c80debfcc13b6b9dc675b48154f331cfa9aba5af149d3899a9f23a1e09cdc64a

General

Target
c80debfcc13b6b9dc675b48154f331cfa9aba5af149d3899a9f23a1e09cdc64a.bin.zip
Size 6.7MB
Sample261002-gfxq4astbv
SHA256 c80debfcc13b6b9dc675b48154f331cfa9aba5af149d3899a9f23a1e09cdc64a
MD5 f7440cf3223d8aed1cea5c179d0c1574
SHA1 520c344d36f7cf67f45c5f1449de15d333601e31
SHA512 85cc2c83fd9df694290fa29e76e3bfe5bf28dd8b1564abe8856a9784d3369f6048fb08928fc53038c576848a4c03aed77cd3aa703137710ef57101ad38443126
SSDEEP 196608:mvHtFqY0gQpmoZvQQntcZLUWo3Q2j6ZH8wJ2mtRDAO721:6HtbLHQntc+ZQ22l8m2mzBK
TLSH
T11666334BBEC1370CF43DC9B4B8FF61E8E05592539111E7AA0792AA4421757C8DB2AFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  c80debfcc13b6b9dc675b48154f331cfa9aba5af149d3899a9f23a1e09cdc64a.bin.zip
- Size 6.7MB
- SHA256 c80debfcc13b6b9dc675b48154f331cfa9aba5af149d3899a9f23a1e09cdc64a
- MD5 f7440cf3223d8aed1cea5c179d0c1574
- SHA1 520c344d36f7cf67f45c5f1449de15d333601e31
- SHA512 85cc2c83fd9df694290fa29e76e3bfe5bf28dd8b1564abe8856a9784d3369f6048fb08928fc53038c576848a4c03aed77cd3aa703137710ef57101ad38443126
- SSDEEP 196608:mvHtFqY0gQpmoZvQQntcZLUWo3Q2j6ZH8wJ2mtRDAO721:6HtbLHQntc+ZQ22l8m2mzBK
- TLSH
  T11666334BBEC1370CF43DC9B4B8FF61E8E05592539111E7AA0792AA4421757C8DB2AFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  app.apk
- Size 7.1MB
- SHA256 aa09685a2d152700a66b566f42e97360b5ae542d4d995831165f4741d005fb81
- MD5 519e54ef9d298165c8623949443c2ae6
- SHA1 ec2e1e1fdf636cd708a069a42fd6c7d1b20be446
- SHA512 9b3b5346b71c68257f181a256f05f52699303c508176e5b09960570b37e32015f48ddb387277a14ba472217286056e7f8a8bae6a080205452e1d8992094e909a
- SSDEEP 196608:JlzVeXXkHbYeFGWSzCM5DB6IG7XmWq2hpUwxsXPKHxona:jIG7XmTAUwafKHKna
- TLSH
  T1D376F142FB98D91FE8B7663108699232511F9E0ACE46970B6A4C3F4C29B75E41F4DFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection defense_evasion discovery execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral2