Overview

overview

10

Static

static

6

1db47973bc...28.apk

android-9-x86

10

1db47973bc...28.apk

android-10-x64

10

1db47973bc...28.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    186s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    29/08/2024, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1db47973bca9f92224b2f5976541c967cb0b2bdff04a66a700db8201d7aa5128.apk

  • Size

    4.7MB

  • MD5

    bd848a07e2988d7c58669292d09f311f

  • SHA1

    975146d6d6042e55a555346f25b870ef51662e83

  • SHA256

    1db47973bca9f92224b2f5976541c967cb0b2bdff04a66a700db8201d7aa5128

  • SHA512

    9887967f1194cc28b37ed771fa2f400922a89322274434dde805fd915eae5a9711efe1abb12a27cb8705f94837e9685b3cdb620cac944a20a45dab6734125bc8

  • SSDEEP

    98304:D6fO6TBKEgRoMHNdcCKYeufeAnjUT/nUlF3nYM5G2Ndup0Ni40g0SpLxNc:+fOCKnjNOC7fTnjUjUl9YMIEupBZr

Score
10/10
nexusbankercollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

nexus

C2

http://85.217.144.111/

Signatures

  • Nexus

    Nexus is an Android banking trojan related to the SOVA banking trojan.

    bankertrojaninfostealernexus
  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
    stealthtrojanevasion
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 12 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.fault.junior
    1⤵
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries account information for other applications stored on the device
    • Reads the contacts stored on the device.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4257
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.fault.junior/app_DynamicOptDex/FQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.fault.junior/app_DynamicOptDex/oat/x86/FQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

3
T1633

System Checks

3
T1633.001

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

Contact List

1
T1636.003

Screen Capture

1
T1513

Stored Application Data

1
T1409

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fault.junior/app_DynamicOptDex/FQ.json
    Filesize

    2.2MB

    MD5

    95c111d4533692543648fa432e7eaf8b

    SHA1

    e9b6057ab6eaa03bd6a8e47fc44e7a2b5132bb72

    SHA256

    13add8de3f6a709080a26836cf66d54d32d2dd9d125105d2722d5ee13969ebab

    SHA512

    0438aa4e05dd80c81af9b4b90e6772ce5351ccff350608de0c059dbb0f50cac9f209113941f3abce9e7e825c1115d872ec2580b47180a435e3f1c8bfd3015624

    Download Submit

  • /data/data/com.fault.junior/app_DynamicOptDex/FQ.json
    Filesize

    2.2MB

    MD5

    64c4734a59f2cae419697863e8e5228b

    SHA1

    477d2341f20d8f53c68914db4810418941b4b0c4

    SHA256

    3a636e0b6cd67e825fd07d0503e850a25cdaea5b89ae1a24282b8f97e5341660

    SHA512

    480578f51af0036b0c149ffaf57861103461e183d3d23f49c9a4ae658d93cf7bf202db2762565599904b1f97851ece4018f7b05f57cb43af21e5d92dab335e51

    Download Submit

  • /data/data/com.fault.junior/app_DynamicOptDex/oat/FQ.json.cur.prof
    Filesize

    2KB

    MD5

    48f0a33595b7884ee3891f345ffb2dfb

    SHA1

    440bfc0704151d5ec3405cf0d4491b0e967ac4ca

    SHA256

    e23cdbe2b9f67eaf16cb71a7f614e87893c23e1e8e01f39b78fbd3cbfa083299

    SHA512

    74c862dc7f5cb8e36364cef4e08d6314aef6b70b36f99f9cd0571501bb9ae8985229b8a724b5ec984970c4d60e77b8976c438e145a2f6c2c7e30ae23e12c580f

    Download Submit

  • /data/data/com.fault.junior/app_DynamicOptDex/oat/FQ.json.cur.prof
    Filesize

    2KB

    MD5

    2ef7b3d5a10679e033910778b242923c

    SHA1

    737a37895511e8aa2d29a7a07b3667d4bde60ab1

    SHA256

    f35197c8ec54f1d7d97d956cf86fa05ddd3f236e7d4641e2f4e876a0903d6ddf

    SHA512

    1772b91578ca7e3b6cab87953904b4f53d50e3889423730dfc816b6bcc8eba23db57312ea1dc58cac4c9f51419afbcf7bd83446c1bfb205f187994dae376bcbd

    Download Submit

  • /data/data/com.fault.junior/app_DynamicOptDex/oat/FQ.json.cur.prof
    Filesize

    2KB

    MD5

    77b096d53bf4fbffe0d9922b7ee054fe

    SHA1

    1f424cd2a445cbc0386ffe891dab28ff5d83fc56

    SHA256

    42ec24c80f828b1c0e1cdcc12d42ce74377ab29eeddadc50fb28d1f62f760361

    SHA512

    ece1def53579797df91bc3897098fc68cdaa00ca465baed5013aa449fa0b724b2820f7c22f55b3049c6f42682e7bcaa5c20b4694275b890969f48065cd71cd8d

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    e3b870e3755a361843c02b7d558a501f

    SHA1

    2fa165b07b599516d71f223326ebe9ffdda99929

    SHA256

    4d3a703b21754534c2a169a11ad9de0aa5d91c00502f85de412704a36d834ca9

    SHA512

    9bdcba364d3e14ed6dbc0fc30da703054a7e6b1f59cc722ddb4435df15d6b11609a2d69074c22533461dccddcf6ee20d2a0aa022d365fb3d3adb5d417b83b016

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    cba9b1518d84578b0d04ad2b269dbb5f

    SHA1

    b9f4817dadafd7d26a8c17e75b8285a8bd0bdbe6

    SHA256

    08264d6b92535e3a932ca1a17d0dcfd57ba53662aca7fbc6de2459ebf75de4f0

    SHA512

    d33e7280828580c0ba381abf0170b5f48a88fb4249831925f9f6a9f8410027629f7b6c9d01e278c6b692d2c712dc6402ca0559de42e63bd0c8988ed658dc437a

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb-wal
    Filesize

    229KB

    MD5

    fc53494944e5ec9ed13a35cca35cab65

    SHA1

    acf97e74c85ddd5617337d0aaa1a648b66e1307c

    SHA256

    744bd0213b0bce8ee0b9d999f530270f09ef6412d27cdf059ae55757015c4229

    SHA512

    a2b949cb7f310febfa9a92320d77fe45690e2007d8e22e503e3d2403d7129abb908a0406e94920309fae551a7a2343abeca522eb318ba89325e9bb4fc1bf431c

    Download Submit

  • /data/data/com.fault.junior/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    087483c6513a57b3db322e4b807b26cd

    SHA1

    b9d74bf2283d5286ef2e329a9e44df6a58d060d3

    SHA256

    799d2f2847e28c491529bf3a3fe5d6c617c555ac2904da3b3f2efa46d62670f5

    SHA512

    9fd404a6fb371ac161f229da87d241756ee076792775675503b3642dc51fa14ad5d0779c4bb87062b44e374e998d64cfc66f09796897a6d0e239574d07b72cad

    Download Submit

  • /data/user/0/com.fault.junior/app_DynamicOptDex/FQ.json
    Filesize

    6.1MB

    MD5

    e8882a355ca2c888db5726dce810671c

    SHA1

    33d9fc1a3e5818ae2456e406fe7242d5f031b357

    SHA256

    2836305d778bac3e7e0221282da754423a4158a0d5a66eba6550d5ef8c203388

    SHA512

    43852548d2afe22087765efb21d9a0c74cdfb56468a4b0b644290a23d243f5a1261a24a60f6fe16d73efe0b715e3b6b6676ff71017c3d115bd916e90f5d60a76

    Download Submit

  • /data/user/0/com.fault.junior/app_DynamicOptDex/FQ.json
    Filesize

    6.1MB

    MD5

    84cbe9376e34550c1c7aaf8dc1f651f4

    SHA1

    ede6b527a761edbaf37f11d0e71caf8ae3039ba5

    SHA256

    36b8ad0bbf2458fdae9743cb87a2c9dbcef990581c90fba7566ebe414c31e210

    SHA512

    b8b96e77e77ea4803b9bdb27ed685d44878ea4fd2ab35abc9dbede3b0028e60d38c989448fe6377613684b85361f8ee38ad7ba58d379b608cc33ed325fd49530

    Download Submit