7fa18253fcff9ea9728834f2768c41f999c7792ca2b11bf4e04696e9cc1ca5b5

General

Target
7fa18253fcff9ea9728834f2768c41f999c7792ca2b11bf4e04696e9cc1ca5b5.apk
Size 7.5MB
Sample260817-d56hrahc69
SHA256 7fa18253fcff9ea9728834f2768c41f999c7792ca2b11bf4e04696e9cc1ca5b5
MD5 b5dac94bf0c71e6b1a94ebbe051b1e84
SHA1 9ca911f18c188764787cc8304e9048989e213759
SHA512 e179388221306754995daf47e4048fc313127934943fb2df36f9081c748a8041fda656f19be593a43e5ed68661acf675ea2e23bae158fb8c999391209491af38
SSDEEP 196608:m4XV+fqikyAe71u9M9wP8UG0018nlxfLB/qI:mQ0kyAe71u9MWsNOlxzP
TLSH
T13F76024FE345765BC4FA83BB45B6723511475C214BA3829BD92C723CA87B6F08E94BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

android banker c2 defense_evasion discovery evasion exfiltration obfuscated otp persistence stealer

Malware Config

Targets

- Target
  7fa18253fcff9ea9728834f2768c41f999c7792ca2b11bf4e04696e9cc1ca5b5.apk
- Size 7.5MB
- SHA256 7fa18253fcff9ea9728834f2768c41f999c7792ca2b11bf4e04696e9cc1ca5b5
- MD5 b5dac94bf0c71e6b1a94ebbe051b1e84
- SHA1 9ca911f18c188764787cc8304e9048989e213759
- SHA512 e179388221306754995daf47e4048fc313127934943fb2df36f9081c748a8041fda656f19be593a43e5ed68661acf675ea2e23bae158fb8c999391209491af38
- SSDEEP 196608:m4XV+fqikyAe71u9M9wP8UG0018nlxfLB/qI:mQ0kyAe71u9MWsNOlxzP
- TLSH
  T13F76024FE345765BC4FA83BB45B6723511475C214BA3829BD92C723CA87B6F08E94BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  base.apk
- Size 5.7MB
- SHA256 aa2b85c26056dfdba1285b2ed75c15c3bd8457cd907d2f64513942cd3f9ac698
- MD5 4ab02faf520fe0e1369bbfc82346e069
- SHA1 af1c8fe64b7acef0c6f50c74b8fd6df94ffd10ea
- SHA512 1bf86beaa9f16978199c14ae9a58bba16ede40d94c6d7972733aad7333aeacdecd36046bff7f2774a159bd8a0fdf6593dca6202311a6a6002bfe2850cbb58c05
- SSDEEP 98304:ryjQAtE8kzlktCzqBEVUFFWDgaifG5zTjOR7NCXclwuKcqMXEFBnO4JdnNRqU:ryZtE8kmtCz+E2ad5zTjORZlw5cqMXER
- TLSH
  T1F256E0CBA7C99B1BC43A91B9C56B72F151474C114AE29F0BE92C720C78B75E48EC5BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral4 behavioral5 behavioral6

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Obfuscated Files or Information

1

T1406

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's foreground persistence service

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6