General
- Target 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
- Size 19.1MB
- Sample260820-lkmtxatepd
- SHA256 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27
- MD5 a1a4fe5ec1bd523034d08ae26b812a5a
- SHA1 157744af9745209f418f732d301965447d8dbe66
- SHA512 3e3842e2f44426778a3675422fd70f9bca65ab18e8b1eca610f6294188ac5c367483928fbd24e635df2749c6624f005db696dcb99ad762d7282edefcf1f46ac3
- SSDEEP 393216:PMG3RgnY2bbdHBUQm+SPSqhlaVeAZzqrz+umPIlE2pEPnx73wmoMPKlIw:d31ySPSqhsVeAM8IlEQmZ3dPK5
- TLSH T19317229BBF4CE87FC43A5073CE669133327B9E164142A7737508B20869B35898F59BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
Resource
android-x86-arm-20260325-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
Resource
android-x64-20260325-en
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
Resource
android-x64-arm64-20260325-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27.apk
- Size 19.1MB
- SHA256 3bf85d89ea0f5f29c3adbc1af46fafb2fbd2147102659709cd1bd90273b44d27
- MD5 a1a4fe5ec1bd523034d08ae26b812a5a
- SHA1 157744af9745209f418f732d301965447d8dbe66
- SHA512 3e3842e2f44426778a3675422fd70f9bca65ab18e8b1eca610f6294188ac5c367483928fbd24e635df2749c6624f005db696dcb99ad762d7282edefcf1f46ac3
- SSDEEP 393216:PMG3RgnY2bbdHBUQm+SPSqhlaVeAZzqrz+umPIlE2pEPnx73wmoMPKlIw:d31ySPSqhsVeAM8IlEQmZ3dPK5
- TLSH T19317229BBF4CE87FC43A5073CE669133327B9E164142A7737508B20869B35898F59BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock
-
Queries information about active data network
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Checks the presence of a debugger
MITRE ATT&CK Mobile v16
Tasks
static1
dropperloaderevasionantivmobfuscatedpersistence
Score
10/10
behavioral1
defense_evasiondiscoveryimpactpersistence
Score
8/10
behavioral2
collectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistence
Score
8/10
behavioral3
collectioncredential_accessdefense_evasiondiscoveryevasionimpact
Score
8/10