158b53d8da5ddcfda916b11cfedca2dd5456d417b5da98d6cdabb741a811dfa2

Sharing

Copy URL Twitter E-mail

General

Target
Disable_Dm-Verity_ForceEncrypt_10.28.2020.zip
Size 4.8MB
Sample261102-lvc3fsa12m
SHA256 158b53d8da5ddcfda916b11cfedca2dd5456d417b5da98d6cdabb741a811dfa2
MD5 225ed7885531e0d6748ac241d781f758
SHA1 a1d3402b102e37f25ba35c9b08fffcdf1a468c62
SHA512 590072149f8918bedd1c69d255764c17c44b64bd9b5e9026a36875690ba5b2fb17666609c8698fcf210a18a4d0b74a3507ef89c61a4c8f4c6b1e6242daae2061
SSDEEP 98304:f8+8uAM0g5Da6dFsmoY9d/dzr7DlZBDcyv2Xzh+hWxfB7PvHOZGepRGddHo7:U+vAM0wFsvYTFzr7BZBoyujh+ET/gpR7
TLSH
T1963633D761222287F717A7B086CC439A989DDD0F8A8FD744F5183E8501A36D2DE05AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  META-INF/com/google/android/update-binary
- Size 13KB
- SHA256 c06724e93ecf1df17bf7a6149cdc1c19208e20bee70fbe1125ebb926eecdee9d
- MD5 8b516d3e51b63bc71123225add5de3ce
- SHA1 c992d7f73cbebe1c8cff8f11696e2dd5fbbd29a4
- SHA512 a889f315c0f75d29d42c759a6f6615daf4f17f37612a2245d9482ce545332b916682258d8209a2800253873fb493c7e2d8a6a6b1274be05b4ef0a6ecbbd6c46e
- SSDEEP 192:yo2jkMaqsp0Dv6FwFiQWwOXOh1iEEUgZQmxYRICxkHpoowbqM8Y55M3Mu08b+e5p:BMaHSWwL9g6r7JCxD
- TLSH
  T168527229F6F68770314640A8BF076C436E5A105B16F0F880FDCFA3A57F99654B1B1AB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  anykernel.sh
- Size 5KB
- SHA256 77742d5a84545a52ecb040f0d672450c7aa702585b4ff7d56c7d7e399d3ba036
- MD5 81d6ba71363400db9d853e3fa33ef263
- SHA1 05caa72ad4ff982a3a46775434e36f86dcedf8af
- SHA512 f15694230adccf245ff744d9c21af2c68c946ef93aa298d868d7d09f0ee67bc09742c25a973dd2d13492bcb91ac76b08b546dba429f30d3350e97505ff187a8f
- SSDEEP 96:FjDAFWqC49th3G0OorSuwFtmdPC1jzoBgoFHf0MzQT2x3zqXaXtj+xQvYRhRoG:FvqC49thW0OSSuwFtmdPC1XoCoJfgT2o
- TLSH
  T15DC1C913B4006A7B32641821CC132D112967F2DBEBD87DC5715FF2E4AF18AE49276B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  tools/ak3-core.sh
- Size 23KB
- SHA256 5f4f87b684872be30057efb7d78a8f1e6f19d7539950a5a856d83fe1d2f70e8d
- MD5 18e3cd547bd42bef48a45da2ec8b6243
- SHA1 6d00ba2050534400b43bfb5a827388258240585f
- SHA512 1ca6c0974b93fae62eb6f1e90dab7e34578e5754776a76c0b3bf858d6e4c17beebafafa747bc8384caa74a287d7c611df2af318a938dfbcb62cc286e1be61b29
- SSDEEP 384:1rRvDORmy5AyfNRhh66Je8zDeEJoXEp6CfMDAvXVM2w1xBxl/xeT/iuPJxzMdiiO:rvDrySKdDeEJoXOVUDAvXVM2YxBxl5xc
- TLSH
  T16AB2D84ABAB396B935B550AC8F9378005D0E80075DD4ECF5F55CB1C83F68AA8A0727BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  tools/arm/busybox
- Size 1.4MB
- SHA256 1e5906eca348db415acdec807a6762d2263387d125681932cff1c083274b50e1
- MD5 399cb275516a2c50433b6af23444c15a
- SHA1 fd72de06c382e500def905442f8ac5b4d04162d1
- SHA512 d0ccfa9a6bb160191af589d5c338607ea7687cea9bba5477ae8f43d5bddec0cfa7e1b0b5b8cb8bd43674c757433684845adff96a229c1791b4486a52f7142e60
- SSDEEP 24576:t9jYIRULWqCNwnJhEO7AGrK3axkxFRDi:tOI1NiJhEO63axkxfe
- TLSH
  T12F65D0C5F2471928C9C9813EFA6138D45A1CD84F76925ACDB7DC403B378B9328A4B7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  tools/arm/futility
- Size 464KB
- SHA256 283e6b45989f89541270619a483e552540ee4a6660070894786ffff4ad2e98fe
- MD5 3e61249ef82467a427011b3ef0d2870c
- SHA1 0e682a243f4c64934a74d40f9757487571d62286
- SHA512 a887fbe4dc8c48946487015009b6048c8cabb556a5f761fd750d102075f5b384b050a45b87f5cf46def317eb75d047b3a69a5b2ba3e289a8a8f0b1b9d536bd36
- SSDEEP 12288:LG1H+nIyESJpoCPw+a2nfddhtldcp1xD:LOy7pXP5jldh2fp
- TLSH
  T1E6A4BE1AB8807F93D98358797056816433769E7C8368B342B14CFA383BBF6E74F5A584
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  tools/arm/keycheck
- Size 133KB
- SHA256 21ccedcce2715743c23e4a5e12a2fbae5f72ce7dabb1711f71db7e6f4dd477c1
- MD5 c48fb7ae93b2d14744f465ffa15d95d3
- SHA1 f13f65d4caf7c80dbb7fd4db5d185ea2372b2a85
- SHA512 7fa2dce4480ca6cece6ccce0850d19d744434a1e04f8704dde290ee00082ef001ec2ddaae88b9750ee59d220a903309a78c5db05729f32fa679c5a467996fff8
- SSDEEP 3072:3+WfiJbTyOPM8Yv6rlXSWb76q/03Vt9kW8kfFd1R:3bfiJb+yM8Yyrl3b76q/03b9kW8kfFd
- TLSH
  T1A0D3C096F540E627C8878A7AB93087C63B329E6CF7C4725C72143A7E7B546718CBC960
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery keylogger
- Reads hardware input events
  Reads raw input events from the evdev driver, possibly to record keystrokes.
  keylogger discovery
behavioral11
- Target
  tools/arm/magiskboot
- Size 287KB
- SHA256 696deb8d7517d11dc73f3a827d6b6178f9c87dbfde416a74cd01534931e5736d
- MD5 d5296084f08488ffba94b15305466acb
- SHA1 eba1d49793eee816d613aa2157ef1afd9dbdb7bd
- SHA512 7dc6336be391a67d20a953e2b256b8c59c8a274aaaa172dbd6af4f6f425cc7e7d361947b995868ddced62363ba2cbf78076677dd40ed5f237393295726f193d2
- SSDEEP 6144:hFky5wRHJd6MBQ1KRw2Z6pdSNVz/x39yGpRPUuFYOIPSTB:hCHn6Gw2wQ6pIb6uFtIPST
- TLSH
  T1BD54CF96E100F993F7928C39F9A40B6226ED1D2BA3F01146668C279C7A9F7B45F503C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  tools/arm/magiskpolicy
- Size 237KB
- SHA256 3a0639abf567b824609d35bfb9aabdf533ff6636417dc0c4f94b62b70b4fc28d
- MD5 67602e4714a3b2ceaf3eb850660b8d97
- SHA1 11e0087583e5714d97140391a06ccb8c2658291c
- SHA512 48d60773bc7a0c5bbd03d98273029946a170e3893d0b776a27fafdac8b966bf3193625532bc9f4298debe918312aececa88a526c76bcb7643f285d8181c7fb6e
- SSDEEP 6144:7mmEwD1KEBDOVve/E79OyTgKXJnLBNZDZ:XK6DOVWcKarZ
- TLSH
  T16334C0A6F5446C17CD97417BF7E045400A2CDC1EB3A5934932A85EBA3ADE8F05B6BBC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  tools/boot_signer-dexed.jar
- Size 1.6MB
- SHA256 6f9b39ea30462d47ed82f21cc6cb8a821d4c2780ca4eccea197f814cd3fb5e51
- MD5 7f9e3b188a9aa557ee28ec71ca0d47b2
- SHA1 66f49325fa1f5f568b5064e996f435622db97a4e
- SHA512 c02633ce5fc2b4de2c4d4c88a98dcb96e36858dc9d3328156b35cc4b0b00b107b2a2a08088760b1a2ec034ebcc01dceb79c4d9c6d158d5a9f12854fc1ddef904
- SSDEEP 24576:4ooZwSO8WjFY7HUyruWGaFc/Hxs92Q8pd9M7XDiHy/+lzJrmFB5vr0uSa:49wSO8WjeuWRFc/Hm8z8GWczJrDa
- TLSH
  T17185CF16ED92801EE183C0371DC2DAD7FD3892AD9286EA2F01D1169AA4D5F9F4743BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  tools/util_functions.sh
- Size 4KB
- SHA256 5b9fd6bba3721066aebbe1e1157a6e3b6dfa2daeb0194bfc3e8bc515426aed21
- MD5 4f91c699a9e150572aaad4e40952095c
- SHA1 441f5a0e7d28a3d3d5f68325c963c757ce48289a
- SHA512 3dbdc3ffd8d946b98dee5c372c3ed8dd8d8e02252f1848e680081fc7d12a62ac3d6acc9e0f34c2a6dd8e1256ade58110f6f8429a724e9a62a48fc59b8c60b81c
- SSDEEP 96:0sln8xn6vMKJRdnbsu/frqkf/AOroWgK0NKdqxIlcV6xBq+c14FKZEl:BOsvMKBsu/f1wOgxJ5Vs8nWFaq
- TLSH
  T18CA199D37890A9787F064CA9FD8290483207F1479EA737E0B89EB6383B3D524A475F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  tools/x86/busybox
- Size 2.0MB
- SHA256 4cc40a05725b331b78b8bcf1161fefb281dde530d675772ee4297edd408da373
- MD5 a39bea9fd3614001a27f8ea79004b625
- SHA1 ecb2d83611e7c03bedb5ede5554bd99d2f756f7c
- SHA512 43f57c16cc67d95341413ec5df8ac1f27996687cd9e3e4016206b7db16232c2bbad4038ebcf7e6fb4568e4888de9285d85568edb0a6fa7f470eb623ddebff18e
- SSDEEP 49152:bk2Z2M5HD3KmOlS4XwbUvp8c3xkxgYHh:bk2f5HmmmS4Bptw
- TLSH
  T16DA56C86E94344F5CA2624B041DFF77BDB2E691A42339CCADF895D22BB233111A1F257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  tools/x86/futility
- Size 790KB
- SHA256 c3261573ec4cfb84e670b919cca81bb82806bbc71b0f5627cbfdb094f6883236
- MD5 29deff5737f73ec93971dac1fd4522d9
- SHA1 78df375c6f6e86477ab997ba8977121991240c33
- SHA512 a4ee76be2633fe1aeac508365e1a55c9a97a792745cf9cc7fbb426f64fd14873c057c052d141905dec8376b7af9b8271640085e3b3806dda990fac182929648c
- SSDEEP 24576:L4yUpnXbVx7DRA8coom90JH4hDqcvEVVWU6c:0FrGRJ9JH4hDqcvEVgU6
- TLSH
  T10905F444EE8B50F1FE679870924BF27F4A209E0A8015EEB6FF5CFD1AF6376022519215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  tools/x86/keycheck
- Size 281KB
- SHA256 581ff33f35b2f8bdf75eee3cba6d92484d6f070115e4335e838f749d6de3a9df
- MD5 a16d4cded54cedd5ff9e87addd9a6f12
- SHA1 76eb5fbb01a23ae289f3c15422494d1693ee0cbe
- SHA512 96fc84976df41de286875713b2a9093b340b24ce38621123f15bd45d647d08e699373bac9474907351e2a420b57b33275f02c9cc9683d64466fd0f7bcf648c2f
- SSDEEP 3072:g/clIJVvuN9PMRjrgazlTczNBbbek0JwvidqlUQBEK+4fO+jfKB3F2Qpiiv60xaZ:H+VvuN2Rg0TCvbbeRERSWmxTCu2
- TLSH
  T181544A48FACB84F1FA571431110FF77F8A7162065238EAB6DF892E96F973B062A0D145
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery keylogger
- Reads hardware input events
  Reads raw input events from the evdev driver, possibly to record keystrokes.
  keylogger discovery
behavioral20
- Target
  tools/x86/magiskboot
- Size 441KB
- SHA256 22c235dc61cf07736274f1495099756b5a8b342b2024c77f8c4df9e2455745fc
- MD5 a6f37b432fbee691495754d14688608c
- SHA1 00496cfbe7c9ede804e9347f5a22deb528e95aa0
- SHA512 003435d5eb5778c9c5864c9c6b9273b69b9fd0ba2baa7eae4e4fa19be12ac0b8b88a00da7d137cb30048a6f63a0b9d7d5535a917f300e50eb11899bff25cf739
- SSDEEP 12288:9TYNlk8HL8KKBMZcf6M7m3RNH9LG3KsGbh3vDWmf8lBtBJLTC4a:9TYTcf6M7m3R76a5h3rW2iTNTC4
- TLSH
  T1C8A46C85EA83D0F1D5734CB1C09FEB3BC6B115168112D9AAEF8C3F16AA2B711552E387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  tools/x86/magiskpolicy
- Size 407KB
- SHA256 d6b63f2f71738cf47bb49bb1c7e7f829ec99f78e88161ff6c3865b8f705420ed
- MD5 3360df9b1359bf5300c57060b029cf8e
- SHA1 4d28038da06c326e35924ca5f85f7b76afc0f505
- SHA512 adbf359532981ca974bd1ec3ffe2320b6b5eb559e363db1920c2987b2efce4f0631d5e748638060b8899a1938c32ba6b3d53d03e07cd7164075ed5e20164442f
- SSDEEP 6144:J5Qwz//oKa3FyKJ0CTI0WDD+mcvDXP7ok7ihTOiQBNZg:bQlyK60aLcvDXP8hT5D
- TLSH
  T1F3944B45EA4280F5C67268B151CFEB3BEA31A91B9123C9DAEF8D3C11BE17310572E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Input Capture

T1056

Keylogging

T1056.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Input Capture

T1056

Keylogging

T1056.001

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads hardware input events

Reads hardware input events

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22