Overview

overview

10

Static

static

10

0759a60e09...db.apk

android-9-x86

8

0759a60e09...db.apk

android-11-x64

1

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    10-04-2024 09:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0759a60e09710321dfc42b09518516398785f60e150012d15be88bbb2ea788db.apk

  • Size

    3.2MB

  • MD5

    bb98d68156b619928db5122ffbd9dce5

  • SHA1

    b1dfb2be760d209846f2147ce32560954d2f71b5

  • SHA256

    0759a60e09710321dfc42b09518516398785f60e150012d15be88bbb2ea788db

  • SHA512

    c138e74c1ef6c9da94c1a1240cf590dffad9e7656fadcdf934ee313c4b4e0a1c9ee2a11661a4fa96251d1459fc460f4650200b83d8af69b34bcf87aea6c84cb3

  • SSDEEP

    49152:24TUQniX10zo7/iiZJm1hNvlpAj/4p76JWYqojqyJnCcW:eF0EdsFyrymJWYDjLJn1W

Score
8/10
bankercollectiondiscoveryevasionpersistencestealthtrojan

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
    bankerdiscovery
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscovery
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about running processes on the device. 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion

Processes

  • com.xdja.safekeyservice
    1⤵
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Requests cell location
    • Makes use of the framework's foreground persistence service
    • Queries information about running processes on the device.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4270

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xdja.safekeyservice/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/data/com.xdja.safekeyservice/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    fa75738edefea9b705d9bc87c18c1839

    SHA1

    7f73883e5d4ea2499fb6e0d5b93363102b846342

    SHA256

    29be3fce722ccc32a61f992753839bb3b4e30a68ff5e0a4c551762cb0b1f0e40

    SHA512

    264657088188335ac732ab93e4ed64612fb27b8e5b4e97d8bfa7d7b1a752040c3e52e7fba3ad32e9304287ec0f24fdf8e38040f3d83da636c3b4990f689d4f4a

    Download Submit
  • /data/data/com.xdja.safekeyservice/databases/com.google.android.datatransport.events-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.xdja.safekeyservice/databases/com.google.android.datatransport.events-wal
    Filesize

    52KB

    MD5

    ecb32471dc13e6a394fba7b1e9115986

    SHA1

    7fad5429d8ec0c29b74ff20477e6bf4d2c807eb1

    SHA256

    63d69c7e4c6186b696f57124b5de19f506dc44586fd0305a7037123a59cd7b50

    SHA512

    8c8e00ccb6580308352ceb4b6eb139909d32d7cdee3c2fcd656f5c85b16d3b7511ee53d12811386fc79f7ce511ef91d886c6e2c5ca17dc5fbd507d02cc3ae04e

    Download Submit
  • /data/data/com.xdja.safekeyservice/files/PersistedInstallation1440793529946540733tmp
    Filesize

    114B

    MD5

    a1c017b1940ccf0256223d05af29d214

    SHA1

    79293d23d152521c2fad79a729625f639f22e064

    SHA256

    4aeec46d61cbd34628e87bb24514dcf3aa8eb76323515ee279a8c3597b6e923d

    SHA512

    f562c97cc2fe270a152dbf52ae5584cb183a3a70e543db0852ad928cec84447502e3268aeb74caecd031f28a6232c7b41574749fc387bd9c09d949362a78ee9c

    Download Submit
  • /data/data/com.xdja.safekeyservice/files/PersistedInstallation5459199216253804756tmp
    Filesize

    90B

    MD5

    bc7f07d1f46b9717caa03772dddf8d5c

    SHA1

    d05ff3c0cbff524767b7e07c0412567ae6edc931

    SHA256

    129a30ed9ea86a1f4c6e9663d8642ad14116ce22896f61f4c5a7911a10fbd974

    SHA512

    2db0dc57db91d010e47a6c1b7768c2d030b9188806683f3630fccb7b155517e797711cd6bf270aac0cdaa9d2c791d38de736e568e9e110197121dcf6c4d7ecad

    Download Submit