c850564e9825d83428a4d6f984f0752096f888016be93d2a7d5f5bc1774c1130

Sharing

Copy URL Twitter E-mail

General

Target
Babbel-v22.8.0-(Getmodsapk.com).xapk
Size 87.2MB
Sample260811-y7brda1crc
SHA256 c850564e9825d83428a4d6f984f0752096f888016be93d2a7d5f5bc1774c1130
MD5 13ab4ebafa57885fcaf2420db2aaa14f
SHA1 da46293de72e2a6d71ba471ef9471f75c8bcf359
SHA512 e84364e59942e9d7fbd22d574312802e654d7fc63a286bfbebcbf7ef0887eb0264c4ebbd070c37da4ef5c65aa01eaa96fdbab6fea5f23b04b68d2285d0f697a6
SSDEEP 1572864:sI2tdN78AkIRvZuQDRPnr4ScoTDyUNsj6Z4VmGJQYht4v7hFQgZ8ALMLOHwsPW//:t2JX6qPnr4ScoTDyUNsj6Z4VmGJQYhtp
TLSH
T1C318E009E70E9C36CDBEA27C4C6A1790B3366D406A42C3A72415B16CFDB37E057A9BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  com.babbel.mobile.android.en.apk
- Size 67.7MB
- SHA256 84491c3eee6a144a2b6b6b045713d96935af6134a5a6997cb7231361abe949e8
- MD5 84697bdc6c166f8fab9a41c497183ac3
- SHA1 a01c0234fedc9233ad87a64d69129db01f83af81
- SHA512 f4692e81acacc0bc1f50f74399fd205445117316cf4be75bc2257b1a889c78da601510232a6ad6aeaf0da5a5beebf944334bebfb9ab2e3933a30f197908edab8
- SSDEEP 786432:ZW2IfnutdOGYK8a2kZqeaIbqnKvgGujcB3CWief8wnE5O9:dI2tdN78AkIRvZuQDRPnj
- TLSH
  T116F7F102E7129E31CC7E93754CBA6790B7316E44AB4387A72049B278BCB76D167C9BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution impact persistence evasion
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  lib/arm64-v8a/libandroidx.graphics.path.so
- Size 9KB
- SHA256 41e9a793c43a0f4fddb19e33f346bace464f30f888ba7b9eaf96294ea115bfb6
- MD5 cc6cf9b4774c77480df5e6c368a44af9
- SHA1 d7c17fcb44b30a6efe89d436aa102abe52e008a6
- SHA512 be98315c6f4a6a6d6ecf923d85b313c72a1cc279cc833244a69cff4ffe65144ac841a840f1cdb38490955db9cd1f933158aa635b24a9bc5f9af14992fcb0eec0
- SSDEEP 96:9r86qKySYJ+DRDNQTOSPACisQL5Tipsv/zPQlque5XFAWar5kkm5Kci6hzjhj9AL:9r86qKFY8ov3is6y8zITeHTarmpKEx
- TLSH
  T18D22E89DD3BDDC72CCDC927D49DA0A33B636A40481E1CA8AA1185A5CBD033D4D725BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6 behavioral7
- Target
  lib/arm64-v8a/libdatastore_shared_counter.so
- Size 50KB
- SHA256 96c1396995cc8ee32c85b88cb414a67a7327f7f5faa1195d241bc2fe1579266d
- MD5 887be602c862f1b7fec1e08ad1831dc3
- SHA1 8e3a8539f102810db730b2d2759b327c93cdf147
- SHA512 4a3c5a319a35ecb255bbae562075dd2826be2d781e2c3dc7ec22e75f7eca5c48b5b9aca7a71b40c42c4b7306bc1de67225d4ecdd08c072f06f668a04c629ba99
- SSDEEP 96:DO/Powf8FSaQhkn/OAybmq/xVlpYxfI4nTZBr7xD3z:mASR1lAUtqfLnTZBr7
- TLSH
  T11633A597F39AC997F895917C914B0320FB3AD4086521464B7D044ABA3C563FF2E11B82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral8 behavioral9
- Target
  lib/arm64-v8a/libonnxruntime.so
- Size 17.4MB
- SHA256 3fc3e79539f06f67360a810e60eb5c513db5febc16f7bc71e5d9e8ce39e3d775
- MD5 36360e7e38fc69117acf3a99eb5baee9
- SHA1 1de3e6441c9744982e8f7964d169ddfba77d22e3
- SHA512 028017394d3a0922acf72f31463b653e0612f25b7e699549a230593ae481aa815b942c079131dfe770324bce1e4bb71eddcb4877ad6b18e6f94c613067761ee9
- SSDEEP 393216:oVkgkScoTDyUNHMj6Z4VmGJQYht4v7hFQgZ8AWqhsokjYi9QYml7fMLOHwsPW/Nm:oVaScoTDyUNHMj6Z4VmGJQYht4v7hFQq
- TLSH
  T1E3078D6CF64DA82BDEC6B0BC8E0505DA732B74641660C2E92826450DFED37E45379FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  lib/arm64-v8a/libonnxruntime4j_jni.so
- Size 73KB
- SHA256 adcaf5e11ff65ad7b54725b2869118568b14ce2f3596d1b6f082ed0c774f2539
- MD5 bde4ac328d2b598f3ceee493f85c5ddf
- SHA1 d629de06e799160c970cc6fe29ff58e785601b54
- SHA512 59404d90da277e2523a37524bf872196f3503253693cc4132743fa31f6cf270c410a6b2589180f71ecf785896442e8e3dd31fac659024fdab007a8b32d7ff80f
- SSDEEP 1536:kPtU0+OIhbtwaXL2cBIao1YqBwFODnhBy0+BqYeiTEtIIlJNCClCysD5IjMDXZ:k1U0+OIhbtwaXL2cBIBBzrhoXiuaCBtp
- TLSH
  T12673E8D1658E283AF8E671FD4EAA49D1FE29F5901F2206B53D318909DC03AF6C690F71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17 behavioral18 behavioral19
- Target
  lib/arm64-v8a/libsigner.so
- Size 1.1MB
- SHA256 fb279ea3d929928055c8cb90e3a3c213939869a51ffafe6d587a072c530c5736
- MD5 b00fa453f379843ced688676ca677622
- SHA1 1130124320b0f11e5869b66862f6917e7c429865
- SHA512 9a70dc7972c5c68b6685c85c1b8232f21849816f30ef5a193ced2296f3cbe4f28738e7a1b4b00af531bf83c530d96253092a386ddc603cddcb02e6d755c3d0f8
- SSDEEP 24576:mLRHMubzXwhhpSv5FUL9iyoEtq/tv6q5jsz:yNzXmq+cyoL1
- TLSH
  T1FD354B4E575C3C1BFA81B9FC998CC481BCA67521F7008EF65A1108FD5F03AD99EA53A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  lib/arm64-v8a/libvad_jni.so
- Size 63KB
- SHA256 da2b7404d60fad807fa68ef3303e0e2c2d5093632c376983aca0e22fe064ec88
- MD5 d3ad5e31b63811525640dda4a464c8b0
- SHA1 6cc78fcf7e4220dce9fbd4367e28f3dea32cf2dd
- SHA512 1e37fd96259ef609ebc829921755077fd0636220e65ca54625dcc9a5b704bb453551622926e551b754c8241f31f92386440c4840dacffc73ba204d6c19a7d01a
- SSDEEP 768:gYyHFQNjRye1rTbzYCV6sQFDFnOSrG2r4qFDq8oR437b3ZtrYaYNv0mhX0LiWQK:fylQNjZD6BC2r4AzoR43XZtrYaYl0Mf
- TLSH
  T1FB538D0FF619D43FC1CAB479AC8B46C463DC51805A9E93001D099F1AFE513EDABB869B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries information about running processes on the device

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Checks the presence of a debugger

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27