pixrevolution | a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42

General

Target
a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42.apk
Size 1.8MB
Sample261106-b6fbvasx9m
SHA256 a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42
MD5 de6ac97a12722368a7b944682aa01525
SHA1 ba166c29e606339abe5accc97310eb66a21d8b90
SHA512 3dd5b67ebf3d1f569cc1d93285af45b21afcabc2a0f0b8ce95014290ff3ed7d3a892382ace3285a5dca5c1af14ec73b6e2fb5d7623a03f567adef86a169fd8cf
SSDEEP 49152:fHjfyQEvcI+IMydEaOqVtrr32vDHM0d1PXqjgI7ov6:fDaQPvXyd7trqd16ED6
TLSH
T16895AD85BBE99E2ECC7340364F4A5635150AAE27C343C343D968361C78BB6F44E897E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42.apk
- Size 1.8MB
- SHA256 a812cba48749a1bd14931d235f75f54f52710463eb4cecb1b4ded8d82be93a42
- MD5 de6ac97a12722368a7b944682aa01525
- SHA1 ba166c29e606339abe5accc97310eb66a21d8b90
- SHA512 3dd5b67ebf3d1f569cc1d93285af45b21afcabc2a0f0b8ce95014290ff3ed7d3a892382ace3285a5dca5c1af14ec73b6e2fb5d7623a03f567adef86a169fd8cf
- SSDEEP 49152:fHjfyQEvcI+IMydEaOqVtrr32vDHM0d1PXqjgI7ov6:fDaQPvXyd7trqd16ED6
- TLSH
  T16895AD85BBE99E2ECC7340364F4A5635150AAE27C343C343D968361C78BB6F44E897E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery impact
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
behavioral1
- Target
  update.apk
- Size 866KB
- SHA256 3a59035ce30ac0f26bf49d3a0175e530812968614d3870099742258fb336ce6b
- MD5 de57ce657171a839c3f47dd4c3d8c322
- SHA1 96778b7990e3087bf1c26bdf36ca9a64c4a24100
- SHA512 5c0cd2719a25f1c261adefff5c58e293282512156896bcb312baf6e3b4ea173e4929b7d7827742abcbbd61dd14140be2806725c786ca6b90fa2662d53090e59c
- SSDEEP 24576:QIKERcAUIzzvDHMU4zgdFERp+2/yahgm6+7w:YERcAUIPvDHMkdFkO4gJYw
- TLSH
  T19015BE82F7E55E2ECD7744360F9A833112129E03CD56DB07A8A8772C683B6D94F4ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery impact persistence
- Checks if the Android device is rooted.
  defense_evasion
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  defense_evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  defense_evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral2