0edc852de37510edcc48fa25c23d78750dcc9f1fac7c774d1353972debc12b9d

Sharing

Copy URL Twitter E-mail

General

Target
eu.depau.etchdroid.zip
Size 7.8MB
Sample260702-hjsf8abx9m
SHA256 0edc852de37510edcc48fa25c23d78750dcc9f1fac7c774d1353972debc12b9d
MD5 df695c7bc96f4d8b0d13aaaccd033528
SHA1 0874890015f3fdf8ae3692b3bd14f99ec1df0483
SHA512 32fe9e5645df15a69ddbde84a46dacd3282934ea87e1aecdcd9e74c56f50abb2dbcd4691b6b978c6d55d53474356ad10c27c6d4e9c756a87a664638dc87217f1
SSDEEP 196608:FX1BNVNg8EU3LpiHxS5t8md/nJhkaV5ehYsb:1TG8EUcHxwyMka7Hsb
TLSH
T195863375D1FA5B27DE4283762AEF9384DE5105891032D78EB70A613C0F868678FC2FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  eu.depau.etchdroid/AndroidManifest.xml
- Size 19KB
- SHA256 3c68913fac034c398466e9aeb9dca6cdc502bf41ca551e08d480c993043b1554
- MD5 21e8dcb4a95479db89ad2a2883d9a636
- SHA1 bdf35e6e4f489fe309dc5bf6426000be7841f25c
- SHA512 62a4f8ca6dfaeb38d6d89aef5c310d39646476de290e9de8af77edf864edbbed2bbe849446b61963be9e03418e929197a1f0bbe1135f76faf982914b83561be0
- SSDEEP 384:cRIw/OK4vy5UQtzRzen3yiCtjdXNXC8ROh4FAFngr6K4oJ0pPOjuJT7SYKOEd8aa:cRIW4vy5UQtzRzen3yiCtjd9XC8ROh4Q
- TLSH
  T1B1929C4073E9EB05F5BE6BB5AE79D5D5457A7E96DE10832F3101330D0A32A818E62F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  eu.depau.etchdroid/DebugProbesKt.bin
- Size 1KB
- SHA256 065bd792b8527764f33147188302af5bf9e2a8da40fde0830dc111ad26dae40e
- MD5 b3025ebcbcb6491525c87554319167bf
- SHA1 e39357dda8bdfccfebd502eaefcb41479870d61a
- SHA512 520f54128323acf4f04810d64bc55ac169abf5f3c8e9cb18287cf47e550b376b13ea0f2d9a519b02bc35715ba506cb43d969991ed5dd3b0ae2f2641c329be056
- TLSH
  T1ED31EFD2F3741822D2866DBB4C5153B98B309BE3340791468FA220C6B8933C7D75E378
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  eu.depau.etchdroid/classes.dex
- Size 4.7MB
- SHA256 68b725563fb9fa009fdea3295ef32b3dca0e9ae39833a70144a1f9545bb9786a
- MD5 9c27d0756280f767bb4e57f8c305ddd2
- SHA1 af4dd639ca2cd7165b1e9b845d3ca24d323490a1
- SHA512 a2ed3ef4b8df7af343bd506e2f428fa1213865a2a1a1ca1b71d686bf9d26538c29a10a534d15f96f1ef21c7f3477fc8c5074af7ec6e4a85e19cf51fe3ae45ff6
- SSDEEP 49152:8NEucGbmiNRolu/V22x3G5f4JlL63P5rcon+roExGsKrYXiTDL48pN7aFU/TyXr:hucGbsq22R4Mx+PR7RYGsr
- TLSH
  T10E368C0AB6B0CD61D9BE227185B603406732927AE573533715049AF4BFFB1CE27A52CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  eu.depau.etchdroid/com/sun/jna/darwin-aarch64/libjnidispatch.jnilib
- Size 172KB
- SHA256 0d807803265849d1a81a18c5617c87710d2493f3c781d96d47811e2047c884c4
- MD5 e89231af3b1cc9f3398f2dae9e17acc8
- SHA1 249338a0537509564171de0e5e0c35a4251d3a03
- SHA512 25d74f2b21df675b02351c12c08d4f5833c8a752ea6a21dc39b441ff34d559c273c6f8b483a06001fe3ae67ed228fa421cfede2e31118d99de64c8fb537d4c5b
- SSDEEP 1536:mDfP/k+uiiA6e2latsZohFEd2YDqNqu4jBdg2ViyMpZ3:q7KSERjBdg2Vi13
- TLSH
  T1F00474B1DFC9341AD6C4E8FF093427EB9A0799A0C70365A7F2E1465A8C5EBD0A470F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  eu.depau.etchdroid/com/sun/jna/darwin-x86-64/libjnidispatch.jnilib
- Size 120KB
- SHA256 b43c26087a2458c6c727f7bfb8966090f22e9a4a739a55708f6b163ec3413903
- MD5 0686b1bebfbf02d6c672f26c997ca2a8
- SHA1 e695bcd8f24ac6a0ffb382395aca2557ea3546db
- SHA512 160c6465c8f3d9442468d97c617590c1b71c98ba58b0b336073306204e193fa6dbb1dda8b156406fcf434a7ef7ff2cd71f0ca836bcabd39b879be0c2d992af6e
- SSDEEP 1536:+wYPyQ8+yH3nD684mQfAyknuQVWjQFn/oi0azHcgjBdg2VrUrS:+aQ8+yH3nD684syknVVWMv8gjBdg2VyS
- TLSH
  T102C33B3A7793D469E84CC1BA967F8163D025FC10120635BE62D6FF385FBE4613A0BA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  eu.depau.etchdroid/com/sun/jna/win32-aarch64/jnidispatch.dll
- Size 250KB
- SHA256 749e807fa10407e43cf2cf98e885e5ef76a95751c143c0c3326ad1366f3e9179
- MD5 bf93f6b98af1987a7536d69202e0dda9
- SHA1 d8b5600b6c8254afd68068f130bc6f75c62f0a7a
- SHA512 05b98e00ad585b509875f5a5ba37d51fea41952373ad022a5ecb4a538db0675286c0aa685a9da2eba7a00d0211da97bd381cab07c520e18cbd370d2fcc06818e
- SSDEEP 6144:NJmUkkbVsZhi+QCfOsVJB95hD+ER/GUr3yhOZVyubjmAy/f:ZbVsaCJTNGsi4o
- TLSH
  T1D444F851A11DB846F7C2C63DABA10B92C27E7231A430DD4BE719010FDE9B7E7A5226F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  eu.depau.etchdroid/com/sun/jna/win32-x86-64/jnidispatch.dll
- Size 248KB
- SHA256 76f19b52423774932831dcba0596989ec56213f9b217a0432fbc122f99704a2a
- MD5 a004906b9067501293107be3a92c3401
- SHA1 ed9f50de6051aaa1f26e61c64a5c6b0eba407d93
- SHA512 86ad9b89c816d1e1e9215eb6f6852707628a4897168b66b792e655405c914696799538335d33244838940afcd9bd1bad842f8a3b004ef55bbdd1146c09a37003
- SSDEEP 6144:tL6FLyIgDjXnjDknIdHoDDTZNL+0oGCjyubjmzyMLJ:tL6FRg/0ZN58
- TLSH
  T16D441917E7B248E5E8B7C03D4523AA12F6B178254320EBDB47848A574F67BE09B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  eu.depau.etchdroid/com/sun/jna/win32-x86/jnidispatch.dll
- Size 211KB
- SHA256 39bab69f5ead37326cb4c032c621dbddbc5093932871f2010120819a4100abdf
- MD5 7668f8f21cba1d0d7e2cc39379b8a3c3
- SHA1 332887373846943f479dac9fabfd42fbe58d723a
- SHA512 6bf511961b24d7a3f31603b8449611768c8bba824a73f781340bbc35dd80ef3a8d4368a6074902f9ebbcab586c6ac7dfcde44d2a24c3c90deae434f028f2c875
- SSDEEP 6144:9aQ/P8oafs3r1xBwQgEWumUkvXsNGQqX:9xP8oafs3rfaumU0
- TLSH
  T1AA246B02F041C072D8EB1A7945B5C7616D3C29302B8099DF67C5AE7A9F31DE1F931AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  eu.depau.etchdroid/okhttp3/internal/publicsuffix/publicsuffixes.gz
- Size 40KB
- SHA256 9af43e9995ec749e7a30eec4e5a87770d7e2027847084a07cca82060eff0c791
- MD5 9cde0af9015ac1e969566abe3043d5ed
- SHA1 2736b5864897f83fea53a38d6f5e50a5a45df686
- SHA512 ec18aeed60064d2eaa2455bf261ccd81c48982b671cf0803756c79437c8e4d9751f0f3ad28be7a452119452073c218f9283e0083c5916e3f9208b507cfdd499d
- SSDEEP 768:J7PJQrM4NRsXCx+VmNDUPuOXOnvUoMufyD0hnIZV7l6g1rsBuIPF5//aw:9nUsyyQ6uO+vU+fyYhIL7l5rsBhdJ
- TLSH
  T12703027FC30C58F6392425A4EC9A13BA2F74B38C99B2E12A5341E0092F5BF4714C1797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  eu.depau.etchdroid/resources.arsc
- Size 355KB
- SHA256 d2ab8a3a1f6f0fdfe55757d49be61f2819c5a2fa7900f9ba5e00c40f4dfa4447
- MD5 4c8116e497cd91601298890c0f8abceb
- SHA1 4614ad356cce52bdfc36dff4bf2fa9b5366fd3d0
- SHA512 a5cc12ffc7f5217e3771599e41d83ef14219d57c8b2332d219cdda2c48fee4a87a01dfc5884fefc7238d72ee1d688cc8bbef96e9137638c96dbd9283e19f1fa4
- SSDEEP 6144:ubuq2igSGEamUvYcybUUtc9liAB5MRG1Dbu1wse3pA7iSrU38QpOX:ubuqRjAB5MRG1Dbu1wse3pA7iSxqOX
- TLSH
  T1E07471CDB744612FC47A593746F7A3219383840B8CC79B976988590C69BB2C81F6EF8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18