746e5ebaf6b6d5c6ef3cc0be32fbd60380aca8632c3c10059e1021d99bfbee75

Analysis

max time kernel
140s
max time network
152s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
08-02-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

746e5ebaf6b6d5c6ef3cc0be32fbd60380aca8632c3c10059e1021d99bfbee75.apk
Size

1.9MB
MD5

0cc4b6fbf14d7af736bfade09b229aa5
SHA1

6a2c67003bd89eb44e3ddee2977d207d83863198
SHA256

746e5ebaf6b6d5c6ef3cc0be32fbd60380aca8632c3c10059e1021d99bfbee75
SHA512

636f2c7d90308cab5df508c373cd31d61db37a3b0f99e18273f07d49aa6bfb89f3940bc7a46c2e7dd28fbf61520a8b397b0f47f1fc76567c280d042afc91a014
SSDEEP

49152:Zy/1YOQeYwhDLd/uDwz+zxPGYeipgqf+O:MQpQpuDwzexesuqGO

Score

8^/10

banker stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4244	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json	4244	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json	4271	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/oat/x86/XmT.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json	4244	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json	4297	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc
/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json	4297	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc

onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4244
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/oat/x86/XmT.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4271

onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc:cproc
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4297

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json

Filesize
499KB

MD5
5f345bae59f434959dcd03b3c126befe

SHA1
87972001bb2b516d40b621187b0c4ce5d236d390

SHA256
f9233150ccf12a404aa2ba7d7b66f3e4bbaa51aa92c1b48d62034ac35f8aa72a

SHA512
10de19be3d0492b6d5a2321b05ae6dcae54b005bd6bfdff075cee57f67e6698302dea93c26e84eced515c5b4b37545fde70fba7d2a97764419111c5921cda6e3

Download Submit
/data/data/onpekpikylb.bcgdhxgzwd.dzlecjglpigjuc/app_DynamicOptDex/XmT.json

Filesize
499KB

MD5
895e2ba62c6014e1985977d5aef8d52b

SHA1
7723b303d72116d479f2f732e11c67dda25a89cc

SHA256
8a25c724dd4e4ef2b0bc1944d4c7357a22f3b639a9d7112afa33b51bc39ef39b

SHA512
2583ac310e28bb6bcc069d4efbd8e42bc6e8ce9119935d9b974cc27f81268594854f30ac5200395e5a0f0f8b4005f385b25f4ca49e580108875301c7adbe88a9

Download Submit