de78e75d178b6581cabf06f9219ffaab4e5748ba74e73de5dbbc669ff2e761d9

General

Target
SecureVPN.apk
Size 16.0MB
Sample261006-e9qtjach68
SHA256 de78e75d178b6581cabf06f9219ffaab4e5748ba74e73de5dbbc669ff2e761d9
MD5 72cd818c94e331bcaad26e6575525c4c
SHA1 4014b11655e5febbc210ca9030def7bb41464961
SHA512 7dba8ff5a7241818c1fa42aaf91a75957ec8bd2f9f1be1d42a3e0cd9bda31ba629040937988cf397b8ae10d1b45ec4f5340bf95de6a1a5bdcb0233c8a5651ea4
SSDEEP 393216:Kv/d6I000eVJ93IgG5a00eVJ9U1RWd00eVJ93L:K3d6VIzFG+IzU1mIz3L
TLSH
T19E0733C2E3AE387FDD610835AE5B45581A959E984B44CB472C08773C6EB33D84FAEB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SecureVPN.apk
- Size 16.0MB
- SHA256 de78e75d178b6581cabf06f9219ffaab4e5748ba74e73de5dbbc669ff2e761d9
- MD5 72cd818c94e331bcaad26e6575525c4c
- SHA1 4014b11655e5febbc210ca9030def7bb41464961
- SHA512 7dba8ff5a7241818c1fa42aaf91a75957ec8bd2f9f1be1d42a3e0cd9bda31ba629040937988cf397b8ae10d1b45ec4f5340bf95de6a1a5bdcb0233c8a5651ea4
- SSDEEP 393216:Kv/d6I000eVJ93IgG5a00eVJ9U1RWd00eVJ93L:K3d6VIzFG+IzU1mIz3L
- TLSH
  T19E0733C2E3AE387FDD610835AE5B45581A959E984B44CB472C08773C6EB33D84FAEB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Requests enabling of the accessibility settings.
behavioral1
- Target
  payload.apk
- Size 4.7MB
- SHA256 f13c303fbcd5a7c976b8bf2beeb7f9703bb3478720cc4c8478b5c4cfc2103bc0
- MD5 84ab17d7b72f6b0b1af01258dc26d927
- SHA1 f8de5515ddee69a84ac4ba408484670dc3a54aab
- SHA512 bc7759a0a0cc1684a3f075f4d7ee1db04471181ef78575cc3ea1942ff0554324d28d59dac061b1b670820f7a073893c3b64a8ae8bf003b39ae2a251922ea3e1e
- SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdhjYw3tTptYVgi5zAKy63kZW:puylKSa7VZ1IF41f1nLSV5JFV
- TLSH
  T193362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A894763C68372C44F4ABC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection credential_access discovery evasion execution impact persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests overlaying windows on top of other apps.
  collection credential_access
behavioral2
- Target
  payload.apk.bak_20261002_224503
- Size 4.7MB
- SHA256 a9e003cb0b5f5631130e8a9aa71cb9df1d6896931bdbba7e9c3999f59a681b88
- MD5 7793610d262cb261446fadad771721de
- SHA1 050c67662858d4a297e507813c72b02084d238d1
- SHA512 a61d12b616710f803135c12f9c49462019f058bff61ed0644ed25f74074e25174e06c556394224f6676a6e81a422991f38060d1b5e97fdb5d1f002a8d95de789
- SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdnjYw3tTptYVgi5zAKy63dC:puylKSa7VZ1IF41f1xLSV5JFY
- TLSH
  T14E362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A898763C68372C44F4A7C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection credential_access discovery execution impact persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
behavioral3
- Target
  payload.apk.bak_20261002_232327
- Size 4.7MB
- SHA256 5aea864b311979c78abd4f8a8d9d09ac2f85032c2d118721d9fb59f98448222c
- MD5 116d6227716be388ca7a139de90950ce
- SHA1 636ad0ff11139c03798ce290514b154256dc1646
- SHA512 ac48bd193ac3130bb09014a8737b909e78d23a91bb7c4fc5282bb762463b8348d347a64b9e0223f0cc564afa47bb9e75aa3f8ff4ad97a81d13ee60208aef347e
- SSDEEP 98304:pErxcQ2TBP9I5Sa7bH5ZbJI47IXOS41f07WdFjYw3tTptYVgi5zAKy63V5p:puylKSa7VZ1IF41f1bLSV5JF9
- TLSH
  T1C4362282F7EA2D2FCC3744365FAA46341666DE1AC683C747A894763C68372C44F4ABC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery execution impact persistence
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Queries information about active data network
  discovery
behavioral4