fed97cd7fe808ebf25461d91f5360b00dac723003b3a04da9d349fffbd6842d5

General

Target
fed97cd7fe808ebf25461d91f5360b00dac723003b3a04da9d349fffbd6842d5.apk
Size 23.7MB
Sample260819-bsvjlscd68
SHA256 fed97cd7fe808ebf25461d91f5360b00dac723003b3a04da9d349fffbd6842d5
MD5 0d9087934963860bdcd7a47aa5aafa19
SHA1 86dd274c353d694d4d44d3026d503a80ee6e3ceb
SHA512 67708d61e444159dc0849a622288cfe832326e063e1bc9de03d74d53a8dc51c3ca74b9efd19d8aaf0a111b4e82e71973e013f7b21c706e6166af39ee3bec0309
SSDEEP 393216:fq3J/tpqkJh/gV7XWP4EbKaSnH3WBBV0UjXoqWA0sjTxZW0jhrpYe3fhS5aTgY:fqRqHXWP45aoWBHWA0qZW0NrpXPY5aTt
TLSH
T1BE472387F3A8E85EC8F25372897562B2525B0D20CB639FD71A04773829B3AD46F45BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  fed97cd7fe808ebf25461d91f5360b00dac723003b3a04da9d349fffbd6842d5.apk
- Size 23.7MB
- SHA256 fed97cd7fe808ebf25461d91f5360b00dac723003b3a04da9d349fffbd6842d5
- MD5 0d9087934963860bdcd7a47aa5aafa19
- SHA1 86dd274c353d694d4d44d3026d503a80ee6e3ceb
- SHA512 67708d61e444159dc0849a622288cfe832326e063e1bc9de03d74d53a8dc51c3ca74b9efd19d8aaf0a111b4e82e71973e013f7b21c706e6166af39ee3bec0309
- SSDEEP 393216:fq3J/tpqkJh/gV7XWP4EbKaSnH3WBBV0UjXoqWA0sjTxZW0jhrpYe3fhS5aTgY:fqRqHXWP45aoWBHWA0qZW0NrpXPY5aTt
- TLSH
  T1BE472387F3A8E85EC8F25372897562B2525B0D20CB639FD71A04773829B3AD46F45BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery dropper evasion impact obfuscated persistence
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1