octo | f0621053cb4092291c89554f9e3834673f3f1bd7bad030720d2e9c1dbe59fa6a

General

Target
f0621053cb4092291c89554f9e3834673f3f1bd7bad030720d2e9c1dbe59fa6a
Size 20.0MB
Sample260807-yzyaeasgpg
SHA256 f0621053cb4092291c89554f9e3834673f3f1bd7bad030720d2e9c1dbe59fa6a
MD5 29b562e2242d265ae824bc6c7d53fdf9
SHA1 b46e45d7599dc5bf4a08ef573cd949b5914ec12c
SHA512 89947b2c31573c039ca051d0897ba750a3b755bc8611ab9defa43823bd1b816ae9c182e1c6e9542f22c85e4539120d8e035b0ccb1a6e71706fa19ce8a8de87b2
SSDEEP 393216:lebKr76/xyfaK1DXuQ25HYrEex3yQ7tIDZ6SlhLD7r9o/m9Szy:lEJxyfayF25JexixFrX7qES+
TLSH
T166271242739E4839EAD57AF801472371AA206C28A76155CF5B05F1145EB37FAAF3CBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  f0621053cb4092291c89554f9e3834673f3f1bd7bad030720d2e9c1dbe59fa6a
- Size 20.0MB
- SHA256 f0621053cb4092291c89554f9e3834673f3f1bd7bad030720d2e9c1dbe59fa6a
- MD5 29b562e2242d265ae824bc6c7d53fdf9
- SHA1 b46e45d7599dc5bf4a08ef573cd949b5914ec12c
- SHA512 89947b2c31573c039ca051d0897ba750a3b755bc8611ab9defa43823bd1b816ae9c182e1c6e9542f22c85e4539120d8e035b0ccb1a6e71706fa19ce8a8de87b2
- SSDEEP 393216:lebKr76/xyfaK1DXuQ25HYrEex3yQ7tIDZ6SlhLD7r9o/m9Szy:lEJxyfayF25JexixFrX7qES+
- TLSH
  T166271242739E4839EAD57AF801472371AA206C28A76155CF5B05F1145EB37FAAF3CBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact discovery persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2
- Target
  1_4dd608a010.mkv
- Size 11.5MB
- SHA256 cd2992a630c95859eb6b4a1f41f65296b720da9d6fa50dc900673712e4d71e26
- MD5 56c4f25fa3b19ee31aaf405c4c725c8d
- SHA1 83d793bfabd2ca994f09815a6439c3259963feac
- SHA512 480b98261c65448c8d2b32acd62c90aca854fc2657776fc2d1cc68195780d63e644bec76cfb158299297ee53937f85972bca39206fcb85aa1cfa29264ee28580
- SSDEEP 196608:pK5HY1aFGNEex0ObW/Y7tIZniCU66f6lhLuocO1vj7Jr9UHRZhVhMNSqtSze:s5HYrEex3yQ7tIDZ6SlhLD7r9o/m9Sze
- TLSH
  T15DC60143B79E8979F9C2BEB8424B6376AA106C28A76040DF4B05D6005DB37E5AF3D7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks Android system properties for emulator presence.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Checks the presence of a debugger
  defense_evasion
behavioral3 behavioral4