Analysis
-
max time kernel
27s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
29/08/2024, 22:06
General
-
Target
1db47973bca9f92224b2f5976541c967cb0b2bdff04a66a700db8201d7aa5128.apk
-
Size
4.7MB
-
MD5
bd848a07e2988d7c58669292d09f311f
-
SHA1
975146d6d6042e55a555346f25b870ef51662e83
-
SHA256
1db47973bca9f92224b2f5976541c967cb0b2bdff04a66a700db8201d7aa5128
-
SHA512
9887967f1194cc28b37ed771fa2f400922a89322274434dde805fd915eae5a9711efe1abb12a27cb8705f94837e9685b3cdb620cac944a20a45dab6734125bc8
-
SSDEEP
98304:D6fO6TBKEgRoMHNdcCKYeufeAnjUT/nUlF3nYM5G2Ndup0Ni40g0SpLxNc:+fOCKnjNOC7fTnjUjUl9YMIEupBZr
Malware Config
Extracted
nexus
http://85.217.144.111/
Signatures
-
Nexus
Nexus is an Android banking trojan related to the SOVA banking trojan.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fault.junior1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Reads the contacts stored on the device.
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD595c111d4533692543648fa432e7eaf8b
SHA1e9b6057ab6eaa03bd6a8e47fc44e7a2b5132bb72
SHA25613add8de3f6a709080a26836cf66d54d32d2dd9d125105d2722d5ee13969ebab
SHA5120438aa4e05dd80c81af9b4b90e6772ce5351ccff350608de0c059dbb0f50cac9f209113941f3abce9e7e825c1115d872ec2580b47180a435e3f1c8bfd3015624
-
Filesize
2.2MB
MD564c4734a59f2cae419697863e8e5228b
SHA1477d2341f20d8f53c68914db4810418941b4b0c4
SHA2563a636e0b6cd67e825fd07d0503e850a25cdaea5b89ae1a24282b8f97e5341660
SHA512480578f51af0036b0c149ffaf57861103461e183d3d23f49c9a4ae658d93cf7bf202db2762565599904b1f97851ece4018f7b05f57cb43af21e5d92dab335e51
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5aadc7ab32abd49bbb51d24b2fa9f7cb8
SHA109a235882aa381078e50238dea19c4cabf8c179f
SHA2561b20e6d2eb5512a500770399a327b7f9bbef03e41eb2f1594dbcfd862f5884de
SHA51277c90bb1a710daa99480ca6603ece942c74e7e53b33662ee35ea88845aa93c3b7b39858ea194de11166d2d8c045f2a7a4b9bfbb1827791b2a82a77a9a97cf602
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD555206e41bab4342bbd85b90f116c96bc
SHA1c9040913ba63d97cb8911aa9478fa0dc2b12fdf9
SHA256017e134dcf39d16489db849c5a2dfa0414c4ccb06b2bd24e7c544285e95f4572
SHA512ff5e15d69e641d999bd6414d1e150a1cb24876660d990f8392627edf5c20585907cbb31adcfcb4d27c2631b0954a065494c257e18b4082c56b6ae0187fe24b76
-
Filesize
108KB
MD55c0e08cdf2667c4f5d467f7e8dc34f0c
SHA1b0c08e6373a2123eea3b7a2fec2fcc0ed445d96b
SHA2560922b411b0928018286792f382945d1c985afdccd5452b20c18b3ff2afbf9e08
SHA5123d9d1c61f8cde4eb6ee75b84eb4eaa8f1594c0f3e71484f5638dabf36a7a12d2ffd03d636fa75d1badcf134a78e0987e28272f8d5064d97b9e424bf7522731a5
-
Filesize
229KB
MD554c585ca401887cbc89d728fc63e7e81
SHA1be66d3cddaf77735ead704620e4fce8b3c0350f8
SHA2564f49d063f83b060a89b9dbe10cf2e81fd76e6e823c97b3cb7183214e9f4ef9dd
SHA5120b4e64ad77f755b3d616db712aa2e6d31175bfcd8d2a4f7e650b2356d2269b202ed2e1b8149b58fd280d617b4a9efeea8aa6de24a1723f4fe42826f2b82a94e7
-
Filesize
6.1MB
MD584cbe9376e34550c1c7aaf8dc1f651f4
SHA1ede6b527a761edbaf37f11d0e71caf8ae3039ba5
SHA25636b8ad0bbf2458fdae9743cb87a2c9dbcef990581c90fba7566ebe414c31e210
SHA512b8b96e77e77ea4803b9bdb27ed685d44878ea4fd2ab35abc9dbede3b0028e60d38c989448fe6377613684b85361f8ee38ad7ba58d379b608cc33ed325fd49530