23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.AndroidOS Sample 47454e212503… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample 47454e212503…. Malware family: Trojan.AndroidOS. Threat score 81/100. 1/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115","keywords":["Malicious","Trojan.AndroidOS","malware analysis","sandbox report","threat intelligence","47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115"],"about":{"@type":"SoftwareApplication","name":"co.fronto.apk","applicationCategory":["android"],"identifier":"47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"Trojan.AndroidOS","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T637,Found invoke in ".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.aei.smali.aei.smali" to "android.net.NetworkInfo.isConnected" Found invoke in ".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.aei.smali.aei.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in ".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.ajr.smali.ajr.smali" to "android.net.NetworkInfo.isConnectedOrConnecting" Found invoke in ".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.ajr.smali.ajr.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in ".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.alh.smali.alh.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo"25:T65b,"AndroidManifest.xml" has type "Android binary XML" "CERT.RSA" has type "data" "CERT.SF" has type "ASCII text with CRLF line terminators" "Jsr305_annotations.gwt.xml" has type "exported SGML document ASCII text" "MANIFEST.MF" has type "ASCII text with CRLF line terminators" "build-data.properties" has type "ASCII text" "closebutton.html" has type "HTML document ASCII text" "com.amazonaws.aws-android-sdk-core.properties" has type "ASCII text" "com.crashlytics.sdk.android.answers.properties" has type "ASCII text" "com.crashlytics.sdk.android.beta.properties" has type "ASCII text" "com.crashlytics.sdk.android.crashlytics-core.properties" has type "ASCII text" "com.crashlytics.sdk.android.crashlytics.properties" has type "ASCII text" "io.fabric.sdk.android.fabric.properties" has type "ASCII text" "io.grpc.ManagedChannelProvider" has type "ASCII text" "io.grpc.NameResolverProvider" has type "ASCII text" "javax.script.ScriptEngineFactory" has type "ASCII text" "libadcolony.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked interpreter /system/bin/linker stripped" "libadcolony.so_1606546892821" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked stripped" "libfb.so" has type "ELF 32-bit LSB shared object ARM EABI5 version 1 (SYSV) dynamically linked interpreter /system/bin/linker BuildID[sha1]=bcd43216726e286a2c396628eee76bbc560f44f0 stripped" "libfb.so_1606546892821" has type "ELF 32-bit LSB shared object Intel 80386 version 1 (SYSV) dynamically linked BuildID[sha1]=ffbe698dc61aa6724e261862e82384ced21907ba stripped"26:T135f,Heuristic match: "SX\KIz0+_.Om" Pattern match: "B9.ay/qzHw" Heuristic match: "UM 1@x[.Lu" Heuristic match: "lib/x86/libadcolony.so" Heuristic match: "lib/x86/libfb.so" Heuristic match: "lib/x86/libfolly_json.so" Heuristic match: "lib/x86/libglog.so" Heuristic match: "lib/x86/libglog_init.so" Heuristic match: "lib/x86/libicu_common.so" Heuristic match: "lib/x86/libimagepipeline.so" Heuristic match: "lib/x86/libjs.so" Heuristic match: "lib/x86/libjsc.so" Heuristic match: "lib/x86/libmappsolid.so" Heuristic match: "lib/x86/libreactnativejni.so" Heuristic match: "lib/x86/libreactnativejnifb.so" Heuristic match: "y~yy#G.AU" Heuristic match: "lib/x86/libyoga.so" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://ns.adobe.com/xap/1.0/" Heuristic match: "\u05d0\u05e9\u05e8 \u05d7\u05d9\u05d5\u05d1\u05d9\u05dd \u05e2\u05d1\u05d5\u05e8 \u05e7\u05e0\u05d9\u05d5\u05ea \u05e2\u05ea\u05d9\u05d3\u05d9\u05d5\u05ea \u05d0\u05e6\u05dc \u200e%2$s \u05d1\u05d0\u05de\u05e6\u05e2\u05d5\u05ea PayPal\u200f. \u05d4\u05d5\u05e8\u05d9\u05ea \u05dc-PayPal \u05dc\u05e9\u05dc\u05dd \u05d0\u05ea \u05db\u05dc \u05d4\u05e1\u05db\u05d5\u05de\u05d9\u05dd \u05e9-\u200e%3$s \u05de\u05d1\u05e7\u05e9.

\u05dc\u05e4\u05e8\u05d8\u05d9\u05dd \u05e0\u05d5\u05e1\u05e4\u05d9\u05dd, \u05e2\u05d9\u05d9\u05df \u05d1\u05d4\u05e1\u05db\u05dd \u05d4\u05d5\u05e8\u05d0\u05d5\u05ea \u05d4\u05e7\u05d1\u05e2 \u05d5\u05d4\u05d7\u05d9\u05d5\u05d1 \u05e9\u05dc PayPal\u200f.

" (Indicator: "cmd=") "https://www.paypal.com/%s/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside" (Indicator: "cmd=") "

\ud5a5\ud6c4 %2$s \uad6c\ub9e4\uc5d0 \ub300\ud574 PayPal\ub85c \uacb0\uc81c\ud558\ub294 \uac83\uc5d0 \ub300\ud55c \uccad\uad6c \uc778\uc99d. %3$s\uc5d0\uc11c \uc694\uccad\ud55c \uae08\uc561\uc744 \ubaa8\ub450 PayPal\ub85c \uacb0\uc81c\ud558\ub3c4\ub85d \uc124\uc815\ud569\ub2c8\ub2e4.

\uc790\uc138\ud55c \ub0b4\uc6a9\uc740 PayPal Recurring Payments and Billing Agreement\ub97c \ucc38\uc870\ud558\uc138\uc694.

" (Indicator: "cmd=") "

Autorizza l\u2019addebito dei prossimi acquisti effettuati su %2$s e pagati con PayPal. Autorizzi PayPal a pagare tutti gli importi richiesti da %3$s.

Vedi Pagamenti automatici e Contratto di addebito automatico PayPal per maggiori informazioni.

" (Indicator: "cmd=") "

Autorizar d\u00e9bitos para compras futuras feitas em %2$s pagas com PayPal. Est\u00e1 a dar ao PayPal instru\u00e7\u00f5es para pagar todos os montantes solicitados por %3$s.

Para mais informa\u00e7\u00f5es, consulte o Contrato de Pagamentos Peri\u00f3dicos e Fatura\u00e7\u00e3o do PayPal.

" (Indicator: "cmd=") "

Autorice cargos correspondientes a futuras compras en %2$s pagadas con PayPal. Indique a PayPal que pague todos los importes solicitados por %3$s.

Consulte los Pagos recurrentes de PayPal y el Acuerdo de pagos para obtener m\u00e1s informaci\u00f3n.

" (Indicator: "cmd=") "

Autorizar cobran\u00e7as para compras futuras com PayPal no parceiro %2$s. Voc\u00ea autoriza o PayPal a pagar todos os valores solicitados por %3$s.

Consulte o Contrato de Cobran\u00e7a e Pagamentos Recorrentes do PayPal para mais informa\u00e7\u00f5es.

" (Indicator: "cmd=") "https://www.paypal.com/%s/cgi-bin/webscr?cmd=_account-recovery&from=%s&locale.x=%s" (Indicator: "cmd=") "

\u6388\u6b0a\u4ee5 PayPal \u652f\u4ed8\u6240\u6709\u672a\u4f86\u5728 %2$s \u7684\u8cfc\u7269\u6b3e\u9805\u3002\u4f60\u6307\u793a PayPal \u652f\u4ed8\u6240\u6709\u7531 %3$s \u767c\u51fa\u7684\u4ed8\u6b3e\u8981\u6c42\u3002

\u8acb\u53c3\u95b1\u300cPayPal \u5b9a\u6642\u5b9a\u984d\u4ed8\u6b3e\u8207\u7d50\u5e33\u540c\u610f\u66f8\u300d\u4ee5\u7372\u5f97\u66f4\u591a\u8cc7\u6599\u3002

" (Indicator: "cmd=") "https://cms.paypal.com/jp/cgi-bin/marketingweb?cmd=_render-content&content_ID=ua/Legal_Hub_full&locale.x=ja_JP" (Indicator: "cmd=") "https://cms.paypal.com/jp/cgi-bin/marketingweb?cmd=_render-content&content_ID=ua/Legal_Hub_full&locale.x=en_US" (Indicator: "cmd=") "

Autoriser les d\u00e9bits pour les futurs achats chez %2$s pay\u00e9s avec PayPal. Vous donnez pour instruction \u00e0 PayPal de payer tous les montants demand\u00e9s par %3$s.

Consultez l\u2019article Paiements r\u00e9currents et autorisation de facturation PayPal pour en savoir plus.

" (Indicator: "cmd=") "

Godk\u00e4nna avgifter f\u00f6r framtida k\u00f6p hos %2$s som betalas med PayPal. Du ger PayPal i uppdrag att betala alla belopp som beg\u00e4rs av %3$s.

Mer information finns i PayPals avtal om \u00e5terkommande betalningar och fakturering.

" (Indicator: "cmd=") "

Sie autorisieren Abbuchungen f\u00fcr zuk\u00fcnftige PayPal-Zahlungen bei %2$s. Sie weisen PayPal an, die von %3$s geforderten Betr\u00e4ge zu zahlen.

Weitere Informationen finden Sie im PayPal-Vertrag \u00fcber Abonnementzahlungen.

" (Indicator: "cmd=") "

Authorise charges for future %2$s purchases paid for with PayPal. You instruct PayPal to pay all amounts requested by %3$s.

Please see the PayPal Recurring Payments and Billing Agreement for more information.

" (Indicator: "cmd=") "

\u0130leride PayPal ile \u00f6demesi yap\u0131lacak %2$s al\u0131\u015fveri\u015fler i\u00e7in \u00e7ekim talimat\u0131 verin. %3$s taraf\u0131ndan talep edilen t\u00fcm tutarlar\u0131n \u00f6denmesi i\u00e7in PayPal\u2019a talimat verirsiniz.

L\u00fctfen daha fazla bilgi i\u00e7in bkz. PayPal D\u00fczenli \u00d6demeler ve Fatura S\u00f6zle\u015fmesi.

" (Indicator: "cmd=")1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":81,"unified_at_epoch_ms":1791312102652,"unified_at":"2026-10-06T18:41:42.652Z","metadata":{"hashes":{"sha256":"47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115","sha1":"95befbfbd54c466e7ce96f832a617a8b0c6bb2a9","md5":"f2985f330f606ae4b375e0533e63d18e","sha512":"6847b12ec6fe90525f026984269b0de2436a0855354920d557f2774bfb513be6d59337f40808db7ff8472a8e4638094ac9cdd225d647acc03bd2f476c745b847","ssdeep":"786432:Wvbh1dgI98TN2BSjy7aVbeUbFhhaaOke8e:WT8TwBSjEaVbeUx8ke8e","ssdeep_chunks":["786432:Wvbh1dg","786432:vbh1dgI","786432:bh1dgI9","786432:h1dgI98","786432:1dgI98T","786432:dgI98TN","786432:gI98TN2","786432:I98TN2B","786432:98TN2BS","786432:8TN2BSj","786432:TN2BSjy","786432:N2BSjy7","786432:2BSjy7a","786432:BSjy7aV","786432:Sjy7aVb","786432:jy7aVbe","786432:y7aVbeU","786432:7aVbeUb","786432:aVbeUbF","786432:VbeUbFh","786432:beUbFhh","786432:eUbFhha","786432:UbFhhaa","786432:bFhhaaO","786432:FhhaaOk","786432:hhaaOke","786432:haaOke8","786432:aaOke8e","1572864:Wvbh1dg","1572864:vbh1dgI","1572864:bh1dgI9","1572864:h1dgI98","1572864:1dgI98T","1572864:dgI98TN","1572864:gI98TN2","1572864:I98TN2B","1572864:98TN2BS","1572864:8TN2BSj","1572864:TN2BSjy","1572864:N2BSjy7","1572864:2BSjy7a","1572864:BSjy7aV","1572864:Sjy7aVb","1572864:jy7aVbe","1572864:y7aVbeU","1572864:7aVbeUb","1572864:aVbeUbF","1572864:VbeUbFh","1572864:beUbFhh","1572864:eUbFhha","1572864:UbFhhaa","1572864:bFhhaaO","1572864:FhhaaOk","1572864:hhaaOke","1572864:haaOke8","1572864:aaOke8e","786432:WT8TwBS","786432:T8TwBSj","786432:8TwBSjE","786432:TwBSjEa","786432:wBSjEaV","786432:BSjEaVb","786432:SjEaVbe","786432:jEaVbeU","786432:EaVbeUx","786432:aVbeUx8","786432:VbeUx8k","786432:beUx8ke","786432:eUx8ke8","786432:Ux8ke8e"],"imphash":"Unknown"},"file_info":{"file_name":"co.fronto.apk","file_type":["android"],"file_type_id":"apk","file_size":26179253,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1500260273000,"last_seen":1650535971000,"last_multi_scan":1650535971000}},"detections":{"summary":{"verdict":"malicious","score":81,"tags":["aauto","andromeda","bancos","clicker","flystudio","gamarue","gamehack","infostealer","iop","lockscreen","mofksys","neshta","ntstats","securityxploded","syncopate","temjepeg","trojan"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":6,"suspicious_count":8,"malicious_count":3,"total":17},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.AndroidOS.Hiddenapp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.AndroidOS","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"App Auto-Start at Device Boot","attack_id":"T1402","attack_id_wiki":"https://attack.mitre.org/techniques/T1402","identifiers":[{"type":"malicious","value":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"Requires permissions only available to signed APKs"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1421","attack_id_wiki":"https://attack.mitre.org/techniques/T1421","identifiers":[{"type":"informative","value":"Tests the internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Discovery","technique":"Device Type Discovery","attack_id":"T1419","attack_id_wiki":"https://attack.mitre.org/techniques/T1419","identifiers":[{"type":"malicious","value":"Has the ability to read the device ID (e.g. IMEI or ESN)"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1420","attack_id_wiki":"https://attack.mitre.org/techniques/T1420","identifiers":[{"type":"suspicious","value":"Has the ability to access external storage"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Collection","technique":"Location Tracking","attack_id":"T1430","attack_id_wiki":"https://attack.mitre.org/techniques/T1430","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"tactic":"Effects","technique":"Premium SMS Toll Fraud","attack_id":"T1448","attack_id_wiki":"https://attack.mitre.org/techniques/T1448","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Requires permissions only available to signed APKs","description":"Found permission request for \"android.permission.PACKAGE_USAGE_STATS\"","origin":"Static Parser","mitre_attack_id":"T1116","relevance":7,"id":"static-29","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"informative","category":"General","name":"Tests the internet connectivity","description":"$24","origin":"Static Parser","mitre_attack_id":"T1421","relevance":3,"id":"static-41","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$27","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"org/joda/time/tz/data/America/Kentucky/Monticello%\" (Indicator: \"ntice\")\n \"Name: org/joda/time/tz/data/America/Kentucky/Monticello\" (Indicator: \"ntice\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"help@fronto.co\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"$28","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to access external storage","description":"Found invoke in \".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.agi$b.smali.agi$b.smali\" to \"android.os.Environment.getExternalStorageState\"\n Found invoke in \".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.agi$b.smali.agi$b.smali\" to \"android.os.Environment.getExternalStorageDirectory\"","origin":"Static Parser","mitre_attack_id":"T1420","relevance":3,"id":"static-45","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Network Related","name":"Has the ability to open an internet connection","description":"Found invoke in \".home.payloadsecurity.VxStream.VxAnalysisResults.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115#200#5fc1f59111e0ff5b130b7d69.47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115.apk.decoded.smali.akz.smali.akz.smali\" to \"java.net.URL.openConnection\"","origin":"Static Parser","relevance":3,"id":"static-46","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"SHA1-Digest: 53V91l0+w45mLJINCvncJsMVMYw=\" (Indicator for product: Generic VNC)\n \"SHA1-Digest: KcAKbOCiTO5UMcKfzx/+vncLmXg=\" (Indicator for product: Generic VNC)","origin":"File/Memory","mitre_attack_id":"T1076","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/63 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"malicious","category":"General","name":"Has the ability to read the device ID (e.g. IMEI or ESN)","description":"Found invoke in \"co.fronto.react.modules.FrontoNativeModule.smali\" to \"android.telephony.TelephonyManager.getLine1Number\"\n Found invoke in \"co.fronto.ui.activity.OrderActivity.smali\" to \"android.telephony.TelephonyManager.getLine1Number\"","origin":"Static Parser","mitre_attack_id":"T1419","relevance":3,"id":"static-42","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Has the ability to execute code after reboot","description":"Permission request for \"android.permission.RECEIVE_BOOT_COMPLETED\"","origin":"Static Parser","mitre_attack_id":"T1402","relevance":10,"id":"static-28","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$29","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.5.7.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Has the ability to read the device ID (e.g. IMEI or ESN)"},{"detail":"Has the ability to query the phone location (GPS)"},{"detail":"Has the ability to identify network operator related data"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Has the ability to execute code after reboot"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Found an indicator for SMS sending capabilities"}],"sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["aauto","andromeda","bancos","clicker","flystudio","gamarue","gamehack","infostealer","iop","lockscreen","mofksys","neshta","ntstats","securityxploded","syncopate","temjepeg","trojan"],"sample_flags":["Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5fc1f59111e0ff5b130b7d69","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"AdWare.AndroidOS","submit_name":"co.fronto.apk","analysis_start_time":"2020-11-28T07:00:41+00:00","indicators_count":{"informative":5,"suspicious":10,"malicious":3},"tags":["Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"596c272a7ca3e16fac598ac4","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"Startapp.A","submit_name":"co.fronto.apk","indicators_count":{"informative":6,"suspicious":11,"malicious":4},"tags":["Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AndroidManifest.xml","sha256":"37d8b2f4818e681657627209b6b03d79feb52298c58d211efd740d4572f29012","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"CERT.RSA","sha256":"15aa7de8722a832db6de88c1a072138e8de16c1f7de73ef740896c30629724be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"CERT.SF","sha256":"b2fc16efcc6725df400b1f37142119ef6b391eb523c038625aca33edbe3ea74b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"Jsr305_annotations.gwt.xml","sha256":"0215a446bddde28ed59ae7122f8f59472d4be649ac7b92d5f56488407b364f39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"MANIFEST.MF","sha256":"05a7de0760726a7e7db22a63b264ee83a2c70f14a5debe00ca7f2b0b3bb0c066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"build-data.properties","sha256":"228461f6bf1cc9e3a37febb59ff4e8186bfd8d5f3afe55ab35caec598a5bfe6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"closebutton.html","sha256":"a9731f9a7fd1c359f1d86b80794db8a869d117e13f821974aba00fc1885b1fa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"com.amazonaws.aws-android-sdk-core.properties","sha256":"edbd95924e469a14ed9112c346546d50b7d2a18306865ad7dac294053d69eed0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"com.crashlytics.sdk.android.answers.properties","sha256":"b23ad32e7de52bc4fbb81916e735168cc8ad332a94f6f9a3dc07241c42d96ce6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"com.crashlytics.sdk.android.beta.properties","sha256":"ed7912137bf642c43a9629130f7ab942399e4435657971e10f73ca66a86750cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"com.crashlytics.sdk.android.crashlytics-core.properties","sha256":"c876c6e5f90e3dbb11784144edec1c1ec2eeb0e63cad3bac39b5551e84d493d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"com.crashlytics.sdk.android.crashlytics.properties","sha256":"c5acc53bcf75efd3d877d82f8d1d1a85a87a993ff19e2e0a203c7c5bb5181abc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"io.fabric.sdk.android.fabric.properties","sha256":"6feaf986bd00bf5462351d7a32c747c4dda28676675be0b5ba695a766754d76d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"io.grpc.ManagedChannelProvider","sha256":"a0ebc6fb7d2b272d73d2b6eb8249b315016f58b8e1f5e10177c623993e117914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"io.grpc.NameResolverProvider","sha256":"8fb9f9062afa2d8efefb93b8c584d03bacfc3e40ce19291d1e1bd9c505011296","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"javax.script.ScriptEngineFactory","sha256":"b0499b88ec03155b28af0fe1771520c41b06295eb60b530a60e26da80ca317de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"libadcolony.so","sha256":"ebf75224b1585c4e4876cc8043c5d57f5bd7e752e23576b5d8889b20ee78237d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libadcolony.so_1606546892821","sha256":"b87f58f62b96ae429f042d56ab5585a6ed6439f3c3106cda227a167340d4384f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"libfb.so","sha256":"97e0b9f5356aee49820b15163fe8c7dd4abf4b13d308d9bed6c11af71c0cdc33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"},{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libfb.so_1606546892821","sha256":"d9d2dc8f6e9cfeac830bd2962afc41b8361b567a26378518bad9dc24a3be253f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fc1f59111e0ff5b130b7d69"}]},{"name":"libadcolony.so_1500260208168","sha256":"ebf75224b1585c4e4876cc8043c5d57f5bd7e752e23576b5d8889b20ee78237d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libfb.so_1500260208168","sha256":"97e0b9f5356aee49820b15163fe8c7dd4abf4b13d308d9bed6c11af71c0cdc33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libfolly_json.so","sha256":"a3ca57c72479606deffe9186c79a7694e40b85525df24e5a5469c221a09c4ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libfolly_json.so_1500260208170","sha256":"694abeb784a2a470757b6cbda7e94f3ec30873d6899cc94009a46676426e14b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libglog.so","sha256":"a09cfa9e5d548bffe35197abb470fcf1e36105109584fa3616d6a6298b5b5076","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libglog.so_1500260208169","sha256":"9977045c21644276ea1e0b01c101d6262199a1cc153a85f2c3e0bdf56cdd27ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libglog_init.so","sha256":"d15a59cd909dc2f5b69d90621d72e768b0845dfb223b16db343043d3b2b64f46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libglog_init.so_1500260208169","sha256":"3170e39a4b2053302dd6a7f952a56b67b50beda8fa02b6fc4b81fec94134993d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]},{"name":"libgnustl_shared.so","sha256":"7e6d47743949cc9d00fbb6c5a20f4d9327839db27bcfd40e4b0bfed687c8eb29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596c272a7ca3e16fac598ac4"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["596c272a7ca3e16fac598ac4","5fc1f59111e0ff5b130b7d69"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.AndroidOS Sample 47454e212503… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 47454e212503…. Malware family: Trojan.AndroidOS. Threat score 81/100. 1/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.AndroidOS Sample 47454e212503… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 47454e212503…. Malware family: Trojan.AndroidOS. Threat score 81/100. 1/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/47454e212503ddc54c2dd1582cb1c07fc6f7b32f89334e9402bb997a6d5d4115"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.AndroidOS Sample 47454e212503… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 47454e212503…. Malware family: Trojan.AndroidOS. Threat score 81/100. 1/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]