General
- Target eb.apk
- Size 3.2MB
- Sample260728-q2stpsywa1
- SHA256 0c877a93b403a8b78c9bae76cd6f74a78f97dbad4f0b9e549ce0393eab18fb58
- MD5 eb74075db25e1978b05e06302a15db53
- SHA1 67f0dbca0db11c4617d04bd901a55bafb88e8fec
- SHA512 752d6b36f84ad2501d834ad5116a3c891cc13c9cd32de3efd88205f6f44d5aa7098d40e96e5bede57e2bc47aabf7438c41d9671d13251b145fadbb0c3c2fc2a9
- SSDEEP 49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9C5gbk0gTwrIW6oxQ4hMUzCmLpI:h5d3araLxy/gU//bDgTwrIIC
- TLSH T172F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
eb.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
eb.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
eb.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target eb.apk
- Size 3.2MB
- SHA256 0c877a93b403a8b78c9bae76cd6f74a78f97dbad4f0b9e549ce0393eab18fb58
- MD5 eb74075db25e1978b05e06302a15db53
- SHA1 67f0dbca0db11c4617d04bd901a55bafb88e8fec
- SHA512 752d6b36f84ad2501d834ad5116a3c891cc13c9cd32de3efd88205f6f44d5aa7098d40e96e5bede57e2bc47aabf7438c41d9671d13251b145fadbb0c3c2fc2a9
- SSDEEP 49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9C5gbk0gTwrIW6oxQ4hMUzCmLpI:h5d3araLxy/gU//bDgTwrIIC
- TLSH T172F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1