8f62b5b52cfa7681282abf1bf91ea5a6f6b819b7e9cab717e67ac664b404fdfd

General

Target
8f62b5b52cfa7681282abf1bf91ea5a6f6b819b7e9cab717e67ac664b404fdfd.apk
Size 24.6MB
Sample260817-fbbsdstvhz
SHA256 8f62b5b52cfa7681282abf1bf91ea5a6f6b819b7e9cab717e67ac664b404fdfd
MD5 abb27d209e1015269e4956560f91fefe
SHA1 b2704f0b61c500e38d6f345e729555987309dc50
SHA512 dfaeb33c78d77aa2bdb1a8596e41c7430e0daa46e161db2b321ef6e6077bf036a0c7e94ad3936fb7a3da79b601a24461edd7d0aba0cae5f2bc7701c118681c44
SSDEEP 786432:OVokLQP4fpkBn4vo2WL5JU2aXb/6nDL/rz/ytWd:OuJQGnmGJU2aXbinv/n/Xd
TLSH
T1C1472393F359A89ED8F792764A38412651678CA04347E7E36D09B23D1DBBAD48F48FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  8f62b5b52cfa7681282abf1bf91ea5a6f6b819b7e9cab717e67ac664b404fdfd.apk
- Size 24.6MB
- SHA256 8f62b5b52cfa7681282abf1bf91ea5a6f6b819b7e9cab717e67ac664b404fdfd
- MD5 abb27d209e1015269e4956560f91fefe
- SHA1 b2704f0b61c500e38d6f345e729555987309dc50
- SHA512 dfaeb33c78d77aa2bdb1a8596e41c7430e0daa46e161db2b321ef6e6077bf036a0c7e94ad3936fb7a3da79b601a24461edd7d0aba0cae5f2bc7701c118681c44
- SSDEEP 786432:OVokLQP4fpkBn4vo2WL5JU2aXb/6nDL/rz/ytWd:OuJQGnmGJU2aXbinv/n/Xd
- TLSH
  T1C1472393F359A89ED8F792764A38412651678CA04347E7E36D09B23D1DBBAD48F48FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery dropper evasion execution obfuscated persistence
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Acquires the wake lock
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1 behavioral2 behavioral3