General

  • Target
    DroidLocker.apk
  • Size 13.1MB
  • Sample260705-aje7wsfs8s
  • SHA256 0280fd7da2973e37e577caf2b2fcf06bc77cbcda47004fff6bad0ab77b89f5d9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      DroidLocker.apk
    • Size 13.1MB
    • SHA256 0280fd7da2973e37e577caf2b2fcf06bc77cbcda47004fff6bad0ab77b89f5d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Checks Android system properties for emulator presence.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Declares broadcast receivers with permission to handle system events

    • Declares services with permission to bind to the system

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries the mobile country code (MCC)

    • Requests dangerous framework permissions

    • Target
      childjosh.apk
    • Size 3.9MB
    • SHA256 8cecf18ad253d15489d62eff824a2bec83a4d20f36ada95800d554b405c1baa1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    • Acquires the wake lock

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

MITRE ATT&CK Mobile v16

Tasks