Resubmissions

03/05/2024, 05:42

240503-gd4fvsae7810

01/05/2024, 22:00

240501-1ww92sbb9710

Analysis

  • max time kernel
    155s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    01/05/2024, 22:00

General

  • Target
    d8d8131ee4a6a7c93bae3395cff2823a3f7855d5915b348ec683c601e64bb52e.apk
  • Size 509KB
  • Sample240501-1ww92sbb97
  • SHA256 d8d8131ee4a6a7c93bae3395cff2823a3f7855d5915b348ec683c601e64bb52e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://2adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://3adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://4adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://5adiletasarim.com/OTM5ZWJiZGQyNzJh/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

Processes

  • com.roundmuch38
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4430

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.roundmuch38

        • Path /data/user/0/com.roundmuch38/.qcom.roundmuch38
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        jhiusxkdek

        • Path /data/user/0/com.roundmuch38/cache/jhiusxkdek
        • Size 449KB
        • SHA256 00253d072599ead162eaf915cfa919da74ad6bb0c9c0a1c6740e07859aad2bd0
        • MD5 SHA1 SHA512 SSDEEP

        jhiusxkdek.cur.prof

        • Path /data/user/0/com.roundmuch38/cache/oat/jhiusxkdek.cur.prof
        • Size 294B
        • SHA256 f0b36468d250c463fc0731c96e63d8f8a6bff94e85b066388ebb9433be09a835
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 79B
        • SHA256 d4c169813b9a43c42e97be03b85eb1e56b71ce4f39487ccc881eb430738e0918
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 466B
        • SHA256 5e8c0f311dc44f83684f59da201005720f27430ab3a388794fb0d8e93b6fc10f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 54B
        • SHA256 6578bef88c7eda88527771191f72009837c9d7d9b859d0398ae56cbfd6d8c344
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 68B
        • SHA256 55fd5fb21db23e7d1af65f0143df5abfb557dd57d9e6792e26414616fdb8dada
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 c11c78ef9e5957371f139a7565d08af7b16627f089bb1e87dffc1a1c00de8cb7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 66B
        • SHA256 4d71045833795d897c4d8567fa3207e006ccbeab0357596fab61fc8c14b7ddee
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 d48be49cdac27c3ce7da25cacc5c55c15e67de6cc66d4a9e5af2bc042fcc874a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 84B
        • SHA256 6493449cb7e1b39efc50fddf73091a5a55d3937b2a2cc3418effde98f2a41568
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 68B
        • SHA256 5a8bb1eae2d220981224ef4c87d6d3bf98c85c3e4eac743b81adf2a428f5843d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 68B
        • SHA256 091afa3082570423245b61f847de98911ca62c72ce9aff66e8e75afd03f84c44
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 8403982e53333554c6aa37a989bac98da1fcb90a64a449837d9b097d0a9777ac
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 58B
        • SHA256 32ebfb2c821a0ec76c12a569731d747afab6aadc16e22c87edc03125e527b769
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 230B
        • SHA256 e35ba6ff5910c5c584c80c80d6a8e31a4ecc72e84de7138720cf7a1a51a48127
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 a2df40ae3ee46368666853dff98c540d5ad526a3f6005efbab2b4fb40b7ed017
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 68B
        • SHA256 4cb4119068a51dfff43243818fc4a9a83fe6b80d405ab3f47902248c619d4ac3
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 cac5186567e8ebae27473f68f1840ca074fece3bfda6b80abf94df0caec14ca5
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 db819dbcbd8d06491a34e65b7f7e3d34704ca11d034bcf997a59ce435cc671ff
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 0c93b779b8b0b9d49f437bef0df6dd2d29422f352249188aeaa0d778d279ee6c
        • MD5 SHA1 SHA512