Analysis

  • max time kernel
    179s
  • max time network
    187s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    02/06/2024, 00:47

General

  • Target
    84f7c88715f7eba3052956b634af5e0332b011344567489e31b7b5f1c1acf1a5.apk
  • Size 521KB
  • Sample240602-a5py8ach4w
  • SHA256 84f7c88715f7eba3052956b634af5e0332b011344567489e31b7b5f1c1acf1a5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://juxleq.top/MjE2YTczY2MxNjA0/

  • https://fozkiv.xyz/MjE2YTczY2MxNjA0/

  • https://wemdap.top/MjE2YTczY2MxNjA0/

  • https://zupqel.xyz/MjE2YTczY2MxNjA0/

  • https://rizyat.top/MjE2YTczY2MxNjA0/

  • https://gikmuv.xyz/MjE2YTczY2MxNjA0/

  • https://xotpin.top/MjE2YTczY2MxNjA0/

  • https://werboq.xyz/MjE2YTczY2MxNjA0/

  • https://hudxap.top/MjE2YTczY2MxNjA0/

  • https://nevdiz.xyz/MjE2YTczY2MxNjA0/

  • https://kovjep.top/MjE2YTczY2MxNjA0/

  • https://yiqvux.xyz/MjE2YTczY2MxNjA0/

  • https://qowzef.top/MjE2YTczY2MxNjA0/

  • https://tupfij.xyz/MjE2YTczY2MxNjA0/

  • https://leoyuz.top/MjE2YTczY2MxNjA0/

  • https://xepmeq.xyz/MjE2YTczY2MxNjA0/

  • https://qidvob.top/MjE2YTczY2MxNjA0/

  • https://gufwap.xyz/MjE2YTczY2MxNjA0/

  • https://xulqir.top/MjE2YTczY2MxNjA0/

  • https://lupzod.xyz/MjE2YTczY2MxNjA0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.airtellql
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4630

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.airtellql

        • Path /data/user/0/com.airtellql/.qcom.airtellql
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        dmbgcypmavpl

        • Path /data/user/0/com.airtellql/cache/dmbgcypmavpl
        • Size 450KB
        • SHA256 505d2049a856697ce0d0ffcb24e92c33fce95b55bb195f902f3afecea417d869
        • MD5 SHA1 SHA512 SSDEEP

        dmbgcypmavpl.cur.prof

        • Path /data/user/0/com.airtellql/cache/oat/dmbgcypmavpl.cur.prof
        • Size 303B
        • SHA256 c0b6b1058282f88c2a75f204db7364ba9c829a47ad7a952fe7af591c4f2a6ae5
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 07e6aa15ffc188b18c0891cb4e856e204c2cb673e4f4de34692cde8c9dcb7c7a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 fd094440bca1114472dc75b7138d4b0d60c239794c26981ee7c3d3f8ba09a2af
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 f4288a95c917f2f2c0ca0f6e689bc05db3f026c2c87408a9ebf7fb98b8eed80c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 6f306454ae37dd1b6414068cba9eb4ab98560c9a97eb1b30d3813d96a54201e8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 00fe3e3aace28863398c9fb4ed34a5bfcbbbac9f2224eec522a451b45dc07fb5
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 29e51b1be896bca64f223aa67604c5b7a1fb3e36c6447fafb0a5a358ee6d29ab
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 e57292d642c0b830a5d8cf0459468f6cea3b5ac8075428b75ab892c916e80dff
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 e42f165d7532849ea3a3b12bb5a0c005b6332ed464032392be0b539f6971e260
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 d1c6547a60f9907f89be3839aed31b6a587ef411ace83ff5500e7effd7cc811f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 34804178777a1473ad2e2c8fca1f7ffae28e46dc4556736aa616c10a1fc51a49
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 a1f35f9885edcd25dcc28e688ee17f04b53f43a5f50d21340df5fe05bb77f3e9
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 1ad1bf330d5bb3f17969efaa1e364692e422ee99d432048cf3665d19337f7cb6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 e7b78ee899f6538fcb1dc122abc43c52ed94d4144b12cbb43ecbf1926eb091a9
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 6e605ebd5e5f64e425d03b339f40fcce0334081c097b2e5eec9010a643458cde
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 1c564bb64e819fb0c3fbbe0547d611a5e2fed39be8bc771f9a7f46ced067fe54
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 d17e2c0184e24ccd676f8241e38de5cca6de4e2c166d87a880e3ca9378e99a44
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 0f9a79c5b08c6f8b9485b069094de96315b5a064919fcb24fa1a641f5fc418fb
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 e66076d965e25ecfb62f77d9d9d0e38a491da33655d2d570931ffbf99a35ac34
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 12c716bc151884c778acd7184a610b15e1e5e59089de864053d73dfe7513bc45
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 a5de1261a511668400537b6cc313e98a089be00f513ac99881b799be8c7cd014
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 0e1fc6967dc3097f2f745c5176acb3900d770c1f35447b67d7844ca833450a4d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 bede4a1be2cefd3f41b4d622b0f2ae88df04266e24999d2ce0423f947647ec4c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 b88231d52175de239fc8aa092dca3441a2be0195969cc4f0dd3256c228e714d2
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 c1ccc0fb3359d9c227d826a3d9aabf93035342fb986a1069e05551e180189666
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 6b470679d9a346bb7746ce148df719a113bc70a9fb880d25d0b6c00b4cd07a6d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 f5483d7195cdd86fe7a55e27139fef9cf4e327e20d779aa0c4bd0a056f522b2c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 237B
        • SHA256 e78e7ece76593df8e16ac9738682cb33ca5dcb833729d7692d1327c02b56cc27
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 420c2eb00338295f93526bf248e57928a525560788e452a95034506135ebbab8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 b950683bb76c14486aad561990a9f722a5ef01ec38f22565261bc53658a95acd
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 f5a962402ee6462eff99847b928917bc3b88493ad95ef9ea5f447d2c8869e687
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 dd941ea7b6bf199b843df4dee41730f87515c21f6c0082fc65f5491908a2b3c9
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 4d2b9f0677c104b2fe687cd17e10d8ec8dfbd053b06279d97a32d6bf73ac5558
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 f426811c81b2d51aa1297369792bc833b339537f95514bb4318bcbfed4ca18c6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 a1eedbb4ca143df0980f06380ee5611f3f3d32ab2145fa6da159f735e8c7955d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 0473162ff98834e1fc1f6d25a10c1e2ebe915e7fbbc0e275f87cbdc401dd50a6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 7a695edf53f71f265f91d3cacc63fd1a088bc0dcdd9117b7965e15ffafc25067
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 50e313482fc106a22bba72a4b593c7f256f0fe04a002b2536b2caa1624f9d995
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 fd384af3eb944040b178bca58345789914f88cc51d0b7e287c5ecd50ab350f44
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 cee2526718c273fc0ae19e9ddb8f301a103e55ecc436e8fc14debbd5ab5b43dd
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 e727cdcb7f88c6336e77b3267db5cf4b478b15638599792edba74e2d2997c249
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 4641c2b0c02099584fbcabdde347b02a253437d5c801acbbae4d4f2aefd67929
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 93eba2e0e4aa66cc138ffd05851d156e7bf21913a9a24ae669f14831319d4287
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 108f089b3d958b8d8bf8af64d19b86f6033aa4e0a26c610b6e3a2274d8543493
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 cc4da4d4605869a7a2c814b757252612edc2236af519db826c9bbfb211e77195
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 21b2defe4982e63436449511ab7e728eb7573c4ddc9eadfe30c52cf323ee24ae
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 92d1b6f40f01e3da65923d96a23b30e9457617422853c800c302d36758d03b76
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 75B
        • SHA256 0347de3450759402131ccfceb5c9c21274f91ffdfe32ae6817979ecf4754539a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 4d1654847e43d3538159b0f4ae1bef9edc73da59cf0ac385f723ef4e178cfce4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 600a50e19910ad9b7552b459288f5975c738af82c692ce0be456984a8cefbd3b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 9dc5f2429186581a23f4e543b5ec2ca8018009e1bc8c6d9ba81ab469badbf64b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 74e8c3eea22342f1cf4d52bc1bd0f44b461697cbc1bd9a36f2a695b76f09331e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 6e1dd754f537de7813eee0e8a643c1d12c54b3c2f22f8bf226070cb0c7ed238b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 886d00fd47182700943ab61f29bc330094c3790df1bc1f9be311a6c4f76f61ac
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 899f3efa71dde9fe6f4435a2f1f57a632a3aa8ef25449d4fd539519a91700c82
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 bf2bac7adc311e13ba679548fd5ce816c0caf26f73930ffc2b4812fef7718726
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 45B
        • SHA256 46fe3c2736be828f387ace4ef9e4bb7b033066a587c2db6b1690ff66d603510b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 d46fe2ff4e9d36825b6d8b83e91f2ce1ad800f2a59ea7495f87c6272f0fd2703
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 269519882eb15ed39c36c55d0e0a9d1227a3a4ba10521b0ebe72c1f3531c633b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 5e6ed1f8da50edc67ad5eb3df8bcabe13c4c714cdcb89e0b94abc97d6d4f00d7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 68B
        • SHA256 7e441107336cd7d4c15bb174dfec3339aeebaa1594bfe8c3ec3e627cd601abf6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 76B
        • SHA256 592901bcdfc196096ea0c638b567a81b6a1a6c58504822e6d4dc9d3803f34804
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 c84dffd6077d0a343470bace1844c6bc74d4172835d8a47ef7dbcfc9f8a6d08c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 58B
        • SHA256 913b98f4ebcad7650b3c5031df9bada8a4507ba6641dfd93025bfc7a794d6891
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 480B
        • SHA256 487f841da15db3d9f1a8ce177de7e3a209d3cca30dfff1599578926164d3ec19
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.airtellql/kl.txt
        • Size 63B
        • SHA256 cfb2e6ae729627a313233c39aa5a87afa74e3dfecf3b000392313dfda11cb9e0
        • MD5 SHA1 SHA512