Malware Analysis Report

2024-07-28 12:03

Sample ID 240612-nlkgaawfrq
Target instagram.apk
SHA256 22863248801a28d8312ba09fac50a3a9eacddeaf39e1a6fb05e09c8351f81094
Tags
airavat banker collection credential_access discovery evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22863248801a28d8312ba09fac50a3a9eacddeaf39e1a6fb05e09c8351f81094

Threat Level: Known bad

The file instagram.apk was found to be: Known bad.

Malicious Activity Summary

airavat banker collection credential_access discovery evasion persistence

Airavat family

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests dangerous framework permissions

Declares services with permission to bind to the system

Requests enabling of the accessibility settings.

Requests accessing notifications (often used to intercept notifications before users become aware).

Queries information about active data network

Declares broadcast receivers with permission to handle system events

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-12 11:29

Signatures

Airavat family

airavat

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 11:29

Reported

2024-06-12 11:35

Platform

android-x86-arm-20240611.1-en

Max time kernel

331s

Max time network

336s

Command Line

sigma.male

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /data/local/bin/su N/A N/A
N/A /system/bin/failsafe/su N/A N/A
N/A /data/local/su N/A N/A
N/A /system/app/Superuser.apk N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A
N/A /data/local/xbin/su N/A N/A
N/A /system/xbin/su N/A N/A
N/A /system/sd/xbin/su N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

sigma.male

ls /data/local/tmp

id

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.202:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 research-model-8ad6b-default-rtdb.europe-west1.firebasedatabase.app udp
US 34.107.226.223:443 research-model-8ad6b-default-rtdb.europe-west1.firebasedatabase.app tcp
US 1.1.1.1:53 instagram.com udp
GB 163.70.147.174:443 instagram.com tcp
US 1.1.1.1:53 www.instagram.com udp
GB 157.240.214.174:443 www.instagram.com tcp
US 1.1.1.1:53 static.cdninstagram.com udp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
GB 163.70.151.63:443 static.cdninstagram.com tcp
US 1.1.1.1:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 graphql.instagram.com udp
GB 157.240.221.63:443 graphql.instagram.com tcp
US 1.1.1.1:53 firebasestorage.googleapis.com udp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp
US 1.1.1.1:53 www.instagram.com udp
GB 163.70.147.174:443 www.instagram.com tcp
GB 172.217.16.234:443 firebasestorage.googleapis.com tcp
GB 142.250.179.227:80 tcp
GB 142.250.200.36:443 tcp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp
GB 142.250.178.2:443 tcp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp
GB 216.58.201.99:443 tcp
GB 142.250.180.14:443 tcp
GB 216.58.201.99:443 tcp
GB 142.250.180.14:443 tcp
GB 216.58.201.99:443 tcp
GB 216.58.201.99:443 tcp
GB 172.217.169.10:443 firebasestorage.googleapis.com tcp

Files

/data/data/sigma.male/app_sslcache/research-model-8ad6b-default-rtdb.europe-west1.firebasedatabase.app.443

MD5 7076cb46257d30e8fae6d61156bf8260
SHA1 dbc762cc2d93dd78a0db2296360fb405d05e4105
SHA256 6ecda3af994e617026bc6e3fe3aa1fa5f63eac71c1d4ced513bae56e126629e2
SHA512 9028112ec3cd97fe6732051f218af1114eeaa46dd28d4198fe21410e3c79aed824e4c460f57c7720ef8448158be22391ab29b8bbb7182495cb02c07d8b49bfdf

/storage/emulated/0/Android/data/sigma.male/files/uid.txt

MD5 483d6aec1627aaebcd0e193150aa1c9b
SHA1 a45b9bafeaaaa0b60d615808346c1266acfcfa6a
SHA256 e69eb9aa12a44851f08a9bea38d4a974375b4ab798c6dd7f0a6d64f8ad2d133e
SHA512 f809cf60240cbd5a3045741778502e1d26d5b6c010a5ffc6cb13c224673b8f967bfbc0618b04b536127789d6d426ddcbcee15467931e7cb5acdfecc5003c0b6d

/storage/emulated/0/Android/data/sigma.male/files/panel.txt

MD5 6e0075dcc0b7ac222bea767743b61a33
SHA1 44b3eaebc17568ca6e120747fef61521137068d9
SHA256 d0d1b610858419980e61586967769ed1bf001756aacbd5e00518b3b0eb83a402
SHA512 9950d09e464f74889ae85d70e72e57197b8a2713518bb7901b2c7b6e1ae51dc7e53547b2865f0226bfcc3bd5ea530453298512f8ecbc7b790da3339b5e05cf42

/storage/emulated/0/Android/data/sigma.male/files/sms.html

MD5 f020935d9c20a6b6124e5153320e6a94
SHA1 ff4c83d7b71b28b22447705fdf9a09438d3d78ca
SHA256 a4242868f6c807f86ff403988b7ac8d302cfc847ae9addef4dafa780dcd950ff
SHA512 4a4d097b74f5036685512452b730ec720cd84ad6e1ab1afdc71dd05caa22bd0f1572226d42c6547738554be66ad55a35b3e8c466adbcc50f81b258d907218942

/storage/emulated/0/Android/data/sigma.male/files/apps.html

MD5 65be3a283d73f7ebb9728d1717040190
SHA1 aa7f9d4cbf24575bc567205f6ee5e2e1eb87173c
SHA256 fe20366769794dd3d74697801cb16da53e4b90a67933bc17f3da98c8c586211a
SHA512 106f9084afb96c61bf5a425d8775b5d3f317ffbfcf1cd06fe51ab12411a0f47af90573a7c173879307d0004bd6de470244bdd7c8b1a7c2ddac72c5bdb7428bee