fakecalls | 703d36404e1e9bb74172bc7be5e3cfb8ffad4a6a4bee54ee0ab18deae3d105d5

Analysis

max time kernel
2306821s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20/12/2023, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

703d36404e1e9bb74172bc7be5e3cfb8ffad4a6a4bee54ee0ab18deae3d105d5.apk
Size

14.8MB
MD5

a05dcab001a60974ffe00af3b8cdd52f
SHA1

af438a9279d1e4c3cba7bf710c6a90d4283c66dc
SHA256

703d36404e1e9bb74172bc7be5e3cfb8ffad4a6a4bee54ee0ab18deae3d105d5
SHA512

bb4ab06a23bdcbfa9ac0a4fbeb3a7f17919755c3ab1e2319895fdc97ea0978101817fea1a2a41a86e4085c5beb22ca1e54e44d664854c58b303abb0616ddcc91
SSDEEP

393216:zO0kOdzbiqHYTm5y4Cv9O+zShcnF+Ml5QBYLK0sBPuF:60tvbZhCZSQFtQBYLKXm

Score

10^/10

fakecalls banker infostealer rat trojan

Malware Config

Signatures

FakeCalls
FakeCalls is an Android banking trojan first seen in April 2022.
rat trojan infostealer banker fakecalls

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by in-call services to bind with the system. Allows apps to handle aspects of phone calls while they are in progress.	android.permission.BIND_INCALL_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Requests dangerous framework permissions 51 IoCs

description	ioc
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS

biqfgu.mgycleom.bauokge
1⤵
PID:5079

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-journal

Filesize
512B

MD5
92d89631c656c0e61d9f7e7cd2c71a27

SHA1
bdff2b843faa622f04091fa0098cf1cda3f18ecd

SHA256
ffeed74c8e01e2aa64087a6da6c1ba39adf9e53656fe8d4141b96596763a63aa

SHA512
7da4feeb9da083970f583ecaa28cc9b86de0bb56d3e35be5bda5d97286bdfb5ff3a01b9fabdac82388153263f988ca1f54a6f8d46cc6a2d04ac814cf20680db7

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-wal

Filesize
16KB

MD5
26ab5e94c33ba87a1b9d379cf1cf41f4

SHA1
c3d75efdc2ea12d5ad231a248220a8a35aaf43a8

SHA256
69fe17403a91b0605bc2d0cc88a68ba61158a4d3218b026454cf677e1dfcee22

SHA512
7e1a304e208195bd3769b843bdcfca63cfd013cbc3d58aee6e6d717514acf509ec1898cf3ec7a40ff7fd3416e88660d5bcf23afbc47995d5daad357f30c47024

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-wal

Filesize
88KB

MD5
fa7a1d95be8608626b47200272cee34f

SHA1
3d3a91b6d4f0d61b8a144194426d3b9f12777955

SHA256
169be3670caae52fcc6867e0c7e0865ee801ff198ab1463a6e98dd62218963e8

SHA512
5fec3b46db5cbfab501c9490123a886c4a8d9fbdefb849d8d21964ebc7b612c36a0c813787993af0a4bde943435ced22d7a413d374ed458a3a799f4eb02f90c3

Download Submit
/storage/emulated/0/Android/data/biqfgu.mgycleom.bauokge/files/apk/app1.apk

Filesize
115KB

MD5
abd379f6045720c1f2b0808b2adaa72b

SHA1
d534fd28e38ca392f6cfcb4612807534e41689ad

SHA256
b5f29d066ab5f6318418a421f6311788eb1ae71f0532954f9e98636090971701

SHA512
22c72667b123d76fd1cb03634fd45832a4b283705c080052795e07771873b99534c747121f7764b783482430816ae7263f970f95a72ba7a38e22ddbf3b9920ff

Download Submit
/storage/emulated/0/Android/data/biqfgu.mgycleom.bauokge/files/apk/app2.apk

Filesize
115KB

MD5
da045285384187b816b46a2457ccba45

SHA1
9022caaa4fefebba46f3a10d2d86befcc83935ad

SHA256
f653480aa82f273ceb0552225634b641d9bf9f09309baf163444add2ce92a354

SHA512
edb219511011b1f3b119394adcbac2a72dd07d41d9551cd5f3cf13ffd937d2403e0f46c45b3b1d0f649a7bc24bce69adb0c4cff08b9bfaca17d20525c6c30077

Download Submit