General
- Target 177716d41625e4e8446a7f858c2e345e35d1321cfd1297d579465eb245c810a7.zip
- Size 3.6MB
- Sample260816-zaa91swzft
- SHA256 fbbe389b9b0ad18b4a0861a8e1c2673fe8c37d5a7ee20f137b1e283cd8ec3bb5
- MD5 9afdcad628e30edb751addcef95bb3af
- SHA1 31f5a71370ac517c45105229e1a9314d199dbf18
- SHA512 0f15647e7e6cbf35931129876a19b21a757f64e910a4b702dbe99b6ea28e5cf8744cb64dd41719cfcfdc0a10caa5b83175c61c756f09d5430f408884d8750285
- SSDEEP 98304:LRdAo8HaKtLOofsbZU3Mv9NBTv7kZpaonxYj:fAo8Drfs4MVNV7Cagxu
- TLSH T1CC063312D3EC1977FCE559301F70804CDA04D66BB2A2383E325B7CFA21AE654B1AD57A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
177716d41625e4e8446a7f858c2e345e35d1321cfd1297d579465eb245c810a7.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 177716d41625e4e8446a7f858c2e345e35d1321cfd1297d579465eb245c810a7.apk
- Size 4.4MB
- SHA256 177716d41625e4e8446a7f858c2e345e35d1321cfd1297d579465eb245c810a7
- MD5 6c125c0d87cc9acdc78efa832979f3e9
- SHA1 e97f3a4131f13a60fea712eccd71ef8b7f0f9372
- SHA512 c893cc7446169f645f3732bf69c13b0032bd75f4e321119d4cd5f8d74d73c6e82e46fb4c2885b2006a74b873921a2c93e2c64c9e9a29b5d65a612e6ac0aa1e98
- SSDEEP 98304:kwsmL4LFz7ooLH1ofxJT5xdeCZcSzP+Og3Vf/HfrNOr:cmL457FLH1ofvleMcCP+OgFfW
- TLSH T1CB26F143F758AA2FC837C1335A670A3526678E0A8A439797295C770C2DB76D80F59BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
-
Queries information about the current nearby Wi-Fi networks
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the contacts stored on the device.
-
Reads the content of the SMS messages.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator.
MITRE ATT&CK Mobile v16
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
5System Checks
5Discovery
Location Tracking
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
3