General
- Target 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
- Size 8.2MB
- Sample260817-bngf7a1blh
- SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
- MD5 22c90e1be761de86e96e409073fee778
- SHA1 a043a6ed3e02631aa3e5fdfea76a2e4d87381908
- SHA512 72414a5f1b5146f93fed7d59bb3319a5b5644fcad5433bd51c6d75871f94bbd6ce8d2b19cd3845ab9966d5cffcd571d6221c941e53680285fbd2e114184ceeca
- SSDEEP 196608:/r4lU2ceS9+PiGVlMIX+dhSoKKXfdOgGEXbBD6SOfK4HNjl4lQ:/i3BpPF8NKKdJXNDcfTjlD
- TLSH T1CD96125AF7A9A96FC8FB93320979123411574C268B43EA876818727C18B7ED44F47BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce.apk
- Size 8.2MB
- SHA256 62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce
- MD5 22c90e1be761de86e96e409073fee778
- SHA1 a043a6ed3e02631aa3e5fdfea76a2e4d87381908
- SHA512 72414a5f1b5146f93fed7d59bb3319a5b5644fcad5433bd51c6d75871f94bbd6ce8d2b19cd3845ab9966d5cffcd571d6221c941e53680285fbd2e114184ceeca
- SSDEEP 196608:/r4lU2ceS9+PiGVlMIX+dhSoKKXfdOgGEXbBD6SOfK4HNjl4lQ:/i3BpPF8NKKdJXNDcfTjlD
- TLSH T1CD96125AF7A9A96FC8FB93320979123411574C268B43EA876818727C18B7ED44F47BCC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Checks the presence of a debugger
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2