640b074c2bc8c47930daaf3a20b9105b46523f0917373894ae6d7a6fe55426ce

General

Target
Gl_Chrm.apk
Size 18.8MB
Sample260728-wevbxaaf68
SHA256 640b074c2bc8c47930daaf3a20b9105b46523f0917373894ae6d7a6fe55426ce
MD5 f3bc51b8f56d90d2a0d163b9cf1b5e2f
SHA1 32a47f85fe9c5b9eed80e7a82d8387cc1168d8c5
SHA512 2112d64677293b47405d213797d8d75d7fa27882a733fa3cd61bf9b34d2dadf7f01cf58897d60f1582c1ea92e2e94c5c4a6bdb2be581b77f02b6818ff54354ea
SSDEEP 393216:/RavXZ6xIWh3sDNoTfnN53JyzHhXRCQ32WI8VN2WnkUT2V3csj/OH:YvXZ6eyN5KB882W/N2WkFNl2
TLSH
T1B41733927788987BC17D463A08738B6096433C59DAE2A71B3601371C6C772CD1FAEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Gl_Chrm.apk
- Size 18.8MB
- SHA256 640b074c2bc8c47930daaf3a20b9105b46523f0917373894ae6d7a6fe55426ce
- MD5 f3bc51b8f56d90d2a0d163b9cf1b5e2f
- SHA1 32a47f85fe9c5b9eed80e7a82d8387cc1168d8c5
- SHA512 2112d64677293b47405d213797d8d75d7fa27882a733fa3cd61bf9b34d2dadf7f01cf58897d60f1582c1ea92e2e94c5c4a6bdb2be581b77f02b6818ff54354ea
- SSDEEP 393216:/RavXZ6xIWh3sDNoTfnN53JyzHhXRCQ32WI8VN2WnkUT2V3csj/OH:YvXZ6eyN5KB882W/N2WkFNl2
- TLSH
  T1B41733927788987BC17D463A08738B6096433C59DAE2A71B3601371C6C772CD1FAEDAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral1
- Target
  1_b7e404b6ec.mkv
- Size 11.0MB
- SHA256 16ac49155d1ed38b1c65f7dd037e049263556e07e760d3a16d6810e7bf244d1f
- MD5 8c678c0ec89077c16be4c6546e4d4ec2
- SHA1 4544ee41ac541c1bfba85c26babac48d87642501
- SHA512 1afda4b098468b1602f9cd480ce5635c782de076d64781c80ad9fe4e72d4fbbb76c3d51813c7ea15028b1a8a1c115bb542ee828640e87dde2629bd769799c10b
- SSDEEP 196608:CFWNrsyN3RmtDNowUf/YnlITVr53BGhq7bL/Pm3zHhXRCQ002WI8JuqnN2fOiQPb:KWh3sDNoTfnN53JyzHhXRCQ32WI8VN2y
- TLSH
  T177C6333323148C7AE33A563E0C25D6D695423EEDDB20A3AF6512B34D783B6C41F9A535
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection defense_evasion discovery evasion impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral2