General
- Target 265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee.apk
- Size 794KB
- Sample260707-wpflhabv2z
- SHA256 265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee
- MD5 30b5a3cd4d23b440d561e43a299647cb
- SHA1 3c3815e30c3d06888901a844455cae6d9aa948fd
- SHA512 a0719ea4dfaec2ee31e846274c2a6a5c7e50618a3a5c03a0460c20fbb5fb985999d87fcfc50547e26966363df44cc91434922926f13bfad87b63941c625b23e0
- SSDEEP 12288:PNh/RBiD3HrhsCji4GNTZ5PaBQcK6hDLrMhd/9V2Bn7K1KvV+gd/aXm:3RBinhy4CZ5aBfzgd/9sBG1K9+g4Xm
- TLSH T1D605E0C2B325B52FD97B81754D5AC7352626AE01CB83AB0BA554373D2C3B3990F86BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee.apk
- Size 794KB
- SHA256 265d5fe88bf08193b75f47acd89c24a5fb3880f6b7635414641a5ae73f11deee
- MD5 30b5a3cd4d23b440d561e43a299647cb
- SHA1 3c3815e30c3d06888901a844455cae6d9aa948fd
- SHA512 a0719ea4dfaec2ee31e846274c2a6a5c7e50618a3a5c03a0460c20fbb5fb985999d87fcfc50547e26966363df44cc91434922926f13bfad87b63941c625b23e0
- SSDEEP 12288:PNh/RBiD3HrhsCji4GNTZ5PaBQcK6hDLrMhd/9V2Bn7K1KvV+gd/aXm:3RBinhy4CZ5aBfzgd/9sBG1K9+g4Xm
- TLSH T1D605E0C2B325B52FD97B81754D5AC7352626AE01CB83AB0BA554373D2C3B3990F86BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Requests changing the default SMS application.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1