41d7018a8c13596b83eb0ca6d2c450d0ff3ce1a82824d417475291a1a1a3f0f9

General

Target
tiktok18.apk
Size 9.2MB
Sample260812-lkbrmsdr4t
SHA256 41d7018a8c13596b83eb0ca6d2c450d0ff3ce1a82824d417475291a1a1a3f0f9
MD5 016b3d4e98e1c4e538d2fd068710141e
SHA1 76ecf3e918f4033ab0fd4d25ef82587bf36cb842
SHA512 4965cf759231eebbc3d22060e96e9d1c5a2988cca84148da36c214a37a9b4405ffc73e9b704cda8d0459a791442088cc484a9016daf0e243cbf93624e3257e01
SSDEEP 196608:ADPOTjLcYKy2EpW4EUmZOCjU4JGwzsaNLusy0R7TosuF:AqnPfwXOj4JFzsaJfr7TVuF
TLSH
T186A623195F59B574C9F7483AD56FC9284C808F8841C6E846DAA9B44C1CBBE70E33EED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  tiktok18.apk
- Size 9.2MB
- SHA256 41d7018a8c13596b83eb0ca6d2c450d0ff3ce1a82824d417475291a1a1a3f0f9
- MD5 016b3d4e98e1c4e538d2fd068710141e
- SHA1 76ecf3e918f4033ab0fd4d25ef82587bf36cb842
- SHA512 4965cf759231eebbc3d22060e96e9d1c5a2988cca84148da36c214a37a9b4405ffc73e9b704cda8d0459a791442088cc484a9016daf0e243cbf93624e3257e01
- SSDEEP 196608:ADPOTjLcYKy2EpW4EUmZOCjU4JGwzsaNLusy0R7TosuF:AqnPfwXOj4JFzsaJfr7TVuF
- TLSH
  T186A623195F59B574C9F7483AD56FC9284C808F8841C6E846DAA9B44C1CBBE70E33EED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral1
- Target
  payload_laugh.apk
- Size 8.3MB
- SHA256 3c1b8fcec5dd06296074801fa771919ec418245f16077e0e586b39eb3c342c97
- MD5 084fb047027e040192e22290fe2a9586
- SHA1 2a8cec6ee0798ff80e4044deeaf85031d8abb18c
- SHA512 57bb77f3a340e9499cd77433442881841cef59a5daa11f2e98f66c700cfc2f0f24ebf81b94be0c0e03249f87532813139f0b3a0f0cccf4e87f81e359f3eb7b3c
- SSDEEP 98304:Qa5WRrUpoEjY48mlwbUKzVnqSTuwTxRmWmddXBFGudvDxF:QbHEjY4YUknqSTuw9Rm9D
- TLSH
  T16196BF33D746B96DC9BF5637A4E95E20AF343D8A530386972028B69D78731CC63D12AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2