Analysis

  • custom tags

    bankerratoverlayevasionantivm

General

  • Target
    6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4.apk
  • Size 2.1MB
  • Sample260817-bcczma1amd
  • SHA256 6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Root, emulator and instrumentation-framework detection 1 IoCs

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

  • Scripted prompt coaching the user to enable Accessibility 1 IoCs

    Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

  • Attempts to obfuscate APK file format

    Applies obfuscation techniques to the APK format in order to hinder analysis

  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 5 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4.apk
    .apk 2.1MB

6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4.apk

  • SHA256 6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Root, emulator and instrumentation-framework detection

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

  • Scripted prompt coaching the user to enable Accessibility

    Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

  • Codesign digest Mismatch

    File was altered after it was signed.

  • Insecure Codesign Algorithm

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
c010f78f5b7d06b7ffff9e62778e12e22e41860f
Digest Algorithm
sha1
Digest Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d
Chains

Jan 1, 0001

la.ronilart.popmpa

Android Permissions

6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4.apk

Permissions

android.permission.INTERNET

android.permission.POST_NOTIFICATIONS

android.permission.QUERY_ALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.FOREGROUND_SERVICE

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WAKE_LOCK

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SETTINGS