General
- Target 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
- Size 8.2MB
- Sample260817-bngf7a1blh
- SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
- MD5 22c90e1be761de86e96e409073fee778
- SHA1 a043a6ed3e02631aa3e5fdfea76a2e4d87381908
- SHA512 72414a5f1b5146f93fed7d59bb3319a5b5644fcad5433bd51c6d75871f94bbd6ce8d2b19cd3845ab9966d5cffcd571d6221c941e53680285fbd2e114184ceeca
- SSDEEP 196608:/r4lU2ceS9+PiGVlMIX+dhSoKKXfdOgGEXbBD6SOfK4HNjl4lQ:/i3BpPF8NKKdJXNDcfTjlD
- TLSH T1CD96125AF7A9A96FC8FB93320979123411574C268B43EA876818727C18B7ED44F47BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
- Size 8.2MB
- SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
- MD5 22c90e1be761de86e96e409073fee778
- SHA1 a043a6ed3e02631aa3e5fdfea76a2e4d87381908
- SHA512 72414a5f1b5146f93fed7d59bb3319a5b5644fcad5433bd51c6d75871f94bbd6ce8d2b19cd3845ab9966d5cffcd571d6221c941e53680285fbd2e114184ceeca
- SSDEEP 196608:/r4lU2ceS9+PiGVlMIX+dhSoKKXfdOgGEXbBD6SOfK4HNjl4lQ:/i3BpPF8NKKdJXNDcfTjlD
- TLSH T1CD96125AF7A9A96FC8FB93320979123411574C268B43EA876818727C18B7ED44F47BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks if the Android device is rooted.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Queries information about active data network
Queries the mobile country code (MCC)
Checks the presence of a debugger
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2