Overview

overview

10

Static

static

10

9146e0ede1...f9.apk

android-9-x86

8

9146e0ede1...f9.apk

android-13-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    10-04-2024 12:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9146e0ede1c0e9014341ef0859ca62d230bea5d6535d800591a796e8dfe1dff9.apk

  • Size

    2.9MB

  • MD5

    5ef94cbc5a182cba6d65ec6884e98a21

  • SHA1

    4f8145805eec0c4d8fc32b020744d4f3f1e39ccb

  • SHA256

    9146e0ede1c0e9014341ef0859ca62d230bea5d6535d800591a796e8dfe1dff9

  • SHA512

    ed8ce47c881bcb456026c5827fc5b9aeb9a412d709e5b9a60e247b9fc041a62ad7e29980007cfa5f960375960924901e95fef9d2d8d0f8a86d4c57ba2f68f90c

  • SSDEEP

    49152:CCSq3bA25W0D04emo5SvbDuQmYs6uRMA7QqywT0EdyqDVpZfVJQ:5j3/I42SDFmLQLkzDVpfu

Score
8/10
bankercollectiondiscoveryevasionpersistence

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
    bankerdiscovery
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscovery
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about running processes on the device. 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion

Processes

  • com.androidservices.support
    1⤵
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Makes use of the framework's foreground persistence service
    • Queries information about running processes on the device.
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.androidservices.support/databases/com.google.android.datatransport.events
    Filesize

    40KB

    MD5

    571112758fefc013ca64f73bc959a009

    SHA1

    64b3e995d49a74c647cb467f54fc72c28c5af3bf

    SHA256

    632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2

    SHA512

    ce75b2bf73c4fd98b5391cf39610260fc90a91a7e85388c6074fe7b21f8b54eb88a0d0ce83a3403b496bcaf885deceab36daaae18976dc1f18fa4dd0605e2e34

    Download Submit
  • /data/user/0/com.androidservices.support/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    91f12f631499736cde232ccefb9be486

    SHA1

    55417b747c1e4e274dce256d858392d8a2f94f7d

    SHA256

    833b4c12387bc7b1984fa797cea414153f0bf94f3ff9f685bbc91647d1b978e8

    SHA512

    07650e10ce1792a0526cbee5d34d09e0d638c008eb50519b9e696245626749b29fb5bc162f1dfce0a4255a6f8ea7d300a6fbf3a50fa1075f842e2982afea9d8d

    Download Submit
  • /data/user/0/com.androidservices.support/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    e03ab6746d9adcba23854feab9eb753a

    SHA1

    a20530f8b598d68019775fb9dfa4ab46c694cf80

    SHA256

    52955f516069d8fc97edd3581357a77ac8eff519cccc5ad24e7b48a630085c85

    SHA512

    4d7c4426f4fbc1656f40759232c028771aeaa23a817e24f14834d2f89d833d8b88c54306f8dab2b4582a0bc519678a6c01818859cc267a55e27be11ae7a48a55

    Download Submit
  • /data/user/0/com.androidservices.support/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    d9ffe05bc7dc8cc06b8e7a7dbcb53932

    SHA1

    29d689f300fe478725a3f53374ab571a74411a26

    SHA256

    0eaed72daff21d71f5da274f4e668492aba6ea6a777f4e0988cd165fb45c3388

    SHA512

    4122bad9c0a66ddf19e2136493512a4c83aaf4fd710b006c278072021127a7f5987c94865cfcee093829eb71a906f498e87a40d844b0fee7ffbf3a8385a8a037

    Download Submit
  • /data/user/0/com.androidservices.support/files/PersistedInstallation3099130402111054742tmp
    Filesize

    114B

    MD5

    a3b8e11ea2d9997eeb4af4ec0852c543

    SHA1

    1be6c78b1df8ddf33eef9a789bba5ed64211e99b

    SHA256

    fc8e92165127d64127bcbb6829a224e301df48f6d2cad9a8f8d9078bcb188d88

    SHA512

    039bdf0b002a961257ab52016289f54ee705a2dce290c1c6dccb2517328c84198e53111f82904bdf19b75748c7dbf7a069d6cce092c293a475ccccd9a23e9899

    Download Submit
  • /data/user/0/com.androidservices.support/files/PersistedInstallation6110078537064981169tmp
    Filesize

    90B

    MD5

    7a5ff13a79c20a9f05e337423a9c12fa

    SHA1

    f70448d8d21d217dde4dd7ef3f4e3c65a16acd87

    SHA256

    6fa2fa24e2bb811a221aa525055878f9862c64548775ed30d6490e85d7302bbd

    SHA512

    d494b692ce2b5254b8f8d727c52110c13ff1ae6bb7690a8beadd637ec0b3995dad50dad4fb736e034ac1ab07bb6267d7314f8926e626bed95e2ae083070c7bd2

    Download Submit