nexus | 0c78489423101d08e47d67ab467a45edacf84ea46ef1f7c0370084dc7a956867

Resubmissions

08-04-2024 12:28

240408-pnlb2acd6t 10

08-03-2024 09:07

240308-k3bc6abc69 10

23-03-2023 01:50

230323-b89y8scg82 10

Analysis

max time kernel
301s
max time network
311s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
08-04-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4.apk
Size

4.6MB
MD5

d4c6871dbd078685cb138a499113d280
SHA1

60b64c8481f9de5b92634efc70a9ff42f451c78f
SHA256

376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
SHA512

e8823b7c73140af88ad6fd8c52a6619d245281170ddb31feb9d4e726ee47a8f34575f687048947272fabfb13dbed2c24f50d6fbd6117d40c1db577305955af59
SSDEEP

98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc

Score

10^/10

nexus banker collection discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

nexus

http://193.42.32.84/

http://193.42.32.87/

Signatures

Nexus
Nexus is an Android banking trojan related to the SOVA banking trojan.
banker trojan infostealer nexus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.help.marine
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.help.marine

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.help.marine

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.help.marine

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json	4303	com.help.marine

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.help.marine

Queries account information for other applications stored on the device. 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.help.marine

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.help.marine

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.help.marine

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
57	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.help.marine

com.help.marine
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device.
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4303

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.help.marine/app_DynamicOptDex/nx.json

Filesize
2.2MB

MD5
cf9772416a747ac509ec2970cb9c9e74

SHA1
128bcf36307203dbb198d45c3560f30cd63bbd8d

SHA256
6e9478358dbfbefe00e28c9bf85255a8706873479cf8f0746a2246bbbab03c04

SHA512
9f0789d68ba6143d289a066db215a06b64adafa7967bd6915516f12ee416a02cb70bb52dc6cef945ed8965640e8d969093b33c2ce0fc35c480b9cfc57c8da014

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/nx.json

Filesize
2.2MB

MD5
dd644c0a66a11feb4a0d086916d77d42

SHA1
06c009c8e0e9258ab46348573a8023ba2a17086d

SHA256
12d162274020d3a09c7921c34ab8461a1a2a562667feb79f4ab222813b7e6b43

SHA512
f8978a8486d094b33024c0c4d40dd1eca425ab66ed6fe6423e176cb5edb2e38007410b47010c3e3f5edf6a3229f8ef4e61bbb991bd213d52ca8afc49492b4ddc

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/oat/nx.json.cur.prof

Filesize
3KB

MD5
83649561d70ffdbcb03a4cbd2efbbcce

SHA1
464a0bc4137eea355705401d80b029269eeaf401

SHA256
0d89ab93c1bbae0d59b28dc6d1031fd5820627d03ebda78dd9c1541308390477

SHA512
3efcd2dddaa9ddfd2a329102d4a28c65976406bfd6034393aa660bbab237ddbe0d7e7e9dcc0b8b8e3b0e4574a99aa0edfabb768f2f89fae671e282dee35906f9

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/oat/x86_64/nx.vdex

Filesize
113KB

MD5
ccc40097c44dec170c02a59f9412cbe4

SHA1
7d8b300fa0e1f2f96545b4f6f5b9e8ccc108a01a

SHA256
5153d8b9cbfa226d0b8e5fe022adf412f44a563e05d67c239091d445bff0a6e6

SHA512
dab7dc19ba7d0a3ab9ca88acd3b53880119cbbb1cb1c449f4b7b9381028cdcdb1b36401d4c7a737ce7e62962d9ca8814010b87aa8d2cf72fe5482f874b692d33

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c610e7f9b7fd5c29f9df3575960d28ca

SHA1
c3ed4765b945b11181d7781578efb8aaceb875f9

SHA256
9ccf90d09813b73f419e836d761400899e5e29a5f4a5745b42d75b9dee97cd7a

SHA512
1694807ed135b97f89ad892e439376ffafea68d99c0bfb48272c7800e14975612953ab4c7b2b32bddeadb9f90b50fc4cc5f4783e4b10128a93d5f07073197ce5

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-wal

Filesize
229KB

MD5
8f5cba8a138994c00338aafe8a5c5246

SHA1
9fac8f65ce251e46514fbd9980ea1e9d95c6cf41

SHA256
0c5da6148afc8f0f0d3227c3150f97a379e522ae01f7106625d24929c2422a58

SHA512
0b60ebae55e38ce222b5ef60538999c35f009fc21b00f3ef644fa666b06a30106c4d24859c22d192976d39485d3b5a360445c0bbaabb638c080a039de8629f4c

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
fff9cbb81c96219da6d84902f0d71f10

SHA1
7b3573b318b56191d71b7fa41848ff3bb77bf617

SHA256
32f4a89defcc84a7d2ca9f531e548485f4dfdc64d76d32096f371dc4b6511c27

SHA512
c78b5063db0b89ce94eb17175d7515a7c0a1c6b1ba07596c09b66b19e0152af30ecb923d6dfae33a12fd261aacde2041f5003747a4f1f4f1277ff9a422b6c540

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
eb41db2fe7d63c7929ba6efe6f469ed9

SHA1
cb3d6b7c4579ff0e35e822030999a34941ba80c8

SHA256
f7364cf6ccd0ceaf7285444ed972ca069751ae9e5ada0352c853dd9ecf9411b2

SHA512
2d8f01893b61859fc1744b30a04a2b08ca6226154617a380205012f6d81d819d7c3998012c65bdbf3bcd08979f8f37e1390b4aaf2c5a65f2b065c91737b1676d

Download Submit
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json

Filesize
6.1MB

MD5
781a5fd150ae010085b1e7ff4501a0f4

SHA1
bfbe600cec76f9f00f02a6f0eca5f4bbd5eb1e71

SHA256
9ae5523ea2a7080ac97ef5443bf4b781f775c67fefaec687e58b5b983caf3146

SHA512
d5dafba7a47802f4312d03557c428e4834d1ca02f0e49f60bb59873ca674deb7be340cb6d0a714295c29894746512869d480da21ab3862eeb27fee9265a98bde

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads