f006b84b3ae50f2650eb5d97aa2f390db06a289cb5dbb3092ba18f2a5385f9fb

General

Target
f006b84b3ae50f2650eb5d97aa2f390db06a289cb5dbb3092ba18f2a5385f9fb
Size 11.0MB
Sample260723-tws43asfmf
SHA256 f006b84b3ae50f2650eb5d97aa2f390db06a289cb5dbb3092ba18f2a5385f9fb
MD5 c6727d60e4a5f3746116ad3d6643cdb2
SHA1 ab215c889244b7b27258eaad2270486bfa46fc2d
SHA512 a9ac113362068c98848a7c4b9078d0fc90343ea3dd23f56d473604ede8bd847d52e5e38065cf9259ffd4ef53d4f9c17605d2ed5b9e28efcacc266c483ef9c528
SSDEEP 196608:JaC6KFgq/g84UlXtwNiakPmiY5kmnzCeCcNFRwyarXg0vBTTrTv+SJJGcTvcKm:AKFN/GmSkPmiY1nzTC2FRUlrT2vcTvE
TLSH
T1CCC6128BFB84985AC0F353B29575636600874C2A4F83DA876D58727C19BB5E06F4EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  f006b84b3ae50f2650eb5d97aa2f390db06a289cb5dbb3092ba18f2a5385f9fb
- Size 11.0MB
- SHA256 f006b84b3ae50f2650eb5d97aa2f390db06a289cb5dbb3092ba18f2a5385f9fb
- MD5 c6727d60e4a5f3746116ad3d6643cdb2
- SHA1 ab215c889244b7b27258eaad2270486bfa46fc2d
- SHA512 a9ac113362068c98848a7c4b9078d0fc90343ea3dd23f56d473604ede8bd847d52e5e38065cf9259ffd4ef53d4f9c17605d2ed5b9e28efcacc266c483ef9c528
- SSDEEP 196608:JaC6KFgq/g84UlXtwNiakPmiY5kmnzCeCcNFRwyarXg0vBTTrTv+SJJGcTvcKm:AKFN/GmSkPmiY1nzTC2FRUlrT2vcTvE
- TLSH
  T1CCC6128BFB84985AC0F353B29575636600874C2A4F83DA876D58727C19BB5E06F4EFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion evasion persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral1
- Target
  app
- Size 8.2MB
- SHA256 25ebfdd11a552097027f5b143a4b7ef27dfa65952e9f499a69f4a6923845275e
- MD5 3e1bc7254d67a929c6cccc0b8f753df3
- SHA1 32520962391b5a8377547adf5976bfc1bf028932
- SHA512 0dfb63036ee16efdba23f7dda0697076e69e81853d03bd547dfb483b9795256084abbb4a3bb193d41b49d2fff0226abf0fba6e59d21e1bcfa09884eb467777ab
- SSDEEP 98304:71VKZRmLimJ+s4FZFbRspRFqtu13XP1nz5iSRGzKrhIhVBjJeG0ASy0od:BU/mOPR6FqtA3XVzrH2jJeG0ASy0od
- TLSH
  T1A496CF13AB9A4C79D9EDBB7B919717207B30BC45A7434BDB1908D2506D633ECAE293C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Checks the presence of a debugger
  defense_evasion
behavioral2