hxxp://google[.]com

General

Target
http://google.com
Sample261027-p49dssdf22

Score

8^/10

android upx

Malware Config

Targets

- Target
  http://google.com
Score

8^/10

upx
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Declares services with permission to bind to the system
- Requests dangerous framework permissions
- Probable phishing domain
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

1

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Patched UPX-packed file

Contacts third-party web service commonly abused for C2

Declares services with permission to bind to the system

Requests dangerous framework permissions

Probable phishing domain

UPX packed file

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3