General
- Target 0d.apk
- Size 3.2MB
- Sample260722-nj4gdaeb78
- SHA256 8703ee8685a47d4085b737b29aaa0f6f7898985b41963bd15d7027c75a609a3e
- MD5 0d62eca9b2976516b9e8d905acabf283
- SHA1 c31558d8ab25d6121d0b10c96f4c7ffe623fda0c
- SHA512 f6b5b531d7f47c00cba48e5e12c925745ce5cf55cc3739b3f10127c2875a9d66d57146f13ce1edcc1b4c5b54037b343caf091dfe5c2ab6962fe83f62c0531457
- SSDEEP 49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9R5gbk0gTwrIW6oxQ4hMUSPY4sR:h5d3araLxy/gU//bsgTwrIIz
- TLSH T112F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
0d.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
0d.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
0d.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 0d.apk
- Size 3.2MB
- SHA256 8703ee8685a47d4085b737b29aaa0f6f7898985b41963bd15d7027c75a609a3e
- MD5 0d62eca9b2976516b9e8d905acabf283
- SHA1 c31558d8ab25d6121d0b10c96f4c7ffe623fda0c
- SHA512 f6b5b531d7f47c00cba48e5e12c925745ce5cf55cc3739b3f10127c2875a9d66d57146f13ce1edcc1b4c5b54037b343caf091dfe5c2ab6962fe83f62c0531457
- SSDEEP 49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9R5gbk0gTwrIW6oxQ4hMUSPY4sR:h5d3araLxy/gU//bsgTwrIIz
- TLSH T112F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1