9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371

General

Target
9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371.apk
Size 11.1MB
Sample260820-ndgenavhqh
SHA256 9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371
MD5 9c33ffd69e2efb85ec1c9cd7887f66a0
SHA1 bd176004ab7e74d124f15eca96cb2a0825ef6279
SHA512 b9df111545df14598bee1bbadc8f8eb9be63a76d69c762071f8050098b834d6a99c26dd7b46c948062dde6a1b68a3525898d668e4af87fead58db1070da58980
SSDEEP 196608:lmaWiwIq5XJmrd9ym/LZz9G3OL4UGCGpcdmCkrAVjai7aMJY3bU3IOMcg/P7nC9S:Q55XJdm/LZ4VKdmCKaH7a2Y3bwgG9S
TLSH
T147C6239AE36CA02FD57B54324DBB132106574D478D83AB53BA18720C6ABB6C48F5EFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371.apk
- Size 11.1MB
- SHA256 9c97d3197c004bc0b28561209d29a4d79703812a790a6f5ed6cbd62542b05371
- MD5 9c33ffd69e2efb85ec1c9cd7887f66a0
- SHA1 bd176004ab7e74d124f15eca96cb2a0825ef6279
- SHA512 b9df111545df14598bee1bbadc8f8eb9be63a76d69c762071f8050098b834d6a99c26dd7b46c948062dde6a1b68a3525898d668e4af87fead58db1070da58980
- SSDEEP 196608:lmaWiwIq5XJmrd9ym/LZz9G3OL4UGCGpcdmCkrAVjai7aMJY3bU3IOMcg/P7nC9S:Q55XJdm/LZ4VKdmCKaH7a2Y3bwgG9S
- TLSH
  T147C6239AE36CA02FD57B54324DBB132106574D478D83AB53BA18720C6ABB6C48F5EFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

antivm defense_evasion discovery dropper evasion execution impact obfuscated persistence collection credential_access
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Root, emulator and instrumentation-framework detection
  Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.
  evasion antivm
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3