Analysis
-
max time kernel
4265145s -
max time network
162s -
platform
android_x86 -
resource
android-x86_arm -
submitted
14-01-2021 00:06
Static task
static1
Behavioral task
behavioral1
Sample
kakaobank.apk
Resource
android-x86_arm
android_x86
0 signatures
0 seconds
General
-
Target
kakaobank.apk
-
Size
14.1MB
-
MD5
0ca16038c31f3ce5bb074c7fef5b5ae2
-
SHA1
753d3c8ba8507d88e5e0b71a9947b25483fb6618
-
SHA256
6d98d5269a2f597312589d92c0cbef1e4781dead46d37a2fe0ba5fbecd4eae19
-
SHA512
5be92cb0d1e216f7bcaa78260d76817a7067f9241b6ae912270117c4aef58aa8f879e408042cead0a11393ad0f5cca50d4dd859d25562ba02a1c4b2c0544930c
Score
6/10
Malware Config
Signatures
-
Reads name of network operator 1 IoCs
Uses Android APIs to discover system information.
Processes:
com.kaka0s.sx98xadescription ioc process Framework API call android.telephony.TelephonyManager.getNetworkOperatorName com.kaka0s.sx98xa -
Suspicious use of android.app.ActivityManager.getRunningAppProcesses 3 IoCs
Processes:
com.kaka0s.sx98xapid process 4555 com.kaka0s.sx98xa 4555 com.kaka0s.sx98xa 4555 com.kaka0s.sx98xa -
Suspicious use of android.app.ActivityManager.getRunningServices 1 IoCs
Processes:
com.kaka0s.sx98xapid process 4555 com.kaka0s.sx98xa -
Suspicious use of android.app.ApplicationPackageManager.getInstalledPackages 1 IoCs
Processes:
com.kaka0s.sx98xapid process 4555 com.kaka0s.sx98xa -
Suspicious use of android.telephony.TelephonyManager.getLine1Number 1 IoCs
Processes:
com.kaka0s.sx98xapid process 4555 com.kaka0s.sx98xa -
Uses reflection 75 IoCs
Processes:
com.kaka0s.sx98xadescription pid process Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getDeviceId 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getDeviceName 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getHost 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.isNavigationBar 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getNetwork 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getNumber 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getOsVersion 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getResolution 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.getSaler_code 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.isTCall 4555 com.kaka0s.sx98xa Invokes method com.kbwork.dygaqy.net.entity.RegistEntity.isWhowho 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getEntity 4555 com.kaka0s.sx98xa Acesses field cz.msebera.android.httpclient.entity.HttpEntityWrapper.wrappedEntity 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpMessage.getAllHeaders 4555 com.kaka0s.sx98xa Invokes method cz.msebera.android.httpclient.HttpResponse.getStatusLine 4555 com.kaka0s.sx98xa
Processes
-
com.kaka0s.sx98xa1⤵
- Reads name of network operator
- Suspicious use of android.app.ActivityManager.getRunningAppProcesses
- Suspicious use of android.app.ActivityManager.getRunningServices
- Suspicious use of android.app.ApplicationPackageManager.getInstalledPackages
- Suspicious use of android.telephony.TelephonyManager.getLine1Number
- Uses reflection
-
com.kaka0s.sx98xa:remote1⤵