware activity)

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Changes the wallpaper (common with ransomware activity)

Changes the wallpaper (common with ransomware activity)

Queries the phone number (MSISDN for GSM devices)

Reads the contacts stored on the device.

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32