General
- Target SharkBot (15).apk
- Size 14.9MB
- Sample240402-hp2xvaad7v
- SHA256 6f1eb9c21b026eecfd65459ec4cffe3954d24619010741e18722108d7bacf3d1
Malware Config
Extracted
-
sharkbot
-
http://mefika.me/
-
target_apps
com.example.creatersa
com.barclays.android.barclaysmobilebanking
com.bankofireland.mobilebanking
com.cooperativebank.bank
ftb.ibank.android
com.nearform.ptsb
uk.co.mbna.cardservices.android
com.danskebank.mobilebank3.uk
com.barclays.bca
com.tescobank.mobile
com.virginmoney.uk.mobile.android
com.monitise.client.android.yorkshire
com.monitise.client.android.clydesdale
com.cooperativebank.smile
com.starlingbank.android
uk.co.metrobankonline.mobile.android.production
uk.co.santander.santanderUK
uk.co.hsbc.hsbcukmobilebanking
uk.co.tsb.newmobilebank
com.grppl.android.shell.BOS
com.grppl.android.shell.halifax
com.grppl.android.shell.CMBlloydsTSB73
it.copergmps.rt.pf.android.sp.bmps
it.extrabanca.mobile
it.relaxbanking
it.bnl.apps.banking
it.bnl.apps.enterprise.hellobank
it.ingdirect.app
it.popso.SCRIGNOapp
it.nogood.container
Targets
-
- Target SharkBot (15).apk
- Size 14.9MB
- SHA256 6f1eb9c21b026eecfd65459ec4cffe3954d24619010741e18722108d7bacf3d1
Score7/10-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.