c3a5895b6d38af17da610c1e66d20888dc10b5c94bebf30d5c7acefa3c92ad85

General

Target
Button VPN(1).apk
Size 417KB
Sample261022-w4g3wabc39
SHA256 c3a5895b6d38af17da610c1e66d20888dc10b5c94bebf30d5c7acefa3c92ad85
MD5 7833329e41945463ee5f21b9fea4e985
SHA1 07260cb4728f80c6dfd792b14f52760b1be47d6b
SHA512 2a651ca34abeeb6a35bed81258454e91930966635541a656ec348c85fb4c6a6abd0eec3a3186ecd7da3fd049462575a83de1d3bd8cb7fe8c076ee74c229f9b91
SSDEEP 6144:/i5wjnH/ucjWgkrNlWp14mKRrKsLiAvoH7G/FoxCvXeUYcCsTMMHDdz0F7Hn:OQnweOmyrvGdH+iAvrosTNJwF7H
TLSH
T1DA94125AB7DCE757E263C130184A8252540F3EB8CD45F3AB76303BADA4B3F640B556A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Button VPN(1).apk
- Size 417KB
- SHA256 c3a5895b6d38af17da610c1e66d20888dc10b5c94bebf30d5c7acefa3c92ad85
- MD5 7833329e41945463ee5f21b9fea4e985
- SHA1 07260cb4728f80c6dfd792b14f52760b1be47d6b
- SHA512 2a651ca34abeeb6a35bed81258454e91930966635541a656ec348c85fb4c6a6abd0eec3a3186ecd7da3fd049462575a83de1d3bd8cb7fe8c076ee74c229f9b91
- SSDEEP 6144:/i5wjnH/ucjWgkrNlWp14mKRrKsLiAvoH7G/FoxCvXeUYcCsTMMHDdz0F7Hn:OQnweOmyrvGdH+iAvrosTNJwF7H
- TLSH
  T1DA94125AB7DCE757E263C130184A8252540F3EB8CD45F3AB76303BADA4B3F640B556A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1