f369bf8102fc2acada0aa38504194a7c7f5c5db962c0fb2b03253fefe4d3cb22

Sharing

General

Target
Plants_vs._Zombies_Defend_the_Homestead(Unofficial).apk
Size 7.9MB
Sample260702-dazfysbt4t
SHA256 f369bf8102fc2acada0aa38504194a7c7f5c5db962c0fb2b03253fefe4d3cb22
MD5 d1e46de7f15a69ea2983f0036fc93541
SHA1 d9077c16fad7a38136d4269d2a42bb6df4dbc538
SHA512 c609974134e2d9960f03b5749d736cfc75781cc93d7a469e36cadb53d43f3deb748241782dd6cec3e02c0075bc8f77454b2771f5d76068ba19e40fe9ae067594
SSDEEP 98304:NSE1XgzQ7Z5jkXLslQYHPJ48SAZbqo3jmLzFy0XAFAHiQ5NCPKjZWPekV+RWbLBo:viM/jpx4LFo3jmLkzALNCeWPe4+RWy5n
TLSH
T15F8633C4D68A698ECCD52CF5AB668045F127861846B0D96D0AEC39F46F33D202E17F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Plants_vs._Zombies_Defend_the_Homestead(Unofficial).apk
- Size 7.9MB
- SHA256 f369bf8102fc2acada0aa38504194a7c7f5c5db962c0fb2b03253fefe4d3cb22
- MD5 d1e46de7f15a69ea2983f0036fc93541
- SHA1 d9077c16fad7a38136d4269d2a42bb6df4dbc538
- SHA512 c609974134e2d9960f03b5749d736cfc75781cc93d7a469e36cadb53d43f3deb748241782dd6cec3e02c0075bc8f77454b2771f5d76068ba19e40fe9ae067594
- SSDEEP 98304:NSE1XgzQ7Z5jkXLslQYHPJ48SAZbqo3jmLzFy0XAFAHiQ5NCPKjZWPekV+RWbLBo:viM/jpx4LFo3jmLkzALNCeWPe4+RWy5n
- TLSH
  T15F8633C4D68A698ECCD52CF5AB668045F127861846B0D96D0AEC39F46F33D202E17F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7
- Target
  Plugin2.apk
- Size 133KB
- SHA256 a35482d25becb4cfa2fa3a8f8df6ff42ea7f058ddab5483addd050fbe5cd9690
- MD5 934ebff21ed5e09bb7f30e761b43815f
- SHA1 56f6f64024f6d77ad2211cf3f11128def9210570
- SHA512 9855d1776cbc70a2df91f1f63f24752f3af3d20234afbd5d55a75883881a84c0b54f16f6471a9d59ef23cb7ed0bdfd1cd9efc6ba0e076160ee44a502a90c63a4
- SSDEEP 3072:I+IUvIEmQGTWauB95t8+ZNW5sfx1nentClfc4HkOF2OBzfA4o9kPebGJTRjoq8GE:qUvIrQGJI9n8+ZEsfPn4Kc+L2KA4o9ym
- TLSH
  T1ACD312E3EF19F3B7E6860B701DF8966CC27D6418836DC3E25D852528625E1E08ED438E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral8 behavioral9
- Target
  Plugin3.apk
- Size 71KB
- SHA256 9a832dc1dad0a345036efcdf65fea2b9dc95adf4e0f35d8143706a65dcd86748
- MD5 98f60259d4ec41b8c6becbd7cbe0051a
- SHA1 e1d993687163d911e4d6835d6cd660155748294b
- SHA512 e0b73ebe96cf75180b1b1f4f4fe9aeb61943b3511a04eaaeef70f425eea23f57005fd36083e4759024bb78ad93e2732a1102fe3289035e56f1f33b569b60bbfe
- SSDEEP 1536:oHNZEQF6zoXXYZuyJzjkW3UXwpaRGqg8glKkGgtgyMYJlQZapNzzb:BzoG3wwqrgl5np5vQaxzb
- TLSH
  T167730267DFCC30D7F13A6BF0D2980573420560F5A664FA5D0C684C287AFF55AAE1CAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral20 behavioral21
- Target
  unicom_resource.dat
- Size 64KB
- SHA256 4fcfe4f8c3e7cc3c4320e2a6a3dd3c20f47324f53243e93dd85ad95e387d92cf
- MD5 92196937fb04bc1bee22e106ea4cf28f
- SHA1 0c68a181eb63f1a6690e60dfd837b91eb17151a5
- SHA512 6cda00e6ebe4f6ade964ccab4db83c8363f2def0acd2dd744e1b0048cb5f32185fdfe75aa70d0df38ce1ce52d3d731848eece6f5626f826f891172433fdc8bd4
- SSDEEP 1536:aWDADrANWprK16KtyiRFtm8clagB/dcfziAWmk2CN:a13ANkxsFto4c/HT
- TLSH
  T1C9534A2ABB0CD9DAC6F6FD3B9AD709BF9B20C458494ABF970544B00C0BDBA8017097D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22 behavioral23 behavioral24 behavioral25 behavioral26 behavioral27 behavioral28