Analysis

  • max time kernel
    171s
  • max time network
    183s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    19-05-2024 22:00

General

  • Target

    ac2faf2543ec1c37816eb060a3f5e5138351e2a9519ac22de153f2f91eed54da.apk

  • Size

    517KB

  • MD5

    131d6f65932d2f25144b7447da1a8853

  • SHA1

    2e61768a05c7c18084b16d9e0afe04b988a069bc

  • SHA256

    ac2faf2543ec1c37816eb060a3f5e5138351e2a9519ac22de153f2f91eed54da

  • SHA512

    a0d4dc960db3674b560e5510e3bc0701fa3ef4c53a7bb32a00829810af6b615a4815df9c531b1f57743fe463d498014e78898dca6ac5bedb9613b62a59aebc3c

  • SSDEEP

    12288:YpnvbY+kxOfT/LdyUkMAGwkZGI32ZkzvSMPObI:2nvbdkxO7ByZ0NZGIIkzPWk

Malware Config

Extracted

Family

octo

C2

https://tabukareler.top/ZjM0NjUxNDM5MmVi/

https://tambanunakere.xyz/ZjM0NjUxNDM5MmVi/

https://fesatokero.top/ZjM0NjUxNDM5MmVi/

https://lemanobelki.xyz/ZjM0NjUxNDM5MmVi/

https://tutankamunhaci.top/ZjM0NjUxNDM5MmVi/

https://karakapkaraklpak.xyz/ZjM0NjUxNDM5MmVi/

https://buzbuzdagdaglari.top/ZjM0NjUxNDM5MmVi/

https://bilebilegndere.xyz/ZjM0NjUxNDM5MmVi/

https://saybyebyetohepiniz.xyz/ZjM0NjUxNDM5MmVi/

https://ruhumdnzincirr.top/ZjM0NjUxNDM5MmVi/

https://kefalmefaltefal.xyz/ZjM0NjUxNDM5MmVi/

https://gecelerisvdmpkiyasen.top/ZjM0NjUxNDM5MmVi/

https://kranliktaaradm.xyz/ZjM0NjUxNDM5MmVi/

https://yoktuhcfener.xyz/ZjM0NjUxNDM5MmVi/

https://dlounayyanimda.top/ZjM0NjUxNDM5MmVi/

https://izlemebskasiyla.xyz/ZjM0NjUxNDM5MmVi/

https://astralanahatarim.top/ZjM0NjUxNDM5MmVi/

https://anilardvrimi.xyz/ZjM0NjUxNDM5MmVi/

https://leardolordoloro.top/ZjM0NjUxNDM5MmVi/

https://hadikapanikapatsana.xyz/ZjM0NjUxNDM5MmVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.endbetween46
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5156

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.endbetween46/.qcom.endbetween46

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.endbetween46/cache/nkbkg

    Filesize

    450KB

    MD5

    49942b1e9ef99dd6efd7610e2f4887a9

    SHA1

    8bda7cb915aba3b7026d8438357444c2f17673f9

    SHA256

    ffb1d94e8619a2bc50279883c65bd06b3690e5dee35b24b4dd65ef73583ba3c4

    SHA512

    3f308dc3dd25ff82711749c5ef03c7c9ff73c6835ef4c527a699d75b5cafd11cce9c4f1619200bf9f72c7078a73053f6b601d6dea01f7ce1e98719bf6c4c7812

  • /data/data/com.endbetween46/cache/oat/nkbkg.cur.prof

    Filesize

    549B

    MD5

    fa5f09cf576fd4edb9f2ac5980ac7ce3

    SHA1

    4ea05de5b230ed801469ff17486e07ddeb31e6dc

    SHA256

    ddd093184227240b95296ac132ac9cecc483513c3d12075831124c07317a16f4

    SHA512

    0288fa178e379afd8b583fc9fd1f5779fc64160d0fa6eead82da8ea2c384a090a2f5e68a45f8d4a41627bacaf4df7ac5ec103ed1cd380ddd3ea41502168a7273

  • /data/data/com.endbetween46/kl.txt

    Filesize

    237B

    MD5

    6f21b0f51e200f8a1ba58d8039d200f9

    SHA1

    165b5f6d5beb7facc18a3a6dd28bf19ce763204d

    SHA256

    46b2f7a487da5be7492dd919e43b4d44971fe8f54b52ddbcfc5bffe74a8af01d

    SHA512

    5f6bf2a0c72edf1d9d78a8daab322c1cf3b5ec67227cce32546e7ebe9932b3e7c12b545bfbb185ff19c66c96f0c557b08fa99afb1d6d3fc7f6e7f751134d7a87

  • /data/data/com.endbetween46/kl.txt

    Filesize

    60B

    MD5

    285399c115ac3a56a1233d81025ca502

    SHA1

    0e460b9ae2b912404e9d3bd7363d8262cc14f003

    SHA256

    4f5b1244febcd770e2d5bf318e490c5548392aa2456850cdd412cb4fa48e09a4

    SHA512

    5fc71c40a1f68d028624ea98f27fa895aedcfd83cf7134e6660b5c333122f4933e308414ad114c6d10dac8c4a1ebbfc7ae135cdd28139f1dd0fbcd876605e712

  • /data/data/com.endbetween46/kl.txt

    Filesize

    68B

    MD5

    b2c4a7193bd019741da8485514127ead

    SHA1

    6c9f3e28526cba36316fff81904a5131c1e3c774

    SHA256

    4d362eac9e3445e605d5982053e85512ddf17f61a81ec466bdcd9cb825388d99

    SHA512

    da13fc62639f40ed5a638dd01b02058da2081d57b392f081448dca94bd4f793e7ed15e72ff013be37284fa31ed2d01b9eaf929f9ba4bb210ad69830a63fe401a

  • /data/data/com.endbetween46/kl.txt

    Filesize

    237B

    MD5

    fde35474bfc700447fa2306e6eacb89b

    SHA1

    e4a5449dcb33af6e947778f1727defa78d73c596

    SHA256

    5f2a959c4b09ae2bb14e35f30aa361dee80e533893c1c09e269e154017b493d3

    SHA512

    0c300e0a313360f0ee2ad07545e2618a3aa738ecc5b1f9c897dab94048df0ff7185b189995dc278ceaed7ca2d541786f471537219fc36d30d74c7cb1f4efc21b

  • /data/data/com.endbetween46/kl.txt

    Filesize

    437B

    MD5

    3b9e304da05b1d5cd7c404201c238487

    SHA1

    047f939d25408c81bd9e5b785c5d65534ef45ad7

    SHA256

    96ed2ebc068b8f324dee3ef02018cdfbdb8a3ce3e9af71365767911534ac82f2

    SHA512

    e18041c0aa182116938f1f55b4ff0344a02d7b55736d25227ca6591c81d2d746c77b42ace70ac22aeb60471835a3963ce951d2f22355a8ae99d7257e8eb73d8f