Analysis

  • max time kernel
    542691s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    11/10/2023, 20:04

General

  • Target

    Marcação de Ponto 2.0 HCM_2.12.25_Apkpure.apk

  • Size

    9.1MB

  • MD5

    9e57f2db0a81340049c0a6715332d41d

  • SHA1

    5e938536682da5002566d06107b4276ae31afb99

  • SHA256

    17886f555b4c292c135b87137c9b49316543ec52d1c5bb74da25d8e23dcfe749

  • SHA512

    54338e9dd340135a6c4b10c56f677b73d68b9c04053876ee5553ab81201a7fa3eb4a1e209e9036e5e5ca6c0e8d5ac2036a7e04f9ddf5d301efa9997ae25e9565

  • SSDEEP

    196608:pxwVLFrJkFHbblNi2R+LWvybYJmzu6CzBJcMZgUpf16IBTvI6LRmHY43lnOxRJ5k:nwVLFrJgeLWvy6mzultqOBf16Sf143ll

Malware Config

Signatures

  • AxBanker

    AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.

  • Checks the presence of a debugger.

Processes

  • br.com.senior.marcacaodeponto
    1⤵
      PID:4483

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/br.com.senior.marcacaodeponto/databases/_ionicstorage

      Filesize

      12KB

      MD5

      d1302c93f580dc90c228de7153677a64

      SHA1

      27214c7d7613dec65d5dd76a31eee747c92baf90

      SHA256

      6e22cffccb9f934d1ac54f14c4fe80c2f2f58899bc6ab42860497920fc6e13e6

      SHA512

      1ed69da4abc67768938cfeffcec2dd67b2d08e92fef22f05f4cc226450f3f83c7fb183df3bc4e792367f3837eb42c9b13b03326f34d145839be43ae295c75574

    • /data/data/br.com.senior.marcacaodeponto/databases/_ionicstorage-journal

      Filesize

      512B

      MD5

      4db5fa2698d87c075ce721de39cc844f

      SHA1

      bdd35962e0938c83656ae5229fe0b1b81bf56385

      SHA256

      0044399fcd2481a4805dbd7cafffc9072bd66ca3109c31f8a5a6c4a64cab64bb

      SHA512

      9b26c9a73c1064df6d47eb32491412d484e8225ee90503d3d0cbc33b6756f289db13d45004f5482b5b490eefd94315eafbe85b4ff7ffcdcd39a0ef89095c2791

    • /data/data/br.com.senior.marcacaodeponto/databases/com.google.android.datatransport.events

      Filesize

      56KB

      MD5

      8752543a0e1e591ca331d37210949e7c

      SHA1

      cd4c8b387d14d29597b70a7d3681a3aac180f60c

      SHA256

      0e7624f57ac20252b1de97ea4a185e5c9df0a3b2290c87e98f1469798a804234

      SHA512

      01bd1903124d00bc4baf323e152c05b6dab7d99090ddb9132db2d653441367039ada915aea63b5fb7f91001be7e21e1540dc56eef4be98874463a5b107b40d50

    • /data/data/br.com.senior.marcacaodeponto/databases/com.google.android.datatransport.events-journal

      Filesize

      512B

      MD5

      3e6a15dc879b1f5df6243156dcd084c2

      SHA1

      c3d0d8c246dd828fe68cc397b1a9dd43535e8697

      SHA256

      25f1f897e43f3773f82eff280acab1164ee1d1cd0377da3da04699a585fee3f2

      SHA512

      fbe25635762d32500d731c8ee519b44d54b3dbb39625e085bdf1cbfe4e8e11b26fb01585cf25600d04d987502a10e415f5736dceb87a71f4efb5f85dbc574982

    • /data/data/br.com.senior.marcacaodeponto/databases/com.google.android.datatransport.events-journal

      Filesize

      8KB

      MD5

      13f8f5999b53189f1825fdfa11bdc7ef

      SHA1

      68a1c24a4f34626ab82ba159ad07e5d3e20448cb

      SHA256

      c66fe7d6d7c7011763dbbfd648c0b82adf2a503937a390e95c5a9abbe0da125c

      SHA512

      40ac18acd2107c587c2586748e77543d1d106f2cfbf0cb7c807517324d71d02edb20194160774798b46b9f103c46cd0468e34eb23d841379be00da719b9b330c

    • /data/data/br.com.senior.marcacaodeponto/databases/com.google.android.datatransport.events-journal

      Filesize

      8KB

      MD5

      8bdea6b27f6b11bde0f249a4ac282339

      SHA1

      4d5583ba4ecb3bc98c252a4a675a8ae850267af2

      SHA256

      8ab7508b289d4d1d53f5982622316a26900fce9ac6a8df9dfe45f076598b8475

      SHA512

      a20557523b402e3a5e241fc15a952b85ed987ac4d66f74bb695eaa6c0ba718fdac05c61b0d45246a07cd21616edd9ab0e1f1e9600b26534b989871bf729a8a60

    • /data/data/br.com.senior.marcacaodeponto/databases/ponto_mobile

      Filesize

      516KB

      MD5

      f92ed46aea7375b8b71d13ffebd5c6da

      SHA1

      5cb2880b968f4e0f580ac7eb539c23ed45dee5df

      SHA256

      939677f79f03da2c1b8290e1cc775fe1e670a8a7b8e787a48888533efdc921c6

      SHA512

      ff3cc3d4ebf845eebe6de1760394b29a394246bd0f6b7bb6ae791879d42414b6f710f5d403b095db487ddd50d8a1fb9e5ac4a09873c4013aa16941e97f597a88

    • /data/data/br.com.senior.marcacaodeponto/databases/ponto_mobile-journal

      Filesize

      512B

      MD5

      b7655029a3c8170d37c1ba9431cd1374

      SHA1

      5a4f1f4b9a4076e3ab44b959d75e2fac75af67a9

      SHA256

      b8e6aacd4be59113f5300c7db8ed793188b0dd201a6a55d905519b94f75aca33

      SHA512

      6608a956a937b5a78b1b39634810488ba35fea5c835a96fb9e6566d2cd54b1829a7b052a9d3ffe68537b171c068d3d7353b47a0b900083cfa657a42881a13689

    • /data/data/br.com.senior.marcacaodeponto/databases/ponto_mobile-journal

      Filesize

      12KB

      MD5

      03387bd646bd14bfd3ab16769590d695

      SHA1

      01315a086fe7752864f84ec633b4baedbcbc4887

      SHA256

      225104d82ec9cd3f3ac8cf95cd3f957edc6dcc216ec3e5bcc093abcf6a233d4e

      SHA512

      9b5ac8752206814c364f60c967d310fc0604eebf7b87804754cc2bb1a9d279ae22003716ac38ffdf0f12e58c0c7d9b7e0a9dc8ed6a5c2e22fa5d07ea9f07d40e

    • /data/data/br.com.senior.marcacaodeponto/databases/ponto_mobile-journal

      Filesize

      12KB

      MD5

      c049785365148fc7a1c968aca171f26d

      SHA1

      b577598c5d3e5190039300f01b39c9f80bcf7a7d

      SHA256

      54e03f0779a23a5fb1ad68960d4bf8943805f82471deecfb925c7e247b0fc8dc

      SHA512

      fb715896b64e2bdf8277c43f83a3d02ff86a7488507f2f59cde8f55e7ef26bb4f03b0feb9679a8389641c36942754062487880c406e7b07059eb341400dd6b66

    • /data/data/br.com.senior.marcacaodeponto/databases/ponto_mobile-journal

      Filesize

      8KB

      MD5

      a06a10963564eae7c5e8fc0dc449f6bc

      SHA1

      4594268f6f49edf5a99138850057ca659a33f613

      SHA256

      040eb2a90502bc43dbbaa4932ec29e592d1a0165d2bb0a1e7401d1c12109fa70

      SHA512

      17d25acfff25bb6422bfaeeed3da66883864ddb5c3ffb8c9b6c5c2b4c6571079d6ca398736214ebf841b399fa8f70161ee7f44fe876464bbb6383f557bbe0e40

    • /data/data/br.com.senior.marcacaodeponto/files/PersistedInstallation4662907916573670817tmp

      Filesize

      569B

      MD5

      c6514f71c6c8e79ec3c4ecae4d035754

      SHA1

      1002479e1f3cba2c2b20dc0a935a96031eeeb64a

      SHA256

      0c3eef27cfd3392886fff38d32c5836367f703187a6b3f8af753fdf01959083e

      SHA512

      131099bf8ef38bf3688c1596c22b385c152aa694750db221f0f802bca76beabe42645c55a1f64b0e3a4728598b5d4a650333acbd2788fda3337d1c4f337cb2b6

    • /data/data/br.com.senior.marcacaodeponto/files/PersistedInstallation8017483437460788951tmp

      Filesize

      90B

      MD5

      74bff021a7578d6f112235406274b7e1

      SHA1

      0ac80e8989221f64074250b5bb592e5b4b81756f

      SHA256

      686446d232d06034ccc8fe3f05ee891457d99dc93b88ba8e63b9cf270bcd55dc

      SHA512

      1f0e56553f50cb38a4bf9ca766e36280a72e269515df4989fb18bd722672ffc3a25f02cf97cd52be11288b93ec55b6f7cb3628f08e8cbd9b6902a317aa5905ff