sha1:
- ef9bca86c788c1712b439a97edad1a5364c8ffad
Description
An Android data stealer disguised as a Remote Access Trojan builder for OS Android and Windows.
Operating routine
-
Requests the following permissions when launched:
android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.settings.MANAGE_APP_ALL_FILES_ACCESS_PERMISSION android.settings.MANAGE_ALL_FILES_ACCESS_PERMISSION - Accesses ipinfo[.]io for location information (IP address, network host name, city, region, country, coordinates, index, time zone).
- Sends system information, including error logs and images from the DCIM/Camera and Pictures/Screenshots directories, to Telegram bots whose identifiers are hardcoded in the body of the trojan.
