Analysis
-
max time kernel
4090811s -
max time network
133s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
03-10-2023 04:35
General
-
Target
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b.apk
-
Size
123KB
-
MD5
39074c61fffeccf21907cd3dbf3ffffe
-
SHA1
329c2e94e8c95a0d588fed72ea7e53fe21ea7837
-
SHA256
36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b
-
SHA512
119ec034f5286a2f7b5e78ed563ee18cbb6b8f602abb9001e4fa0248f6ae9bb259998591bc2b839bbad9b1e5412b8425a26f0ff45ec6e4beec1cd54084f5de66
-
SSDEEP
3072:xKoSoUSoJh/U99KFdlvgDG14p4aG7O48SKZxKSp6ZF:xNjAJW6YDQozAOuKZ/a
Malware Config
Extracted
coper
https://4-u.wtf/
https://fitnessstyle.xyz/
https://sportsstyle.club/
Signatures
-
Coper
Coper is an Android banking Trojan with a multi-stage infection mechanism first seen in July 2021.
-
Coper payload 3 IoCs
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.lineanysl1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378B
MD536e266177ef0cb1059c34b283c4b0425
SHA1fe5173a6b87679f144b68b13c47fb761a2b95b50
SHA2562765bf6f816b675f0fb7bc8f2de10b741a6dea8923130ece53af9fe0b1ec6120
SHA51235916ff3cf5cd37b556a0a4e3c0412b3fc0529504861aa7d42ce16dd28b5a28d848142a91f23b76bf1de85f22875838963fd7d89b99a2cfc64b825ecda5028e4
-
Filesize
72KB
MD59af1044411e312db0bca097cba17b972
SHA1f2de6a855f04a0f5e0999c5b413347adaa1197e2
SHA256b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604
SHA51275615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d
-
Filesize
72KB
MD59af1044411e312db0bca097cba17b972
SHA1f2de6a855f04a0f5e0999c5b413347adaa1197e2
SHA256b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604
SHA51275615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d
-
Filesize
72KB
MD59af1044411e312db0bca097cba17b972
SHA1f2de6a855f04a0f5e0999c5b413347adaa1197e2
SHA256b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604
SHA51275615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d