b20e43fbae9fabb8cba01aef9064bfa4696b68f7bb8128de61bcdaa54971801e

Sharing

Copy URL Twitter E-mail

General

Target
dicktok.apk
Size 10.3MB
Sample260720-shqaksd14k
SHA256 b20e43fbae9fabb8cba01aef9064bfa4696b68f7bb8128de61bcdaa54971801e
MD5 7cdb662e1caf5403a633737a1cd82a0d
SHA1 ca486f18d908cb1338f924768264b7dc345b326b
SHA512 283555dc39133502bbaac9c59bee79b1897c953e20bbe03323ef3ac1eb22476aba7d9b6b7ce282589d5c3d14bdd208a91a11465572daca49591560b36e48fdb4
SSDEEP 196608:tBojHMZQKKvZTVM4TFfpDVR617oXTlZ/HiZjjSrrXxWlhFZMXCWPQm6PHJ9OPo:8HYcvZTVM4Bpf617oXTlZ/HSMXAlHZMm
TLSH
T1F8B633D2F3A09E1ECC7659328F6A837917469E55CAC5DB0BA0A0376C583B0CC4E5EED4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  dicktok.apk
- Size 10.3MB
- SHA256 b20e43fbae9fabb8cba01aef9064bfa4696b68f7bb8128de61bcdaa54971801e
- MD5 7cdb662e1caf5403a633737a1cd82a0d
- SHA1 ca486f18d908cb1338f924768264b7dc345b326b
- SHA512 283555dc39133502bbaac9c59bee79b1897c953e20bbe03323ef3ac1eb22476aba7d9b6b7ce282589d5c3d14bdd208a91a11465572daca49591560b36e48fdb4
- SSDEEP 196608:tBojHMZQKKvZTVM4TFfpDVR617oXTlZ/HiZjjSrrXxWlhFZMXCWPQm6PHJ9OPo:8HYcvZTVM4Bpf617oXTlZ/HSMXAlHZMm
- TLSH
  T1F8B633D2F3A09E1ECC7659328F6A837917469E55CAC5DB0BA0A0376C583B0CC4E5EED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence collection credential_access defense_evasion impact
- Checks Android system properties for emulator presence.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  core.apk
- Size 8.9MB
- SHA256 cb965d04486425ecf1739432a1a7f32929c4706d799cef9ef63b3003d95e13cc
- MD5 79ebf12c7003f39560a80510ae4f268e
- SHA1 8d4b0fb3fdee4615dccf685542cf0786565ada48
- SHA512 5175d2cf9452e138a8cf9ab1ee954acc13d8c40092869443f51a1fa2b0888e99773f1fe0f5d6766dfe7200ce1edd69f5867e754d7a071b8625624b69ed721543
- SSDEEP 98304:JfDyEJloANv7OZzgTmTufK62g48GKsJZx6xedu:JfDyEJSfZzgNKDJZ40u
- TLSH
  T16796BE53F7018C33C31E8A7569FB7304BB315266A613CB532504B6A8FCD36E9A68D6C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral4 behavioral5 behavioral6
- Target
  mirror_payload.apk
- Size 7.9MB
- SHA256 5659bb29e82c2d9eeb397283d7354d30c89677f948d1c2d3118913ea18ac3d15
- MD5 e308b28eab5135d8e2c6f6018d5b768b
- SHA1 3125006aafaf4f5bdf8cbe1b5319cbcf2db52e46
- SHA512 22166634f7fa7242526f59f4a7b42f2a0e70bbf32f555348ae85efc4b3a91851b4133f1944494ea967f83f770ca7ffe1252e262af1ec6fef0e6e2b9d37d0b627
- SSDEEP 98304:8vD/T5IV//EAUJNcikK62SaSnAMlOkypredNNm:wiV/cAUJjEahMgpCjm
- TLSH
  T144868C4BF6119931C52E163D58BB1B1C773863DF67438B066409EA9C7CA33C0AA9B1DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral7 behavioral8 behavioral9