0f59afe6ee67d220773d1f127a4fbc76dd3e25cfc9d8d1a4053f96ddb8d6ccfc

General

Target
flix.com.vision.apk
Size 69.5MB
Sample260812-s5dkaszfkf
SHA256 0f59afe6ee67d220773d1f127a4fbc76dd3e25cfc9d8d1a4053f96ddb8d6ccfc
MD5 30983ab625f0878e9893f25c0c31d49f
SHA1 51d0ba3e8fb51dbb35da61998b5413b29c0c49f3
SHA512 f5d2c7d02b5dec1e9b6557000c6e8f3904258af88dfe1018fd814df9d2df5039d68a2a08008c6d359ec56e4c882e026bba05a8962e317800ada68267ea233fab
SSDEEP 1572864:G3pMt7Xykri5mUhhg+g7V/WXLnetoRs02qxlkh7zFTTf96PMqBsm:G5Mt7jrY6Gj9s0NzqlIPv5
TLSH
T169F73385F765AA3ED43B4172CDA9422DA215AD228603CB0735C43F2D39B37E64F94BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  flix.com.vision.apk
- Size 69.5MB
- SHA256 0f59afe6ee67d220773d1f127a4fbc76dd3e25cfc9d8d1a4053f96ddb8d6ccfc
- MD5 30983ab625f0878e9893f25c0c31d49f
- SHA1 51d0ba3e8fb51dbb35da61998b5413b29c0c49f3
- SHA512 f5d2c7d02b5dec1e9b6557000c6e8f3904258af88dfe1018fd814df9d2df5039d68a2a08008c6d359ec56e4c882e026bba05a8962e317800ada68267ea233fab
- SSDEEP 1572864:G3pMt7Xykri5mUhhg+g7V/WXLnetoRs02qxlkh7zFTTf96PMqBsm:G5Mt7jrY6Gj9s0NzqlIPv5
- TLSH
  T169F73385F765AA3ED43B4172CDA9422DA215AD228603CB0735C43F2D39B37E64F94BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery evasion execution impact persistence ransomware
- Renames multiple (186) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1