General
- Target db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk
- Size 9.6MB
- Sample260806-xcwbvsgr4x
- SHA256 db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c
- MD5 c95cd77f0a88b3f74a794d735f547e3b
- SHA1 216414ab01a1fee5a056c3fb2fc167744002d5e6
- SHA512 1e64ea334f24358dc52f7949d5e6da39b7018fcd6168c39ed1d7649548e22eab44c4dd37c932c40632fd065ffe048baf69d8b3f7065d2c1b1aa83475acf968e0
- SSDEEP 196608:OjnYBnjbs1wWwPLCLH+QN4ut1eMS4pOvoQ8Y5QrlHDazK8zlv3FKzre3hmggk:ljo1xwPmLH+luHeF4pOvH8Y5Qrxa7JPN
- TLSH T18DA63382B3495F5AD9636E318D61925841322D1CCFA399177646B33C38FEED18F12FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Extracted
-
copybara
-
37.148.161.44
Targets
-
- Target db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk
- Size 9.6MB
- SHA256 db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c
- MD5 c95cd77f0a88b3f74a794d735f547e3b
- SHA1 216414ab01a1fee5a056c3fb2fc167744002d5e6
- SHA512 1e64ea334f24358dc52f7949d5e6da39b7018fcd6168c39ed1d7649548e22eab44c4dd37c932c40632fd065ffe048baf69d8b3f7065d2c1b1aa83475acf968e0
- SSDEEP 196608:OjnYBnjbs1wWwPLCLH+QN4ut1eMS4pOvoQ8Y5QrlHDazK8zlv3FKzre3hmggk:ljo1xwPmLH+luHeF4pOvH8Y5Qrxa7JPN
- TLSH T18DA63382B3495F5AD9636E318D61925841322D1CCFA399177646B33C38FEED18F12FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Obfuscated Files or Information
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1