General
- Target app-release.apk
- Size 1.8MB
- Sample260819-nxpv5staqa
- SHA256 35be5e6bb4674447dae0bbcd09a023a55b82d59fd9055ebfdfd38b7e8ddc03a0
- MD5 701d7c441465e2f1f3eabe26be47fbe8
- SHA1 fc2ce31941ae333a320fa775753c3136780a05d0
- SHA512 4d7efd64496ec71c2af949e85eeb6e971fcdb11547ee8dc7dd6fe361b333ebd0b3b3e7ddd6232beba4246f1025ef5b4f038f919e7c5a0cdd47aa6ea919b43d3b
- SSDEEP 24576:Z3EkfPHPkRGGHQv2S9xIrQHUZdARtFKQCWbm7p/kqoKEkObTPDL1Ej/DtLalLYRa:Z3zvkivlqrcyLWbU8kQH1Ej/cRugSty1
- TLSH T10685E082FF25D82EC8B745334DAA433126669E1EC592934784EC362C6C7B6D80FD9BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
app-release.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
app-release.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
app-release.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target app-release.apk
- Size 1.8MB
- SHA256 35be5e6bb4674447dae0bbcd09a023a55b82d59fd9055ebfdfd38b7e8ddc03a0
- MD5 701d7c441465e2f1f3eabe26be47fbe8
- SHA1 fc2ce31941ae333a320fa775753c3136780a05d0
- SHA512 4d7efd64496ec71c2af949e85eeb6e971fcdb11547ee8dc7dd6fe361b333ebd0b3b3e7ddd6232beba4246f1025ef5b4f038f919e7c5a0cdd47aa6ea919b43d3b
- SSDEEP 24576:Z3EkfPHPkRGGHQv2S9xIrQHUZdARtFKQCWbm7p/kqoKEkObTPDL1Ej/DtLalLYRa:Z3zvkivlqrcyLWbU8kQH1Ej/cRugSty1
- TLSH T10685E082FF25D82EC8B745334DAA433126669E1EC592934784EC362C6C7B6D80FD9BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests overlaying windows on top of other apps.
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
3GUI Input Capture
2Keylogging
1