axbanker | 12240896339[.]zip | Triage

Sharing

General

Target

12240896339.zip
Size

4.6MB
MD5

ceebc0dd92fac5dab7535d740464d422
SHA1

0190f44983cf5507a7354b347443d26858624ba0
SHA256

2e6f290133693e64433206858d6244f453875285212ff05edfe4ee079dfbe138
SHA512

c00c9ba169d352648ef643e9b92aaa198fb1f6b498362e49461b73cc47945d6298c44518ab0d71371149cc24daf2d0463a5cf38eed4ad79135d11604d99e9f5b
SSDEEP

98304:ipvHf6rF/Tl74KMqOvB5DdlCDWS2wZvuoY0pQVUz6p:i5fKVZ7sqOvBCewZWdPGa

Score

10^/10

axbanker

Malware Config

Extracted

Family

axbanker

C2

https://hdphd.in/api/user/sms

https://hdphd.in/api/user/step1

Signatures

Axbanker family
axbanker

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS

Files

12240896339.zip
.zip

Password: infected
cae205d4fd65e7c4f86601668c225bb5c8ae0ad3f2c81956fac54ae88272dc08
.apk android

Password: infected

com.playrix.townships

com.playrix.township.SplashActivity

Activities

com.playrix.township.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.INSTANT_APP_FOREGROUND_SERVICE
android.permission.FOREGROUND_SERVICE
android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
com.playrix.townships.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Receivers

com.playrix.township.MyReceiver

com.example.autostart.ACTION_IMPLICIT_BROADCAST
com.example.autostart.ACTION_EXPLICIT_BROADCAST
android.provider.Telephony.SMS_RECEIVED

Services