pixrevolution | 5fe6206105b84ca44a5fd1c31ca42da8b9a81d70e9f45202ce498ddec14f2e41

General

Target
a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42.zip
Size 1.3MB
Sample260820-xs32mstfnc
SHA256 5fe6206105b84ca44a5fd1c31ca42da8b9a81d70e9f45202ce498ddec14f2e41
MD5 36174937ec35535439d03e90dceea147
SHA1 65a38b4aef606a23ca3edaf1825056c811a8c73a
SHA512 f4d669ac03a2e9737d1764917adca972e29558856878cf8990eaa3856b52cd621a29b980ccaaa34d77e9590fb259a10a6ff250226e12393b0f02f6eed88a0020
SSDEEP 24576:1lWPoqLHp6u3juP9xpjFTSojS8bk5K0Wvz0sAe3mrXKPSlY/Wmdib:1lWPF7nzyXXS+qW7nAcmrXKDO0ib
TLSH
T12855334EC79F0539B84E3933B74D3949865A8ADC2970B756CD5D0464CE8FEE288AB31C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42.apk
- Size 1.8MB
- SHA256 a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42
- MD5 de6ac97a12722368a7b944682aa01525
- SHA1 ba166c29e606339abe5accc97310eb66a21d8b90
- SHA512 3dd5b67ebf3d1f569cc1d93285af45b21afcabc2a0f0b8ce95014290ff3ed7d3a892382ace3285a5dca5c1af14ec73b6e2fb5d7623a03f567adef86a169fd8cf
- SSDEEP 49152:fHjfyQEvcI+IMydEaOqVtrr32vDHM0d1PXqjgI7ov6:fDaQPvXyd7trqd16ED6
- TLSH
  T16895AD85BBE99E2ECC7340364F4A5635150AAE27C343C343D968361C78BB6F44E897E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery impact
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
behavioral1
- Target
  update.apk
- Size 866KB
- SHA256 3a59035ce30ac0f26bf49d3a0175e530812968614d3870099742258fb336ce6b
- MD5 de57ce657171a839c3f47dd4c3d8c322
- SHA1 96778b7990e3087bf1c26bdf36ca9a64c4a24100
- SHA512 5c0cd2719a25f1c261adefff5c58e293282512156896bcb312baf6e3b4ea173e4929b7d7827742abcbbd61dd14140be2806725c786ca6b90fa2662d53090e59c
- SSDEEP 24576:QIKERcAUIzzvDHMU4zgdFERp+2/yahgm6+7w:YERcAUIPvDHMkdFkO4gJYw
- TLSH
  T19015BE82F7E55E2ECD7744360F9A833112129E03CD56DB07A8A8772C683B6D94F4ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral2