15402044cf340f57ae53517e2c659baa92267883c3ac4f761bed46845d9c4b02

Sharing

Copy URL Twitter E-mail

General

Target
dramabox-3.2.APKTodo.xapk
Size 112.0MB
Sample260709-cthrwabz2l
SHA256 15402044cf340f57ae53517e2c659baa92267883c3ac4f761bed46845d9c4b02
MD5 521126777a0b9e1a47c255361159dc8f
SHA1 dec957293c373c426acad61d35f9b30371d10e39
SHA512 376721834a3b4f7d8ae545716ef640d9c2f0a7043d9f942a545dff91532be9a1a158428b54025ab605117106922f9a27ca623b8f435842eceec21d886d0284f2
SSDEEP 786432:P3PRMJ5svKGh6DOmEOGMUmi3uThpg9UoZ+csv4FgF4BSF1YyXY4GHjxkQJovzBF1:f5MJ5sHhd3+t4aoRjxkZzF77
TLSH
T1E4485BC2EB454923C49EBA7475F64F20BB316E4CD3C793511008B379ADB22C67BB52A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  dramabox-3.2.APKTodo.xapk
- Size 112.0MB
- SHA256 15402044cf340f57ae53517e2c659baa92267883c3ac4f761bed46845d9c4b02
- MD5 521126777a0b9e1a47c255361159dc8f
- SHA1 dec957293c373c426acad61d35f9b30371d10e39
- SHA512 376721834a3b4f7d8ae545716ef640d9c2f0a7043d9f942a545dff91532be9a1a158428b54025ab605117106922f9a27ca623b8f435842eceec21d886d0284f2
- SSDEEP 786432:P3PRMJ5svKGh6DOmEOGMUmi3uThpg9UoZ+csv4FgF4BSF1YyXY4GHjxkQJovzBF1:f5MJ5sHhd3+t4aoRjxkZzF77
- TLSH
  T1E4485BC2EB454923C49EBA7475F64F20BB316E4CD3C793511008B379ADB22C67BB52A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  com.storymatrix.drama.apk
- Size 95.4MB
- SHA256 3584b8b6056c6d688baa9f3bd1e602b7b46b07d1057d71a6e84dbbf4a1cafd28
- MD5 2f809284f42dd42baddda1612d51d144
- SHA1 7d4802a1a77573db4b24feee7b7a09f84d512530
- SHA512 f8776bf42176ea7785e9f4310db0a98775f822c2099ff56a6275132d7ed88681743a865d62b3016fa02ef319ef49e28f0f5d760c881b762dd43e2d2c8eb6b0f9
- SSDEEP 786432:M3PRMJ5svKGh6DOmEOGMUmi3uThpg9UoZ+csv4FgF4BSF1YyXY4GHjxkQJovzBFM:K5MJ5sHhd3+t4aoRjxkZzFS
- TLSH
  T199284BC2DB414923C4AFBA7535F64F20BB306E49D3C797511008B379ADB22C67BB52A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5
- Target
  config.arm64_v8a.apk
- Size 15.8MB
- SHA256 54a44cb55e76f99b203cdeb61ca67ebe7f01c94f14da16b9632e12f8ee99db1d
- MD5 e3302452754ee50f83339c1748437623
- SHA1 61b7bf07abb44564bef05978123316a2f81cfe1f
- SHA512 d5703424a6ff457cc9c53765bfb961827afaf295a4bbef4b30ff2fbdab7d02d15722166681bcb3f0743270bd9846c76c6921836e4ed174fcbf6f0157325a82b5
- SSDEEP 196608:6pazCZahSF4KOZnU2/wPKUSyliYX2FJY+hWB:6paWNFeU2IPKU7kYX2FJY+hy
- TLSH
  T187F69E46F90D5E1AE9C1F1BC8F890353B623B95C0224C1EA3422871DFDD7AD5C66A7B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  config.xxhdpi.apk
- Size 680KB
- SHA256 0950143c50f7d1477913804bd89dd240ae582eee7bf7bb1923480ace316d17b5
- MD5 14344de8e7c815d4b1df0113f6933da5
- SHA1 1a8e7c31829df5a0041b5f71635478f6477d224e
- SHA512 7f1025f320eef438dc4259abf545141fbb747591d75ff1ed8888e02532a711eac881a658940af6fe46191f73c86ddd4b61187b69fcf5864a4c5e632476364e4e
- SSDEEP 12288:lOSx4ZxH/xHwQaBxKDU/BcfH0XozpnSpiX2Ex85IUyWuqH:lOSxG9VwQIQDqBgeoNSpiXVx8lu4
- TLSH
  T1B2E4E1E6D36CF81AC833C539877A16AB64D00D905921F776651AF22C9EF3E819B44FC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  icon.png
- Size 183KB
- SHA256 d94851be9120fca5d4c31d3f4314dbe8febc847d19b51d39d445a7baafcd5b51
- MD5 8d92c5e80adb235f567dcacbfc012ef8
- SHA1 d68dd3ec585574d224310fb23f193c56e8600887
- SHA512 a18310868647a7e4414f19af41b45064566d081c3c3d6b23ad997ba5671fc318f7d6f87edc07596526d38a8657bf4d102490a19fe76c7e9db834a613194975b8
- SSDEEP 3072:+GvbxdiCCmaSch3yntJ95c6HCzWnAi2GVt3TAInaIYwserFxbDgEyux2ILud2ht3:bbPYmaSch2tJ9vzAi2yDbaIzPbpyuy2H
- TLSH
  T17804128D505AF8819F338FE009A77FC5352C880B0974EB2D501D2F5A7866BBB92958F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  manifest.json
- Size 3KB
- SHA256 ffc5e5ffdf51ef03456c2ec21189b2ad43314b8db39f6eca2259b99cd0a5b19e
- MD5 21e3e1539a0e2270211dc6b49b711e11
- SHA1 85841fc64a6d1e0b58f4d07a1a6e71391e7d5d6d
- SHA512 e0a568bab8dc1c3e27147985420ae330ab874f3fe71b4306aef58e9a0d7e177199d2dbe6bfb7ed8955bea1e12a8cabb14a1ee7504bddfb2f5437daec2ab3fddc
- TLSH
  T177613312475806369898909D6DEB3CCC08AC3E7933A454B8BBFFDD5D350B98F3184A8D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware discovery persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13