ad61e0abe570c3575b01fbd07fc92e88c2516d1b74bb2ed536c6e2cc8e70435e

General

Target
ad61e0abe570c3575b01fbd07fc92e88c2516d1b74bb2ed536c6e2cc8e70435e.apk
Size 5.4MB
Sample260816-hvsalasbka
SHA256 ad61e0abe570c3575b01fbd07fc92e88c2516d1b74bb2ed536c6e2cc8e70435e
MD5 1416445ca38d3f168e98e1c2e25ac469
SHA1 10ef0cedca56d0017e441ffd4022891e42b81b80
SHA512 0055b0013ab064af78d6a8f4a4c8903277d4062d2ede1f46b48e034db6cd913f7170c8813a4e1aa3b7cc82ce540e02010e49b418a5a1940941f4ca7fd26a01f5
SSDEEP 98304:xemw4hKQr+fh7i7lDgrccBlOCGXLv3KaTT4MFrzoYLDMtp2v+1zIPNaNl9FrvY+Y:xeAhEZp/OCGXLv3Ka3XrhE1zIMfvw9
TLSH
T1E146338E7A4AF691E333C032493496687215DD71AE02EFDB9455BA440BFEB4C035EE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ad61e0abe570c3575b01fbd07fc92e88c2516d1b74bb2ed536c6e2cc8e70435e.apk
- Size 5.4MB
- SHA256 ad61e0abe570c3575b01fbd07fc92e88c2516d1b74bb2ed536c6e2cc8e70435e
- MD5 1416445ca38d3f168e98e1c2e25ac469
- SHA1 10ef0cedca56d0017e441ffd4022891e42b81b80
- SHA512 0055b0013ab064af78d6a8f4a4c8903277d4062d2ede1f46b48e034db6cd913f7170c8813a4e1aa3b7cc82ce540e02010e49b418a5a1940941f4ca7fd26a01f5
- SSDEEP 98304:xemw4hKQr+fh7i7lDgrccBlOCGXLv3KaTT4MFrzoYLDMtp2v+1zIPNaNl9FrvY+Y:xeAhEZp/OCGXLv3Ka3XrhE1zIMfvw9
- TLSH
  T1E146338E7A4AF691E333C032493496687215DD71AE02EFDB9455BA440BFEB4C035EE9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection defense_evasion discovery evasion impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Acquires the wake lock
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads information about phone network operator.
  discovery
behavioral1
- Target
  com.plugins.cross.jar
- Size 118KB
- SHA256 573a35dbec106af4177c53774691bf27ce574a07a21ebee7e2ce06d185f3fbf0
- MD5 6beacd927561363019e9e47ab9a68c60
- SHA1 d4f32c3582cce6b025f4a3c613adf2a94f84dfc3
- SHA512 ae2fccc535becaff64b2381aceeb2d3c3ea7c35c876f445bcaa07e73293773ac3210e60678d2196bbc94c1375220c8786857a179c8d73273f1284e519866e0c7
- SSDEEP 3072:Ccf2nahoMik0Mm5FdJsRVY2LUpLbZly9BIIQ:CI+aOv5W9WLn9IQ
- TLSH
  T1B8C3F1433680EEA6CC3B95B6DB2B3005F979DD201B12BED31598B21684F33C9C7529DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3 behavioral4