48e5f383ae311718ae22ea0b365930e5df04f56a6b452c11e359c8daa43375cc

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af
Size 7.1MB
Sample261012-3q8f8stsat
SHA256 48e5f383ae311718ae22ea0b365930e5df04f56a6b452c11e359c8daa43375cc
MD5 6e0fcb9737e46d737169cedb61f257af
SHA1 c60a60f747ff230ced5fe6e78c5f18b150fc4cc1
SHA512 e75d30ef6e8dd7c67af21d43f4e3604ea8df7989442784358a44ebaf756a67cc60872f72655208eb233ee4998b605a703a0da7ec01b256351fdc6a7b05780fb9
SSDEEP 196608:Ds9wKrvazH4+Fr6suK6y+310hWZ3ESdiQiqirZIuxLrPc7PFo2:Y9wKrO4EGs56y+310hPCiQoKuxSto2
TLSH
T19E762327D710E942D667407E722F1443B9F04E14229FFA6A7D29BD246FB7F500A086BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af
- Size 7.1MB
- SHA256 48e5f383ae311718ae22ea0b365930e5df04f56a6b452c11e359c8daa43375cc
- MD5 6e0fcb9737e46d737169cedb61f257af
- SHA1 c60a60f747ff230ced5fe6e78c5f18b150fc4cc1
- SHA512 e75d30ef6e8dd7c67af21d43f4e3604ea8df7989442784358a44ebaf756a67cc60872f72655208eb233ee4998b605a703a0da7ec01b256351fdc6a7b05780fb9
- SSDEEP 196608:Ds9wKrvazH4+Fr6suK6y+310hWZ3ESdiQiqirZIuxLrPc7PFo2:Y9wKrO4EGs56y+310hPCiQoKuxSto2
- TLSH
  T19E762327D710E942D667407E722F1443B9F04E14229FFA6A7D29BD246FB7F500A086BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker collection defense_evasion discovery evasion impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the content of SMS inbox messages.
  collection
- Reads the content of the SMS messages.
  collection
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery defense_evasion
- Attempts to obfuscate APK file format
  Applies obfuscation techniques to the APK format in order to hinder analysis
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral1
- Target
  com.skymobi.pay.plugin.main_v10014.pl
- Size 58KB
- SHA256 e44f6d6dc173a53f4d7e4bbcbc92bf991ffea14af1612ee29b81f56c33b6d5ef
- MD5 b0a39aaa44ac82ec0fd321914f6aa668
- SHA1 10a20428675480d68cbc64a5a4be12bde81aaca2
- SHA512 fde8a61b36e3a27acd98ce24b594b71690456c40f76785dac0a4809f66570d4196b60e1e47616cf9855faac18822fe6d953b59534a39506daa15c7a285d70999
- SSDEEP 1536:3a3tkLIW2T8X1S2TN6DH3twagFsydRWd69RJwC27nLt:qmkW1lSiNsaapSRWd61wd7Lt
- TLSH
  T1234302B33FF6AE50DF5BE9BC72D9A8CE151191C0CC30C197145095E61AE2E9122B1F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  com.skymobi.pay.plugin.recordupload_v10009.pl
- Size 38KB
- SHA256 8199c84eb1412ac9f13edc3bff4cd66e788847143bd0c8497ce7f699a0d68e77
- MD5 55c24dc00f667f62ee0cc0dfca41fc28
- SHA1 1811dd0ba5f5bdfeef743332b7ef1b8e4097a23c
- SHA512 b5a5269065f4bcf05c560315255c49dc7eafc015458eca425f6b44eec0ee74c3e1d481e06df70deca25056a8fd070efb5adcf364061a8e5c1e26fb8e102caf69
- SSDEEP 768:Tf5Ui0Wh/Ndv7j7LF12NADhHl2ASeCYuD:+WNNdDJ0NahHMAS3D
- TLSH
  T18003F104DDED7C41F202A6F81171883BB110E9A6E2F997BB4825ACB4DFDAC089746DD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  com.skymobi.pay.plugin.smspay_v10028.pl
- Size 230KB
- SHA256 d705772a36c81fa49accfc9fa55b638ad4502016de00e5790872cb0d26bf8714
- MD5 296a1134a4225941e7e3867f9c03caff
- SHA1 4c798eca899af98670aef8937c0a5160a3e235b1
- SHA512 db9c5bd51748d107df49c3693129069cd0e3183141a74624d199bc78dea7830f7c8a737c18e35804e454b13e4c31b97e845466956893ba013415c255a3812524
- SSDEEP 6144:l95dFl8F+z1d7PXl/vsx+hAhoTx5+310h1:pTHvf2++oV5+310h1
- TLSH
  T128341244DFEC535CDAC6B13308B4F886534E3EF54386AF269B43A16F14E88768158F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral8 behavioral9
- Target
  skymobi_pay_wxplugin.apk
- Size 33KB
- SHA256 6d6f22a6688689b35a723620794bc03e958a69e1770073bd921d3c6129733f26
- MD5 73d8a99bf9de4eb876f1739627197190
- SHA1 135f99fe90f129274c74f5c9b032294bfae3d05a
- SHA512 d5d9068f5fbf3c85bafb8edf084c40e4411814f02542cde120815951c6a2cfae78a0b08f930ef7143f10145ce0abcbd942c44f54afbb0d963ba47c653a162049
- SSDEEP 768:iwFX6Lei59coj/94ML6plol/S54bLhWQeJ:iwF0t5jj1/LMcaivhWQC
- TLSH
  T16DF2E1D4CBDCB68EECF5D8BD565B5567A679BC2D5162CBE30401B04C4CBDC88A90228D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

persistence
behavioral11 behavioral12 behavioral13
- Target
  tongyu-pay-lib.apk
- Size 68KB
- SHA256 b696af25b3382db45dfb37e3cbddbdc084114e08b9a24322572e582e077b230b
- MD5 d889a2dc05a8d31bec541b19e55a15e1
- SHA1 9af90881a26a3512c2993406aebc1e691d826bfe
- SHA512 8ce2d857f54abd849a560cf596d90a2ac3ef63273478752c3dc3a619be747da58aebb92332d1aac08a7bdd3baffb20f71c3a3022a6358a82d75c410eff97e067
- SSDEEP 1536:WSbgLKxe7wu7t6XQyLaFRBb8HaSyVkdNwaDomQFwZ:WbKx0MXQysbcpNw6obiZ
- TLSH
  T1AF63027FA7CDE985F1E69DB4EBEE10578C56C05CC133EAAF1A1E487856840085AF2F12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15 behavioral16