Extracted

• • Target
    bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e
  • Size 676KB
  • SHA256 bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e
  • MD5 288d300db70bc4d68bea5ffabbaedc42
  • SHA1 cb97095b5f002a351869f2970ad6284a12c86431
  • SHA512 9dedf3772d2207644c5371b020516cc7081c2f6a556f12d79c756ba409b7ca895143c9f42041f89e612478e31c40aa731a13a78edf3188e3f61cbe73676d311b
  • SSDEEP 12288:VZd+RjBgbBUjq0jhczeTPBvf1MRusT3cgtN0Fhm46Rq218gAp:j0JGWZjuiTPBv9MRHT3SFhm4GNBAp
  • TLSH
    T160E42283B356C5AEE9E6113F8A0656431A377DA58F42BB7B35DBBA2C15332D05F21E00
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2