General
- Target dynamicSpot v2.01 b200142 (Premium).apk
- Size 8.2MB
- Sample260713-hay8eaex4v
- SHA256 03308583703c8b2f0a7c999966c8f08d3b0ab03926f4717d94c17be4b8249e82
- MD5 0b1b0b339500a524ab340495b28d4aef
- SHA1 8a698dfe5ff1b3becc60ad737982cfe5081206f2
- SHA512 3e3ff55de73c368736c13ecd0e92917ae74a88b10a5121b40a38c8abfe181b7f2c22c687e5a8dc30828e50199f2d502062e0a7f3ba1a6a8216cf6e83405bd9d0
- SSDEEP 98304:pyfyCr+VDRiemiSTvZvJFup+LUa3iu2QCoZe+feIen+Ifo/KrjQk3hIF4WlqLBO1:off+V1SLBPuxaXCb2k3hI38w
- TLSH T1D386DF86E38899EAC0F353724976222751474D35B743D7C72D28B23C28F75EC8B5AAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
dynamicSpot v2.01 b200142 (Premium).apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
dynamicSpot v2.01 b200142 (Premium).apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
dynamicSpot v2.01 b200142 (Premium).apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
aod.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral5
Sample
aod.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral6
Sample
aod.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target dynamicSpot v2.01 b200142 (Premium).apk
- Size 8.2MB
- SHA256 03308583703c8b2f0a7c999966c8f08d3b0ab03926f4717d94c17be4b8249e82
- MD5 0b1b0b339500a524ab340495b28d4aef
- SHA1 8a698dfe5ff1b3becc60ad737982cfe5081206f2
- SHA512 3e3ff55de73c368736c13ecd0e92917ae74a88b10a5121b40a38c8abfe181b7f2c22c687e5a8dc30828e50199f2d502062e0a7f3ba1a6a8216cf6e83405bd9d0
- SSDEEP 98304:pyfyCr+VDRiemiSTvZvJFup+LUa3iu2QCoZe+feIen+Ifo/KrjQk3hIF4WlqLBO1:off+V1SLBPuxaXCb2k3hI38w
- TLSH T1D386DF86E38899EAC0F353724976222751474D35B743D7C72D28B23C28F75EC8B5AAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
- Target aod
- Size 104KB
- SHA256 26cf0718ed0fea8d2860863dd049a4de58b9ae05832713967b8f43cdfac164c3
- MD5 85247c1683a1992253b704c4e02e8afd
- SHA1 2aeff5ad99464b991154af3fe454fdb5fee09ffe
- SHA512 117ef5a42938189f7b9d3e70661a8af341bc360aa1104d9b936fc77d6caf8c0b745accdfa1eccf720a5c5798cedb46416960e28b4b54ad4b433a883056dc5271
- SSDEEP 3072:sRXnAjXIdp0yE3WRGzZl36e7ySUVj1ydlzlMF9zP:KEX2pELtcBS+1G6F9T
- TLSH T15AA3F1B387DAB0A4F4F3D2B440F907FBADF045989196A7B40211F2799C5EDC81EA21E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
3System Network Configuration Discovery
2System Network Connections Discovery
1