General
- Target e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
- Size 28.3MB
- Sample261020-snretsbt4x
- SHA256 82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab
- MD5 b8078650b7870d035e85109d70cc5afc
- SHA1 2ee25a6c2ebe0651849ea2acb0e6bae4a6e557e2
- SHA512 63e5055652b90bef7c6f4a2f277b8fa6a13c33decccf03deb4dfb2a91fcd44a11659ed12e03d7b9708e7ae2e872a34956042f2199d93e294ba6df18548561b25
- SSDEEP 786432:EPSvhHQ4gZttU6ESjaykB8S+4OMzmMv2eK6mGazqhhKxEyU:EPS4tu6ES+yO8S+fMzmMvHkqhp
- TLSH T13A5723A7F36DA91FC8739032CA6A2273949D4F118A42E7572504B35D68F3AD08F69FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral2
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-33-x64-arm64-20260708-en
Behavioral task
behavioral4
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-34-x64-arm64-20260325.1-en
Behavioral task
behavioral5
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Resource
android-x86-arm-20260325-en
Malware Config
Targets
-
- Target e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
- Size 28.3MB
- SHA256 82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab
- MD5 b8078650b7870d035e85109d70cc5afc
- SHA1 2ee25a6c2ebe0651849ea2acb0e6bae4a6e557e2
- SHA512 63e5055652b90bef7c6f4a2f277b8fa6a13c33decccf03deb4dfb2a91fcd44a11659ed12e03d7b9708e7ae2e872a34956042f2199d93e294ba6df18548561b25
- SSDEEP 786432:EPSvhHQ4gZttU6ESjaykB8S+4OMzmMv2eK6mGazqhhKxEyU:EPS4tu6ES+yO8S+fMzmMvHkqhp
- TLSH T13A5723A7F36DA91FC8739032CA6A2273949D4F118A42E7572504B35D68F3AD08F69FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Checks Android system properties for emulator presence.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Queries information about active data network