Analysis

  • max time kernel
    4058270s
  • max time network
    37s
  • platform
    android_x86
  • resource
    android-x86-arm-20231023-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
  • submitted
    21/11/2023, 12:38

General

  • Target

    ee9d9e6e577612b583cce381842efdc6.apk

  • Size

    8.0MB

  • MD5

    ee9d9e6e577612b583cce381842efdc6

  • SHA1

    83b22d9566ef699f37560d39b8166e8aeaabf209

  • SHA256

    7cbe341442e7a836054a69d0659833a93fb22be458909f79c4c346681164727d

  • SHA512

    12e7404376e1e0ccc50c6c05ced5498f4a25053fe5717f61ee1b6f915bc4cf0fba091724cb3bb1625815c0a0af0ee64b68dffe8ef4ee8ae8c29cb8870c80ad33

  • SSDEEP

    196608:oUyy81MVgqaUXyulAf5Ks9Xy8jj8Iukg7RQGoKnOAmgpeP:oUp8nUzAf5Ks9C4j8I5gUoOAp0P

Malware Config

Extracted

Family

axbanker

C2

https://preko.in/api/user/step1

Signatures

  • AxBanker

    AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.

  • Requests dangerous framework permissions 3 IoCs

Processes

  • com.mobisystems.fileman
    1⤵
      PID:4299

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.mobisystems.fileman/files/hook.apk

      Filesize

      4.7MB

      MD5

      cf3eb68bd653e81bdda132d3cde80f31

      SHA1

      dec25df61f988c8419b8fca4a3d703e755f9942c

      SHA256

      8ce8dd68ef9c929af1a43cebeac7294472c309b2ba85e16223b43e4f051b894d

      SHA512

      930ce2c6f7f87ce5085d2502f1bbe94b1e1c97aa4540c8efc02693ec9c4406153ad4a021880eb6381eb1c31da0e78be5a258f36a07eb47a99334b5ed088a71d4