General
- Target DarkVPN.apk
- Size 155KB
- Sample261107-s9554sfc83
- SHA256 5201fb1c63bc1388dc034ec782bf6edcac7485ce3cdea799cc3a3ec788e94661
- MD5 0120db222078ce0228bec2bba9ce364e
- SHA1 70eba40d77901217e2e4b5642b46524c6fe55e76
- SHA512 dc32cbdda059db7470947d2c2f665815ed3b62a05307b26e2d9cfa93a42744750858f0f34345b7c9cd10eb8d0b40d2ba4127bd0f87ed957fe472474b367799be
- SSDEEP 3072:s2mQwJYNL8/5bmWES3rn2tZ08g+hBqLQNxVbM/Sn0kq:gQwoG5bmWPiXrgCBqLQNxVESn0V
- TLSH T1A6F3126A9AAD630FC0734A366C6FC2A1C2199E18A300FF633215557D3BD1A462BCD7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
DarkVPN.apk
Resource
android-33-x64-arm64-20260708-fr
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
DarkVPN.apk
Resource
android-x64-20260325-fr
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
DarkVPN.apk
Resource
android-x64-arm64-20260325-fr
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
DarkVPN.apk
Resource
android-34-x64-arm64-20260325.1-fr
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
DarkVPN.apk
Resource
android-35-x64-arm64-20260325-fr
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
DarkVPN.apk
Resource
android-x86-arm-20260325-fr
0 signatures
900 seconds
Malware Config
Targets
-
- Target DarkVPN.apk
- Size 155KB
- SHA256 5201fb1c63bc1388dc034ec782bf6edcac7485ce3cdea799cc3a3ec788e94661
- MD5 0120db222078ce0228bec2bba9ce364e
- SHA1 70eba40d77901217e2e4b5642b46524c6fe55e76
- SHA512 dc32cbdda059db7470947d2c2f665815ed3b62a05307b26e2d9cfa93a42744750858f0f34345b7c9cd10eb8d0b40d2ba4127bd0f87ed957fe472474b367799be
- SSDEEP 3072:s2mQwJYNL8/5bmWES3rn2tZ08g+hBqLQNxVbM/Sn0kq:gQwoG5bmWPiXrgCBqLQNxVESn0V
- TLSH T1A6F3126A9AAD630FC0734A366C6FC2A1C2199E18A300FF633215557D3BD1A462BCD7DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Queries the phone number (MSISDN for GSM devices)
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Requests disabling of battery optimizations (often used to enable hiding in the background).
Tries to add a device administrator.