Resubmissions
03-10-2023 04:56
231003-fk7anaac27 1002-10-2023 08:51
231002-kslq5sab85 1015-06-2022 10:30
220615-mj79wsgdd2 8Analysis
-
max time kernel
4092064s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
submitted
03-10-2023 04:56
General
-
Target
5bb714a7ae9542e717211bc4f865c9015e14e2909a426706656ec118131f9b95.apk
-
Size
52KB
-
MD5
f4f565dc9db20b26b9fcaeb1887e779c
-
SHA1
a0c2d20e68afe6bffdb6c7b9afcbba657357ea44
-
SHA256
5bb714a7ae9542e717211bc4f865c9015e14e2909a426706656ec118131f9b95
-
SHA512
4a8a536b9cc7c87abd871aac906855d2988baa80ba274bcfac541de0f45a437467de5be5adf100e4fe7733852b1897224bbb2e773da102191c83fe6264f42f07
-
SSDEEP
768:aCbONz7RQ80fV9svIrt4Q09uhpVP+OOcuoBLp9KUCsz2lbMMgSnFyImbG:aCCn9+7ps2/mOOL4l9KFdlAMgS0ImbG
Score
10/10
Malware Config
Extracted
Family
coper
C2
https://4-u.wtf/
https://fitnessstyle.xyz/
https://sportsstyle.club/
AES_key
Signatures
-
Coper
Coper is an Android banking Trojan with a multi-stage infection mechanism first seen in July 2021.
-
Makes use of the framework's Accessibility service. 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.seeturn91⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).