Extracted

• • Target
    ready.apk
  • Size 3.7MB
  • SHA256 4d0850186e6776bf2d995e7895752fd215a084dc1870dd8be8aea4eb05bc39cc
  • MD5 329e4fdea2c33010e44320dd7f714211
  • SHA1 68f570ce032635f27b5bd0744bda1d6eef5189bf
  • SHA512 3414df5b745966136bd16f75243fc73872236d4a2b3aae8e8922bb166551407a7ccbe8544313864077eba90784ed07b2357ae2cc2db30337e47a64e9ee6c7e59
  • SSDEEP 98304:dyVpU5nDp0GzrD0QhUSgDRkAGmz0zBuTy0tg3qyl:gU5n107fxzlx0
  • TLSH
    T12B06E043EF45CADBD8BE83B16B330DA91A170F18C642AAE705157A7E2E771C10DC5A8D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistence

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6