c679455265d1632f6a2665ec5fd644db47a3d633abadc3c63b1097c096affaf6

General

Target
c679455265d1632f6a2665ec5fd644db47a3d633abadc3c63b1097c096affaf6.apk
Size 31.9MB
Sample260818-yr12bszbqa
SHA256 c679455265d1632f6a2665ec5fd644db47a3d633abadc3c63b1097c096affaf6
MD5 0ab9ec99c45527d93decaf0dcffe4821
SHA1 103a293f246caea18d86cf033a34aa9a0e23b2b0
SHA512 6091048565e3888469e50801396a3e149895629278a1d1b167e3a473943453c9cde63dc96b252d887b91e2ed11b0149fe7dd12235fa9236f1b75d19e90401e95
SSDEEP 786432:b3ExK1xcrOFxRhoegehi8xGoWBHWA0qZW0BCTQuWiig0VeyWRO:DqKXp7RVg4G0qo0qLigSWU
TLSH
T111772387E3A8A54ED8F253314439A172455B5E20CF639BDB1F04B7782AB39D06B89FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  c679455265d1632f6a2665ec5fd644db47a3d633abadc3c63b1097c096affaf6.apk
- Size 31.9MB
- SHA256 c679455265d1632f6a2665ec5fd644db47a3d633abadc3c63b1097c096affaf6
- MD5 0ab9ec99c45527d93decaf0dcffe4821
- SHA1 103a293f246caea18d86cf033a34aa9a0e23b2b0
- SHA512 6091048565e3888469e50801396a3e149895629278a1d1b167e3a473943453c9cde63dc96b252d887b91e2ed11b0149fe7dd12235fa9236f1b75d19e90401e95
- SSDEEP 786432:b3ExK1xcrOFxRhoegehi8xGoWBHWA0qZW0BCTQuWiig0VeyWRO:DqKXp7RVg4G0qo0qLigSWU
- TLSH
  T111772387E3A8A54ED8F253314439A172455B5E20CF639BDB1F04B7782AB39D06B89FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery dropper evasion impact obfuscated persistence
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1