sharkbot | 844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd

General

Target

844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd
Size

15.7MB
MD5

b87fea08d3fd6f9d0a4a46b18b5b3f8e
SHA1

9d54231e93035fcde45851fcf26795d8fe366a7a
SHA256

844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd
SHA512

9c578e637a81c52a32a208d90ccf99ee63693c80278309115450f21427fe9b33c2f5fc0a0a1a9b649d08fe01e73663f2aa28b8311bdb95f65b3eed72f125f3f8
SSDEEP

393216:v4irHAeHcBmacX7X52NWdXJq2TN51XcwnpObrfum7m:lg2CqgY5NpOLm

Score

10^/10

sharkbot

Malware Config

Extracted

Family

sharkbot

C2

http://mefika.me/

Attributes

target_apps
com.example.creatersa

com.barclays.android.barclaysmobilebanking

com.bankofireland.mobilebanking

com.cooperativebank.bank

ftb.ibank.android

com.nearform.ptsb

uk.co.mbna.cardservices.android

com.danskebank.mobilebank3.uk

com.barclays.bca

com.tescobank.mobile

com.virginmoney.uk.mobile.android

com.monitise.client.android.yorkshire

com.monitise.client.android.clydesdale

com.cooperativebank.smile

com.starlingbank.android

uk.co.metrobankonline.mobile.android.production

uk.co.santander.santanderUK

uk.co.hsbc.hsbcukmobilebanking

uk.co.tsb.newmobilebank

com.grppl.android.shell.BOS

com.grppl.android.shell.halifax

com.grppl.android.shell.CMBlloydsTSB73

it.copergmps.rt.pf.android.sp.bmps

it.extrabanca.mobile

it.relaxbanking

it.bnl.apps.banking

it.bnl.apps.enterprise.hellobank

it.ingdirect.app

it.popso.SCRIGNOapp

it.nogood.container

posteitaliane.posteapp.appbpol

com.latuabancaperandroid

com.latuabancaperandroid.pg

com.latuabancaperandroid.ispb

com.fineco.it

com.CredemMobile

com.bmo.mobile

com.fideuram.alfabetobanking

com.lynxspa.bancopopolare

com.vipera.chebanca

rc4.plain

Signatures

Sharkbot family
sharkbot

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

Files

844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd
.apk android

com.sidalistudio.developer.app

com.sidalistudio.developer.app.screen.splash.SplashActivity

Activities

com.sidalistudio.developer.app.screen.splash.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.CHANGE_WIFI_STATE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.FOREFGROUND_SERVICE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_SYNC_SETTINGS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.REQUEST_DELETE_PACKAGES
android.permission.WAKE_LOCK
android.permission.GET_PACKAGE_SIZE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUICKBOOT_POWERON
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.CLEAR_APP_CACHE
android.permission.QUERY_ALL_PACKAGES
android.permission.WRITE_SETTINGS
android.permission.GET_TASKS
android.permission.PACKAGE_USAGE_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_NETWORK_STATE
android.permission.CAMERA
android.permission.USE_FINGERPRINT
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_USER_PRESENT
android.permission.CHANGE_NETWORK_STATE
android.permission.SET_WALLPAPER
android.permission.VIBRATE
android.permission.MANAGE_EXTERNAL_STORAGE

Receivers

com.sidalistudio.developer.app.receiver.AlarmReceiver

com.app.action.alarmmanager

com.sidalistudio.developer.app.lock.receiver.BootBroadcastReceiver

android.intent.action.BOOT_COMPLETED

com.sidalistudio.developer.app.receiver.AutoRebootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.SCREEN_ON
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.STATE_CHANGE
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON

com.security.applock.service.receiver.WatchmenReceiver

android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.MEDIA_MOUNTED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.SCREEN_ON
android.intent.action.TIME_SET
android.intent.action.BOOT_COMPLETED

com.security.applock.service.receiver.WidgetReceiver

android.appwidget.action.APPWIDGET_UPDATE
android.intent.action.SCREEN_ON
android.intent.action.USER_PRESENT
android.intent.action.SCREEN_ON
android.intent.action.USER_PRESENT

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Services

com.sidalistudio.developer.app.service.NotificationListener

android.service.notification.NotificationListenerService

Android Permissions

844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd

Permissions

android.permission.INTERNET

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.CHANGE_WIFI_STATE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.FOREFGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SYNC_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.REQUEST_DELETE_PACKAGES

android.permission.WAKE_LOCK

android.permission.GET_PACKAGE_SIZE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.QUICKBOOT_POWERON

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.CLEAR_APP_CACHE

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_SETTINGS

android.permission.GET_TASKS

android.permission.PACKAGE_USAGE_STATS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

android.permission.USE_FINGERPRINT

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_USER_PRESENT

android.permission.CHANGE_NETWORK_STATE

android.permission.SET_WALLPAPER

android.permission.VIBRATE

android.permission.MANAGE_EXTERNAL_STORAGE

Sharing

General

Malware Config

Extracted

Signatures

Files

com.sidalistudio.developer.app

com.sidalistudio.developer.app.screen.splash.SplashActivity

Activities

com.sidalistudio.developer.app.screen.splash.SplashActivity

Permissions

Receivers

com.sidalistudio.developer.app.receiver.AlarmReceiver

com.sidalistudio.developer.app.lock.receiver.BootBroadcastReceiver

com.sidalistudio.developer.app.receiver.AutoRebootReceiver

com.security.applock.service.receiver.WatchmenReceiver

com.security.applock.service.receiver.WidgetReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

Services

com.sidalistudio.developer.app.service.NotificationListener

Android Permissions

844efceeeeff73da35ac13c217ad5723c456ecec01fada7f92b9203fc29e7dcd