Loading malware…
7 distinct techniques documented for this family, organized by ATT&CK tactic.
This is likely to be yet another bad zip technique to evade detection.
We immediately see it is fetching a DEX from the assets/moqls directory... The method which processes the asset file... does some ugly decryption on the file.
the malware will crash if run on a phone with Russian or Ukrainian language.
The classes of the delegate applications are loaded using loadClass(delegateApplicationName).newInstance, and finally the code uses reflection to call application.attach(context0).
the malware will crash if run on a phone with Russian or Ukrainian language.
Answer : the active C&C is returned by a malicious GitHub user account ... The json page actually contains a Base64-encoded JSON object with the C&C’s URL
The real C&C is retrieved from the init procedure ... The code retrieves the “domains” parameter of the JSON ... Finally, the code sets the URL in the shared preferences.
The json page actually contains a Base64-encoded JSON object with the C&C’s URL
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.