oblivion | 872965021bc2d6afeca31dc3d0caed8c71d593d9d2aff4e11ec72498ee56980c

General

Target
build-2.apk
Size 5.4MB
Sample260720-rxj7fads8n
SHA256 872965021bc2d6afeca31dc3d0caed8c71d593d9d2aff4e11ec72498ee56980c
MD5 5f3004caf4d1ca6609114d7dba55edd0
SHA1 12f018e9dd1297bd79cfec0ab6690aa46ee80582
SHA512 8774da0f7d6a38a552a6dc16f07f3cda5ec11f99ee78a7e1b4846add8cfb011aec087db9c52118d34b7f7d6e59fb4db38ed59bc49c25e8c4955c6dac8bc3b61a
SSDEEP 98304:mIa1rtKmtSUCUnLiEXekgSwuVz6yqvauc4P0raMvCak9g9sSCmc:mIa5tzHCgVbws2IaucgGSc
TLSH
T12646334EE2E1EDEBC4ED32FB6604CF129892F790EAF9B115578397D0AC1F2981D84449
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  build-2.apk
- Size 5.4MB
- SHA256 872965021bc2d6afeca31dc3d0caed8c71d593d9d2aff4e11ec72498ee56980c
- MD5 5f3004caf4d1ca6609114d7dba55edd0
- SHA1 12f018e9dd1297bd79cfec0ab6690aa46ee80582
- SHA512 8774da0f7d6a38a552a6dc16f07f3cda5ec11f99ee78a7e1b4846add8cfb011aec087db9c52118d34b7f7d6e59fb4db38ed59bc49c25e8c4955c6dac8bc3b61a
- SSDEEP 98304:mIa1rtKmtSUCUnLiEXekgSwuVz6yqvauc4P0raMvCak9g9sSCmc:mIa5tzHCgVbws2IaucgGSc
- TLSH
  T12646334EE2E1EDEBC4ED32FB6604CF129892F790EAF9B115578397D0AC1F2981D84449
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion oblivion impact persistence rat stealth trojan
- Android Oblivion RAT payload
- Family: Oblivion
  Oblivion is an Android RAT first seen in 2026.
  rat oblivion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests uninstalling the application.
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1