Resubmissions

03/05/2024, 05:43

240503-geq7xsaf22 10

25/04/2024, 22:02

240425-1xv4dafg44 10

Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    03/05/2024, 05:43

General

  • Target

    271fd489f0dc6eb0c888acbd9adbffdd0eb86fab8de213e50560b0ab749b6a9a.apk

  • Size

    221KB

  • MD5

    679f82be2bba91de8b46f9a539063906

  • SHA1

    c0f0e2aed5d78ccd9f8ed704834dda4665751c38

  • SHA256

    271fd489f0dc6eb0c888acbd9adbffdd0eb86fab8de213e50560b0ab749b6a9a

  • SHA512

    ff825e4943556b300440a5db3879d4036e903797f843de5a3983b8351c6466c64d20ae5c1b787ad7486aa22835e8ca869ad59029db1ae8d63de93a2d1a2ee2fe

  • SSDEEP

    3072:hWBLOr1rfHzoXPlkSldHa4TMEmSDaivg73E+IXiKu0RzMqI0/30KnEvNSdvZ:EMfT+l7HayMEY2+mCj0/EuGSP

Malware Config

Extracted

Family

octo

C2

https://filomarinakiraci.top/ZDQyN2NmOGEzOTlk/

https://cannakliyat.top/ZDQyN2NmOGEzOTlk/

https://uzaktasimaatasehir.xyz/ZDQyN2NmOGEzOTlk/

https://kopekuyuztedavicisi.xyz/ZDQyN2NmOGEzOTlk/

https://hayvanyemekveriyoruz.top/ZDQyN2NmOGEzOTlk/

https://topcularaktaricisisedat.shop/ZDQyN2NmOGEzOTlk/

https://evcilkusbesleme.shop/ZDQyN2NmOGEzOTlk/

https://verdilerbizeikiadam.shop/ZDQyN2NmOGEzOTlk/

https://tokaxtliahmetmotorcukuryesi.top/ZDQyN2NmOGEzOTlk/

https://arackiralamacankiri.com/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5098

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    890416bb396bcabe229d79e42d612683

    SHA1

    84cb4553cdec15831c55fbce5fcf1e9213bc3a24

    SHA256

    d82f2007faff72ac40cb6d2e087173a9a198fb8cb67139b474bdeac991f4a33c

    SHA512

    11b5e92cf170c956b03d6ee25786e5ff6eda214dc452cf8bb3c8840d1b009d40f1232127e195d7cf28722484c1b21491538522b88c0c0f6b7a8f065c9c89b4bf

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    bf85817ea4fd561fc6ffedd64b5d7494

    SHA1

    93a972cd86a8d1d7dcf4dca93769122745ba40d8

    SHA256

    2ee5541221526c3dd2940e9a87a5dcb996263fc7b37028c60b6b926a60a34f6e

    SHA512

    6addc4b907074c741d3981d970bfe7803b2bd9123eedfb0a75e5060322cb91721b80dec3e7e28fc598776ea44cb4938469f052367986474aa8c2026b7bcf3670

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    3257d1283729091d9f435472978c0cb0

    SHA1

    f7db3e0a0feec5a90a0649fc45be40b57f51e482

    SHA256

    3896c8e4ca7519c1fb75b21ae325bcc11fc800f4879e52aead0409f3906e7627

    SHA512

    de9feb9fc7a4f5889eff113f7bbd43ea97116076479f12ffe57a1bde0f5639ebb94a58c8d18b3728656233d54fb79873100bc13be8b4fa877d607186f3bc9331

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    e1dd7efae9c467a25b7e0bc26d7c6168

    SHA1

    88809f024d30e3d74a2dbb19f8e6793af4233916

    SHA256

    7abbb99f14012f265706da52327e85c4c94a63098f992c4eb83d7fba44d31847

    SHA512

    c795e937f82be0342c1dd012db33ba8ded098f1986d7682bd7389f2dc75a78912344c461d43283faab3585d5d57c7dd3c13cc5c44f798d35ac5a70b1cbca1aae

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    b065efd89772c4f6ff6529a7cd945e0a

    SHA1

    e52a2c6d21d66266133a6650524b8640c07d67d7

    SHA256

    ac8953a38b9fece9d2f1e514ce3f1129afc0b8fcf6966bfaa62b8c029986c989

    SHA512

    4626124504cbd081774843b74f5705db110c487ba81ff7a70e0d551afbc389d1e63c876e761b19c95ec9d9d2eb8076b59e2ac770d642bf7c03ac45682f916f74