Overview

overview

10

Static

static

7

831346106d...b1.apk

android-10-x64

10

831346106d...b1.apk

android-11-x64

10

831346106d...b1.apk

android-9-x86

10

Resubmissions

03-10-2023 04:57

231003-flel2agd3x 10

02-10-2023 04:19

231002-exzwnsgh69 10

10-03-2023 06:31

230310-haj4gsdf5t 8

15-06-2022 10:31

220615-mkec7sdehq 8

Analysis

  • max time kernel
    4003596s
  • max time network
    310s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • submitted
    02-10-2023 04:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1.apk

  • Size

    123KB

  • MD5

    b08c833107b4fc22289386fe47dd997f

  • SHA1

    fe6673b28888d22b1d3181e26b5e708d96d3f602

  • SHA256

    831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1

  • SHA512

    9b26a007c1c3a107c41992f14df40f094880c045a0586cd67a3fca091fc9937ec513a40733b74950b7c4bdfaffd3a8142be3333f4981e5ff07898d5a1b1bc52f

  • SSDEEP

    3072:ZXWaaDA/UsmY9KFdlvg08HHf1yhEZeXGA4FYP8R4V7/I6EPCLps:ZXP/5P6Y1NlepPnV7/pEKLm

Score
10/10
coperbankerinfostealerransomwarerattrojan

Malware Config

Extracted

Family

coper

C2

https://4-u.wtf/

https://fitnessstyle.xyz/

https://sportsstyle.club/
AES_key

Signatures

  • Coper

    Coper is an Android banking Trojan with a multi-stage infection mechanism first seen in July 2021.

    bankertrojaninfostealerratcoper
  • Coper payload 3 IoCs
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.frontbynpxa
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4669

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.frontbynpxa/cache/apjorsma
    Filesize

    73KB

    MD5

    d4cd337c961cce8a496a5e6e020e54c7

    SHA1

    62d731ab9f40470e649a51b8d7e61af61f23cd8b

    SHA256

    ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a

    SHA512

    531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24

    Download Submit

  • /data/user/0/com.frontbynpxa/cache/apjorsma
    Filesize

    73KB

    MD5

    d4cd337c961cce8a496a5e6e020e54c7

    SHA1

    62d731ab9f40470e649a51b8d7e61af61f23cd8b

    SHA256

    ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a

    SHA512

    531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24

    Download Submit

  • /data/user/0/com.frontbynpxa/cache/apjorsma
    Filesize

    73KB

    MD5

    d4cd337c961cce8a496a5e6e020e54c7

    SHA1

    62d731ab9f40470e649a51b8d7e61af61f23cd8b

    SHA256

    ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a

    SHA512

    531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24

    Download Submit

  • /data/user/0/com.frontbynpxa/cache/oat/apjorsma.cur.prof
    Filesize

    245B

    MD5

    5cecc443ff0bb182474b5e5cb2dc1d90

    SHA1

    f332250f2a9c8c1e50efb4ed9c16b4928bebfb68

    SHA256

    b3f5d43babbc38299db6440c24c176b3f6a5222d59c787d20573c4abb1ef36a7

    SHA512

    8f2eaaaafd0215b7bd03e592efd93569290aeebbea7a560080973587d765318dfc02ae245a170b4e5e7d3caeb979e01e7e19057cbbdcfcd57ccafad074e03cc5

    Download Submit