fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661

General

Target
fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661.apk
Size 11.1MB
Sample260820-qckf2ade78
SHA256 fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661
MD5 8ebbed8b95fba632be8374c753767622
SHA1 afd4122b722bb84668434869ba514232b41f8e8d
SHA512 33e1f88248f6c219bc8e7c34d361729cd2b9a1cc1fbbe4c23a8f69d317b19bd43c0e17c781788516215dbb89a703e879c71eee36daee9516b38d3e3b518dcc35
SSDEEP 196608:Giz9af5CxnXKq0Pv5lI+A5RNG49SjVFDAk6fKDsnYeIaZcg/P7nC9zu:daf+nl0Pv5WAQSjrDu+s+gu9q
TLSH
T146C6225AF32CA02FD97B543349B6122102570D478E83AB93BA19724D29FB6C84F5EFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661.apk
- Size 11.1MB
- SHA256 fef611ec877bebdb9b9a5b454b23dc5b9d0e3cbcd8743501392f71c5e6d2b661
- MD5 8ebbed8b95fba632be8374c753767622
- SHA1 afd4122b722bb84668434869ba514232b41f8e8d
- SHA512 33e1f88248f6c219bc8e7c34d361729cd2b9a1cc1fbbe4c23a8f69d317b19bd43c0e17c781788516215dbb89a703e879c71eee36daee9516b38d3e3b518dcc35
- SSDEEP 196608:Giz9af5CxnXKq0Pv5lI+A5RNG49SjVFDAk6fKDsnYeIaZcg/P7nC9zu:daf+nl0Pv5WAQSjrDu+s+gu9q
- TLSH
  T146C6225AF32CA02FD97B543349B6122102570D478E83AB93BA19724D29FB6C84F5EFC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

antivm defense_evasion discovery dropper evasion execution impact obfuscated persistence collection credential_access
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Root, emulator and instrumentation-framework detection
  Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.
  evasion antivm
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3