Extracted

• • Target
    Install.apk
  • Size 5.3MB
  • SHA256 c31136b16ea0b22df47cc2740f08848f28f8d5bb29bf05671ed2a69856380c4b
  • MD5 6e4b442eb2f2eb623439e1c97b389552
  • SHA1 3ba41be7f0409b228d4513bdf14fdc2f5bcbd87b
  • SHA512 89ba72d8b67bbf4cab9a3e541169c780467805385cc2be5dcbe2d2e26826d88d5e6b1702b85829e1439cb412b6a07ff926225e189f88b9a2b9466fb3cb5ee150
  • SSDEEP 98304:RWy3NkMBjDf7o/aH6giEx+cFC+VsNMGCrFAz4xqUif0ALPMd0:RWyaMBff7EaHpn8cI+sWBJAzb5c8Q0
  • TLSH
    T1AA462343F369ED2BEC75C1352A458371592AAD25D902E78F39043BAD287B9EC8F817C0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionkonfetyinfostealerpersistencerattrojancollectioncredential_accessimpact

  • Family: Konfety

    Konfety is an Android ad fraud malware that abuses the CaramelAds SDK by deploying the evil twin technique.

    trojaninfostealerratkonfety

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3