00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04

General

Target
coreprotector.org_sample.bin
Size 4.8MB
Sample261010-tmalcsxtdz
SHA256 00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04
MD5 38e866c38d6afc5b640f7fd8dc317b06
SHA1 14132a80177936638e4d55c3a11035e43df552fa
SHA512 1455433f21913b82aa396ffc3cd515af75d311e83b4d8ac32731f8ecd756c3f3625e9e65bebb57545e26535c1caeee0461c76fa09245e05d4e6943173f26518a
SSDEEP 98304:Wibg4QOVpQdMjwT5YQFdvjts8ftRrm55T:Wik4DV8XTLvg5T
TLSH
T12136AE46E7501D2AC8FE827A28B74B2023765D41D7839747210CB6686FB77E91F8DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  coreprotector.org_sample.bin
- Size 4.8MB
- SHA256 00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04
- MD5 38e866c38d6afc5b640f7fd8dc317b06
- SHA1 14132a80177936638e4d55c3a11035e43df552fa
- SHA512 1455433f21913b82aa396ffc3cd515af75d311e83b4d8ac32731f8ecd756c3f3625e9e65bebb57545e26535c1caeee0461c76fa09245e05d4e6943173f26518a
- SSDEEP 98304:Wibg4QOVpQdMjwT5YQFdvjts8ftRrm55T:Wik4DV8XTLvg5T
- TLSH
  T12136AE46E7501D2AC8FE827A28B74B2023765D41D7839747210CB6686FB77E91F8DBC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection credential_access defense_evasion discovery evasion impact persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Reads the content of the call log.
  collection
- Acquires the wake lock
- Makes a phone call.
  collection
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
behavioral1