General
- Target 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
- Size 14.1MB
- Sample260817-e9ljtatblf
- SHA256 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b
- MD5 3789a9c47d957662fb000e365ad5bbfe
- SHA1 5050d8f28e67d9509a588b14b00164ec4aaded93
- SHA512 8a47107f914b0b22e88fe9148c3d5d2297357bd2c4351be463527d3ee63587e0a90a91240e80d7d5608cf047944e910160bf4cf565f6dc0f5c3fa46e1bd6c819
- SSDEEP 393216:dRsr16TFK34h8qCtklD0lCsIhJrY4agBy2JJ2b:E8Z/5CetrhogBy2JJ2b
- TLSH T1DDE62267F72E949FC8F39136CE3A026256675E644643ABE72D04F22C59B3AC05B49FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b.apk
- Size 14.1MB
- SHA256 8e5fa795072ebba12d16b2abf5e13a953fb1607d9fc04b1bfee26d5bd23dc77b
- MD5 3789a9c47d957662fb000e365ad5bbfe
- SHA1 5050d8f28e67d9509a588b14b00164ec4aaded93
- SHA512 8a47107f914b0b22e88fe9148c3d5d2297357bd2c4351be463527d3ee63587e0a90a91240e80d7d5608cf047944e910160bf4cf565f6dc0f5c3fa46e1bd6c819
- SSDEEP 393216:dRsr16TFK34h8qCtklD0lCsIhJrY4agBy2JJ2b:E8Z/5CetrhogBy2JJ2b
- TLSH T1DDE62267F72E949FC8F39136CE3A026256675E644643ABE72D04F22C59B3AC05B49FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Checks the presence of a debugger
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1