385453ac19062be1f451b466949043963eb5756e7327cce1676a2c3024a9c602

General

Target
sample.apk
Size 12.1MB
Sample260906-wthxesel7z
SHA256 385453ac19062be1f451b466949043963eb5756e7327cce1676a2c3024a9c602
MD5 fb30d626b7262c6831aec0244aa95b6a
SHA1 85591ea5294b74e93510e9a1ef12fef8312b022c
SHA512 f011a6936d23ae7451bdfeb03bfa0c90694fcacb4ed09d29b4e360d7d0d9834899bfae72647660c809e8bc99e22d8a8e938ba6839aa305b878cad92b5d1503bb
SSDEEP 393216:1HtKH7JK6hTfKLPWr480i3qurFAMoCoA0uN:1NKH7tLfd6u+MoCorS
TLSH
T17FD612C7F7A89A2EC87740F24C5E567122675C22CA439B47AC58375C3873AE82F497D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker defense_evasion discovery execution

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fluxserver.vizumitvapp

Checks the presence of a debugger
defense_evasion
Starts a process using built-in Unix shell 1 TTPs
Android's native Unix shell environment acts as an interpreter to execute scripting commands outside the standard runtime environment.
execution

Unix Shell
T1623.001

com.fluxserver.vizumitvapp
1⤵
- Queries information about active data network
PID:4210
- /system/bin/sh /system/bin/pm list packages
  2⤵
  PID:4252
- - cmd package list packages
    3⤵
    PID:4270

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Command and Scripting Interpreter

1

T1623

Unix Shell

1

T1623.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/com.fluxserver.vizumitvapp/files/profileInstalled
Size 24B
SHA256 3d875cbcd4c2da7f911be672e354b30c4ebcf6e91ed75ca42cf3e0c7dbe1c61e
MD5 18b2f2008701e65434cc78e16568fa7e
SHA1 47c38ef275547319d56180213c13194da95b316d
SHA512 d1967afa072e4aaccff82a6b313cb1e601278102c43cf8270e6890e1a142ae19c1fdbc0046c37d710466f267bf835fc8ee55c9bc7ba6191b7912d82e04c6ac6b
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.fluxserver.vizumitvapp/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 3c9a51b66c9f644a41f40debfa86247cc87d8179934ffad1f595c440d049b43e
MD5 6bd41c9076b7a8024f79eb2458940a17
SHA1 0fc1d2d43983b6c9ef873770b76b87bbacc78f39
SHA512 10ee237654f7d9a81d232abe15bfe4e344099aa8852e758bcc9e93ddd003c6eb036ea2683ac498bbece1bce22f59c17651a3895a6449fd2fe7c990f8faa139a7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.fluxserver.vizumitvapp/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.fluxserver.vizumitvapp/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 6a0d9aeb804e6331e3583082f6898f539e79f98523ecd4ebfcb9a93b07c2e9e3
MD5 25caad88def809f52cab1d9af42c42fe
SHA1 7c0cf455326175e338ccb4cf09da7d349d4444ee
SHA512 d345cc6d3aaf32be7e0e6c3a31f9d6b47e5c23a2ff46ee0d5d265212a878f8c05e80e968af6daea51adbdbe63bdf26e47bf2d6056c88419e786900d95440eede
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.fluxserver.vizumitvapp/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.fluxserver.vizumitvapp/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 1175ab943db640d9bcb413d6504b12a063818bfbc54643a872776046397f06c6
MD5 ad4f4028bf5288b94492815b79bfe2d8
SHA1 3d5a3ade3553b493398c9c7e78091fbd8f8c26c9
SHA512 f0b4b4c3899e213ce6ae03cf19915ebeade1e62dfceb767a4971d61fd8b1de430f5e159fbaeefcc2d82cf488b117c2fb3567e4dc44438999c4ef7e359d55f51c
SSDEEP 6:KX9QZWD09FZdrlOERX4PBX4ogLugMBX4suuK+/nxrnv7ldj8P/kTOw2:KX9QZWyzdTRmBEyPbP/lzW+Ow2
TLSH
T16D72C2F563641993C6090A7780CCF7411EA39E194253C74B55120624BC027CEE4D2D7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.fluxserver.vizumitvapp/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 459bb15ed6e8a4e08c78afc7794d3da0e309a22c0f6a041d9bf0d89d32ddcb4f
MD5 053af177c5d4d5c0f9843d1749a0c8dd
SHA1 e9c6364af05eb01264a22e85acc4229b33e27d95
SHA512 732d1bdbca477399d26ac59f09e6ccbd0a8225cd6853e433308f2f5f329d45a9f1f7987d60583ec6081d6df4f61ca7be9fe811bb64f447f7b72e6037bfa03fa3
SSDEEP 96:ie6+hdjnHtDRMpf8UzS6+BD8q0ExPMvyNd:iedjnHt9Mpf8UzS6+BD8q0E5MaL
TLSH
T1E7B332DE0F2D2540C499A8F0E0941FB1793F452EC793E3E6A5920175AEC2921DE66CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.fluxserver.vizumitvapp/primary.prof
Size 3KB
SHA256 20b3bf20cc8f48d0fc85f9a26d4ff34b8947b84d89480c9421b5af4b7c4ea118
MD5 f4efce56361b3bdfef8cfc9b015ef3b2
SHA1 a15a141c8809a0697045892bf30eeab67f16c547
SHA512 54a5ee7e48ffcf85b3fa0bbe1c89f7349a18f7a27d0c34fdd2feece009146554c9f8c86360a0a447c86891ee5a6893fa42917d0f7c527f688494edaf3f9b95d2
TLSH
T18F816D0D22EF0C989821C7A391FE42D0927951278D09683BEE667D061DCFBCB1550AE3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads