arsink | 917eec78ccb45e014df6f3319ca04dba3a2dac13377640baa9f90dd37bd5df23

General

Target
projectss7658.zip
Size 67.0MB
Sample260628-t1pbnsav4m
SHA256 917eec78ccb45e014df6f3319ca04dba3a2dac13377640baa9f90dd37bd5df23
MD5 8d95968da4da01ad461b49884d7c3414
SHA1 e0b452984a2e7a8d991f1091227460c220eed13b
SHA512 07dd89c30d76c866197f32e757a1404ebd117b08dd7296cd324fc6d70a3749d01bfd9abae0c888209403f5b52136c2e9c84b922e5160f0782c70a99c4a5e309a
SSDEEP 1572864:kjiBpTZ1SQcCD3Voc3Q+jobV5WtkLKIAtwNc8pUooWdpdzrybm2hjJ7x7:km31SQnRF25YkQ18pUovd/fB2hV7x7
TLSH
T14CF73370D0DE8EE4B2DF604285D08C012F5D96A403B575F3B96683B4E1EDEAE4E619EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Elite.apk
- Size 533KB
- SHA256 fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
- MD5 9f01767647e2e72f446d374bbcb20c53
- SHA1 f6b1adcd7723b525418a05bcede5c671366d7ab3
- SHA512 4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
- SSDEEP 12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ
- TLSH
  T145C423A4D2EDF583C9BBA73487654247D53777A268201B0016DCB837E4AFB644F42B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection evasion stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Reads the contacts stored on the device.
  collection
behavioral1
- Target
  Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk
- Size 48.4MB
- SHA256 ca9a6ee5f7a1fb40a8093baa7617ac806ff3877d0e69268a044780677be6a07d
- MD5 d881fca1fade4a08c036a4805dd6c3b9
- SHA1 221906ec94ed7e153fc2f11e57ad9308203c1cf3
- SHA512 ace259efd45556003aafbebbd3d4b4e6b779c1c6194614a2cfeaeba0457125a867dc24f57268f3f8b4da6a9775536b3d9269a5bb242d97bf25f7c979fc746918
- SSDEEP 1572864:fVnTRAsoWXvf5BVIqf4r36WYYh4Cq9h2/fcI5Ls:fVnTKsoqBvJK6WX4hLiXs
- TLSH
  T17CB73342F288F402C5F3CA3756F9263A2A5ACD254B87D7531841BB75A1BFFC44B46AC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection discovery impact persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral2
- Target
  kingo-root-4-5-8.apk
- Size 4.9MB
- SHA256 0ee670fda6b4e5c8daee28aa6e46522649a039ba0178d21e09f894398ea0169a
- MD5 3a4597419a8f64c6928e8b0f21a90e24
- SHA1 a7b4f077831c2f5f6ccad5a4db372e066da96ea4
- SHA512 72db62cadd27654f17f65875732080864372e26504bc75e715ac0257baccdc686cfbd8f1f2059ee46ee5974151e83fdb786a8e773b2e16b58519dc151eb7682f
- SSDEEP 98304:7MEniyhxulMOTtcvj/qwX2zqhAJr1/T3b4rrTjDuDO9pMQ2AI52K5UeY8zYF:7XniyhxWdavjiwmGkNT4XXcfGeoF
- TLSH
  T1AF3612A2F24CF527C87BC03342A58776468A8C65970AF7462855B37C8DFBFD85A81BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery persistence
- Checks if the Android device is rooted.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Queries information about active data network
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral3
- Target
  kingroot-5-4-0.apk
- Size 11.0MB
- SHA256 e86b598451ce4a4d356eb0c2ed13c2ea550bbf57e2dc5616bbe909353e9275c8
- MD5 d249eba55ddcac91d851bfe09730e49f
- SHA1 121cbe46408fc796845c259756bb78005d4ab9ef
- SHA512 006ed6826795cd4fed3ebb44031e59c9eba448e574fe97f35dcdf74b6135366e15d3cba350578b78861d7fc1a9cdb21ad072a2ee70417c423fa82878080da680
- SSDEEP 196608:HUSgp0VpQYB1t5qudbZbLogSf6L19n5Q4aXW1uPzh25WoTSkgtZV4TLWqgdrIsUV:HTq0VpH3dpLkC19n5Qk1iwWMSkcz6ZKA
- TLSH
  T160C6120AFB9CF929C477E03797A34673B0994C686706E6531A44F52C28F7DD04B8AEC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  hk
- Size 140KB
- SHA256 2b940125721797cd63a0f26eb219cb9799d33da4c9695c1854867f21e747c7d6
- MD5 65bfdb1a9cbacec1b6620db9b4648aa7
- SHA1 b50a7a2e52a4f5740eca53f3160a70a3262f28d8
- SHA512 807b0d6b2216b93a5e0b2de1a9f3903bc34e93765d6c08e35f5c84458a02caca3239ab8bf310fa73e174406d24bdeba0e28a272c6d6d2e42785bbac45db08364
- SSDEEP 3072:xvscCp1OvcutEfTNAfJ6HwhpUJuxfvyhyxMYnXrVOXCPqayFfLenl:xvzCpaXzf9WcfETYnXroGUFfLel
- TLSH
  T182E31299A7C12283E3C78375EDA113309A96A29842B9D8B33F7731B9C213BC54D5F818
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  mtk-easy-su-2-2-1.apk
- Size 4.6MB
- SHA256 9cc91ba2742dbbf87480ce125b752b55f5bb88f678a789bbbf70c0224fd9530c
- MD5 26230cdcd869460212331e7098a89efc
- SHA1 d44b229963c362477bbfe97a0bc04e2959b7677c
- SHA512 c3f01e7501209cce75060360448ea061a2aeb941bd2100bb994b3a13d74ef681f88c988d8561903a866a2119d7644dce60d5a84c78f1ad9a9d3822e72d873fe1
- SSDEEP 98304:WEGHyE5PtV78zA0zY7CnZeotsMRoUTT2mNEj5QKw5LGFr+DHt:b6tV78XY7oZtsM7TKNNQKwJN
- TLSH
  T1A226F186FB54A93FC47741334BAA5235326A8D168E82D747384C376C28B76EC4F99BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral6
- Target
  my horror.apk
- Size 1.0MB
- SHA256 3f7271e2b821c4e3c5c3fa2f82f0ed98269cad8c1c56314f37f92d861f9e1bd7
- MD5 2655760e728c9cafa09f6e30e129770d
- SHA1 fd375a88758bb15d49fade163f7bb0e7fdc6b5f9
- SHA512 0d3bb286846748232e28f87f64f52549fc99e0f529d7fc296684c0f821738d5ca971208286386bea71ce7fc23f868d476c82d3a4ea7eedf347b87332415bd6cb
- SSDEEP 12288:NFPSDHTYchZzKX3UJJ7mDpPGjyHNHxy3Ay9nqWQQs5RUNcjpbzFrx/2D2dVnGPKV:6DscTzK30jGxKnkN/leD2Hs/yYhMESfR
- TLSH
  T1A7253347B36D59D5E84324BDC2B124DAFCA29D565B6CCFC3A44AF3B0D2F842A112235E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

ransomware
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral7