sharkbot | 72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e

General

Target

72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e
Size

14.9MB
MD5

72830ce590ffeb0994e35e9019abfce5
SHA1

ba1d41348b44d9fda098a44ade23372dd0a3206a
SHA256

72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e
SHA512

d6e5e6bcda86eaf2d1e8f579ecd51103277525785fb56dfef00ebf501a85e7824cb26888c23fb7d7525471ff57837e03c304f615bb88cfeb7c2f296e9627e17c
SSDEEP

393216:8HZUiBmacX7X52NWdXJq2TN5+dIwepObrfum7R:85BqgY5+AOLR

Score

10^/10

sharkbot

Malware Config

Extracted

Family

sharkbot

C2

http://mefika.me/

Attributes

target_apps
com.example.creatersa

com.barclays.android.barclaysmobilebanking

com.bankofireland.mobilebanking

com.cooperativebank.bank

ftb.ibank.android

com.nearform.ptsb

uk.co.mbna.cardservices.android

com.danskebank.mobilebank3.uk

com.barclays.bca

com.tescobank.mobile

com.virginmoney.uk.mobile.android

com.monitise.client.android.yorkshire

com.monitise.client.android.clydesdale

com.cooperativebank.smile

com.starlingbank.android

uk.co.metrobankonline.mobile.android.production

uk.co.santander.santanderUK

uk.co.hsbc.hsbcukmobilebanking

uk.co.tsb.newmobilebank

com.grppl.android.shell.BOS

com.grppl.android.shell.halifax

com.grppl.android.shell.CMBlloydsTSB73

it.copergmps.rt.pf.android.sp.bmps

it.extrabanca.mobile

it.relaxbanking

it.bnl.apps.banking

it.bnl.apps.enterprise.hellobank

it.ingdirect.app

it.popso.SCRIGNOapp

it.nogood.container

posteitaliane.posteapp.appbpol

com.latuabancaperandroid

com.latuabancaperandroid.pg

com.latuabancaperandroid.ispb

com.fineco.it

com.CredemMobile

com.bmo.mobile

com.fideuram.alfabetobanking

com.lynxspa.bancopopolare

com.vipera.chebanca

rc4.plain

Signatures

Sharkbot family
sharkbot

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

Files

72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e
.apk android

com.ltdevelopergroups.litecleaner.m

com.ltdevelopergroups.litecleaner.m.screen.splash.SplashActivity

Activities

com.ltdevelopergroups.litecleaner.m.screen.splash.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.CHANGE_WIFI_STATE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.FOREFGROUND_SERVICE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_SYNC_SETTINGS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.REQUEST_DELETE_PACKAGES
android.permission.WAKE_LOCK
android.permission.GET_PACKAGE_SIZE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUICKBOOT_POWERON
android.permission.CLEAR_APP_CACHE
android.permission.QUERY_ALL_PACKAGES
android.permission.WRITE_SETTINGS
android.permission.GET_TASKS
android.permission.PACKAGE_USAGE_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CAMERA
android.permission.USE_FINGERPRINT
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_USER_PRESENT
android.permission.CHANGE_NETWORK_STATE
android.permission.SET_WALLPAPER
android.permission.VIBRATE
android.permission.MANAGE_EXTERNAL_STORAGE

Receivers

com.ltdevelopergroups.litecleaner.m.receiver.AlarmReceiver

com.app.action.alarmmanager

com.ltdevelopergroups.litecleaner.m.lock.receiver.BootBroadcastReceiver

android.intent.action.BOOT_COMPLETED

com.ltdevelopergroups.litecleaner.m.receiver.AutoRebootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.SCREEN_ON
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.STATE_CHANGE
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON

com.security.applock.service.receiver.WatchmenReceiver

android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.MEDIA_MOUNTED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.SCREEN_ON
android.intent.action.TIME_SET
android.intent.action.BOOT_COMPLETED

com.security.applock.service.receiver.WidgetReceiver

android.appwidget.action.APPWIDGET_UPDATE
android.intent.action.SCREEN_ON
android.intent.action.USER_PRESENT
android.intent.action.SCREEN_ON
android.intent.action.USER_PRESENT

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Services

com.ltdevelopergroups.litecleaner.m.service.NotificationListener

android.service.notification.NotificationListenerService

Android Permissions

72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e

Permissions

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.CHANGE_WIFI_STATE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.FOREFGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SYNC_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.REQUEST_DELETE_PACKAGES

android.permission.WAKE_LOCK

android.permission.GET_PACKAGE_SIZE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.QUICKBOOT_POWERON

android.permission.CLEAR_APP_CACHE

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_SETTINGS

android.permission.GET_TASKS

android.permission.PACKAGE_USAGE_STATS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.USE_FINGERPRINT

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_USER_PRESENT

android.permission.CHANGE_NETWORK_STATE

android.permission.SET_WALLPAPER

android.permission.VIBRATE

android.permission.MANAGE_EXTERNAL_STORAGE

Sharing

General

Malware Config

Extracted

Signatures

Files

com.ltdevelopergroups.litecleaner.m

com.ltdevelopergroups.litecleaner.m.screen.splash.SplashActivity

Activities

com.ltdevelopergroups.litecleaner.m.screen.splash.SplashActivity

Permissions

Receivers

com.ltdevelopergroups.litecleaner.m.receiver.AlarmReceiver

com.ltdevelopergroups.litecleaner.m.lock.receiver.BootBroadcastReceiver

com.ltdevelopergroups.litecleaner.m.receiver.AutoRebootReceiver

com.security.applock.service.receiver.WatchmenReceiver

com.security.applock.service.receiver.WidgetReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

Services

com.ltdevelopergroups.litecleaner.m.service.NotificationListener

Android Permissions

72512e7de8099e66beb9b4395b8c4a5c1dfd413c85977a31480ff8bd68b2ca6e