58fa325d6a5619e1fba43d6bd8a913632521284306631c8fb7bce7ba8dda3393

Sharing

Copy URL Twitter E-mail

General

Target
Font+Keyboard_1.8.xapk
Size 30.5MB
Sample260716-dnaprafv2t
SHA256 58fa325d6a5619e1fba43d6bd8a913632521284306631c8fb7bce7ba8dda3393
MD5 c5d02939d865d5fc4bce13e6ad6d5d77
SHA1 a365abc4936a89b756c70368a3da472468fb66e4
SHA512 857a6710ac183eff3c9f482f47de1059542645e10675f65eb064cdbcefafae81d59be66e7095b81c1912b45826d964a12bcd18a8e3b6d2f00dc015b747185118
SSDEEP 393216:tJXgcMrH0gnn81Dm94/W9B4GKtO5+dg/eva91YORrKVFDLv9GW5YNE9qkeRGXj0:7gcwVX94/oB43tOCgVRrKVBFesXA
TLSH
T18A671206FB0DAC3BC9DA647C8A574B9131166C854290D3976925F618BFBB7CCCE26BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  com.fontkeyboard.cute.emojikey.apk
- Size 23.5MB
- SHA256 78ce94948996344acdf31c7232f7c762680e22fccc875b0be66fe90184726ffc
- MD5 8f45edf111f1554876b689ff26733f4c
- SHA1 0fcc5477d0d11a0a4cb1cdc5626101012c512ae2
- SHA512 28e72ac72bc7887df9ac8d2ccf34ed8538f2b4eac77f4a42b1dc317e4a43d2ca7ee4488e55c05f302961c92a70114db8437ec054758cd17dd9574284d5f72172
- SSDEEP 393216:WJXgcMrH0gnn81Dm94/W9B4GKtO5+dg/eva91YORrKVFDLv9GW5YNE9qkeRGXI:ogcwVX94/oB43tOCgVRrKVBFesXI
- TLSH
  T1AA47335BF328983FC87764728EB9622201961D47C283A763F525B11C69F76888F4EFD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Checks Android system properties for emulator presence.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Checks the presence of a debugger
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  config.arm64_v8a.apk
- Size 4.1MB
- SHA256 b21872af8776b9d9e240111cf857c8abf9e7ade84f70a9c8b213edbf98022516
- MD5 8bedef8770ead398c2af89fcb606bd5d
- SHA1 464a4ac0bc29b3e4be2c95edf124df5237be6257
- SHA512 f55b0b88f28711ab86b8a43d9196907daf3e4a7156fa7b051ce08e0d978af0bd0ce279b591d6af0e9d77d64d0a09380b0c2c2dca634f2183b25ca9b053dac68e
- SSDEEP 24576:Kbabew4dcmCpfrOjDXcVQq7okkTHhIj1GV9CUTYTMzjPSYzRwzymMmQyxDO6vLNf:caJ46ppfqqVN1Gjz9qLQaZN97
- TLSH
  T18B168D09FA4DB837EAC9B4BC8A474BD1B125B8901A50D0DB2531C719FE877D88F2A7D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  config.armeabi_v7a.apk
- Size 2.9MB
- SHA256 55b8e14361bb9c517b2d0d5f7be28fa2a3f333c6a14e9165a9ec525f2f2a230c
- MD5 d49cd7681afdd6fb9aba5a3c3a70a3dd
- SHA1 79547542defff982e2ce3fb9f3c99e9794e2191c
- SHA512 5f5062bea694c86b6241900dc2482e0b59b1bc74959999ca79ed25ff7998fdac662d85d05256295261d8522f0440afb805034464e797a597fad78141fc183526
- SSDEEP 24576:cRAJPiguUmKqBPPQHFqo4r4E2WfFu4DE0Lz+1JaimefPRq6n+sVBNCt7Yo:cRAJ3WKqBwlarFu8z+hBNPo
- TLSH
  T16EE59D43F646DC27C9E4193AB6534BCC320688C961A5A3954E69DA243FEFBCCDD16BC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7