Overview

overview

10

Static

static

10

924e8a1c0d...20.apk

android-11-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420.apk
  • Size 6.8MB
  • Sample261015-yth9aswv5m
  • SHA256 924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
filecoderandroidcollectioncredential_accessimpactransomware

Malware Config

Extracted

Path

  • res/layout/activity_main.xml

  • filecoder

Ransom Note
  • Current State Information Your personal documents and files on this device have just been crypted.The origion files have been completely deleted and will only be recovered by following the steps described below. Document Decryption Operation Guide 1. To obtain the key which will decrypt files,you need to pay the amount of Bitcoin you see at the top of the screen. 2. After the payment is completed, open %s and enter the userid below, you will get the decryption key. 3. Paste the decryption key in the key inputbox below and click the decrypt button.Reboot the phone,all files will be successfully decrypted. Decrypt Key: paste your key here... Useful Information UserID: BTC addr: 16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy !!!Do not delete this APP,or your files will not be back forever!!!
Wallets

  • 16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy

Targets

    • Target
      924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420.apk
    • Size 6.8MB
    • SHA256 924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectioncredential_accessfilecoderimpactransomware

    • Family: Filecoder.C

      A ransomware family that spreads to other victims via SMS.

      ransomwarefilecoder

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Changes the wallpaper (common with ransomware activity)

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks