General
- Target dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9.apk
- Size 15.5MB
- Sample260814-kyx2cszane
- SHA256 dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9
- MD5 232f6a37670fc8144eb4940dab19d8c0
- SHA1 170b194b295f3d22905dc171756d1b93d622ccff
- SHA512 76d39a10ad3030586c59f982835b2235d8601c42a067e1534585be1ac4b6271be9e795dff03d93a41020dc0a113264d73096dd24d896acc16702613237acdaa0
- SSDEEP 393216:EsgVpWB73XGkZRRBCE2oaGwDEif1vm932pHvpBU:DKpMLXBZRfcoaGABfNLRBU
- TLSH T16EF6229BF748A9ABC4F383B245355361414B4C668B43D6C3AC55763C58BBAC03F6AEC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Extracted
-
flyingeagle
-
cldier.xyz
Targets
-
- Target dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9.apk
- Size 15.5MB
- SHA256 dd7719ecf5007224c4982762d45b1df98d60e87cd2c10d530ec4eb6ad86352d9
- MD5 232f6a37670fc8144eb4940dab19d8c0
- SHA1 170b194b295f3d22905dc171756d1b93d622ccff
- SHA512 76d39a10ad3030586c59f982835b2235d8601c42a067e1534585be1ac4b6271be9e795dff03d93a41020dc0a113264d73096dd24d896acc16702613237acdaa0
- SSDEEP 393216:EsgVpWB73XGkZRRBCE2oaGwDEif1vm932pHvpBU:DKpMLXBZRfcoaGABfNLRBU
- TLSH T16EF6229BF748A9ABC4F383B245355361414B4C668B43D6C3AC55763C58BBAC03F6AEC8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1