7ee0463baf7a43562aa8374e5023cf644925849963bee72fe0337fa85bf256da

General

Target
4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.zip
Size 28.3MB
Sample260819-wh5l2sstd1
SHA256 7ee0463baf7a43562aa8374e5023cf644925849963bee72fe0337fa85bf256da
MD5 b3245e33f952c40689ac75305bc245cb
SHA1 0b8c323845e970ac038d63e9bd1edcfbf8ff8d33
SHA512 78994f593ead699a31d3e5274b2890c9b3e578abafe3162726aafaceec849001a5c9f39c64d104af2b48be38d3d00566dcda0f879e554e9ee65860a3da6d432c
SSDEEP 786432:V3WZ3/TPiDyOmkqhNwT/sQ10PARNuaKCX+XSTMbytQ:V3WZPTTRhCl1EhLnbytQ
TLSH
T13F5733F5E9169E51697463CF9004CE2B376E56BA4F23E8A09F35C0D3A64DA72F180E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff.apk
- Size 29.9MB
- SHA256 4e52f85b5be6cdcfc8a3493c0d56e99494a36871e53ef90ea915015a9fcbbdff
- MD5 e673f474ef3fbfb60c9ae9c32829d4bf
- SHA1 44c4be3ecc83a30db2483eb9895e30ec48fb6eaf
- SHA512 903ab32139331c0fcd72bdaf3f99081252a2622861f43be495a1fa6ac695757b4906bce36dc14cdedde8001346dadb7c301ce1e3cacb1cea1c4056c4bcda7c3e
- SSDEEP 786432:ctCiCLBpRFLh2AeNlUCwCeoJeZcFQGUBuLbXOQgJ:ctCiCLBTFLhpeNlBwCeoJEcFQGKuLLUJ
- TLSH
  T1DB67231AEFC87A6BC5F74236587A55254C430C44838BCA82EE9A752C2C776F1B71DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery evasion persistence collection credential_access impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Attempts to obfuscate APK file format
  Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares services with permission to bind to the system
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3
- Target
  payload.base
- Size 13.7MB
- SHA256 5df90a0393f61cfbb3d7893801428ced22516890828da35fba93d4ec47c42725
- MD5 b6b2ded385e7cca688beb3618aa9d643
- SHA1 7af30b6113a329f9ab0e6a72e0509624698330c4
- SHA512 d2f5457d81fdbbbf252b7a2806d5c290c79039b25352300cd0f0ca4217cce6cfcc8bc5c1cfc087ee7a16d0c8d57208fa43cb7b6bf970f03c3a2fd84677955dc3
- SSDEEP 393216:PYB8tMONZWIsH53s7gYB8t8wYB8tDYB8tAoUUMyjeYB8t5/UlZ:ghONZUcddf81MmjtlZ
- TLSH
  T1ADE6120AEFC87A6BC5F35236487A59294C430D4447C7D983AD99752C18BB6F0BB1EBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery evasion persistence impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral4 behavioral5 behavioral6