Analysis
-
max time kernel
149s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
20/09/2024, 22:12
General
-
Target
3463bba03f7462cf23da29831ce69643a895c0925b3bf46a596e99f92020485d.apk
-
Size
4.8MB
-
MD5
db81b2219bdfb926428a8186b7d2ea56
-
SHA1
83f36d09723151c1480361cdf1c57dd24aff0bdd
-
SHA256
3463bba03f7462cf23da29831ce69643a895c0925b3bf46a596e99f92020485d
-
SHA512
7c15df9fcf38e605cf147b4ef65acf0dc1063d2f6ba5ac92f1a842197fd0ddd714dc7e6d0e5a75ae4d22a6f16e7d26e5d0ec8518e10411751c0afbd2a5130d76
-
SSDEEP
98304:N+M/s+sJjmALGRiUXb1MK+bemf6wsbHok1Vm7z6oNNsV1OUmT+DEHAytd0EZLFk:Mh+2pizXRM5LNJgnoQPO7K5ac
Malware Config
Extracted
nexus
http://109.206.243.54
http://109.206.243.55
Signatures
-
Nexus
Nexus is an Android banking trojan related to the SOVA banking trojan.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 21 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.machine.easily1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD566847dd8909c63e501f5accb10f603da
SHA15b6c9f9d331930f62c9ce153899869929693a8b0
SHA256c0d4c929866bcbf89bcc243561f9f3d8501ecb28aa7cb3dffcf5d401f0c0d64a
SHA51268722fffa54d8ae523182ec9af8457996bd8d07bba1cee097d9ffc6ee3f4b8542bf8d7a7529c7c91eddd792fec7282b9ceab2006ae19b716c554c6b0dcfe0033
-
Filesize
2.2MB
MD5359ac4212288a3b52589868734d75fb0
SHA10fab0b48260b1acc7aab74fcc9bfa0d0302a2292
SHA256c91eeac469d2f41f06659edda118f739b44d2b10321dc7d294c77fe4846815f8
SHA51206b61216ab1bb43d3b4aae2f26062ef7987a4c128b493f5b93f224cf2dd063760c40b21bed0b1e5046f4e416bce86d5f312304bbd663b01f73a603e6dfd4fe9f
-
Filesize
5KB
MD50506d386433f18dfb3ef0d03f33a33c2
SHA192e54532de0e26edf6a0926e18c2b2455216cc92
SHA2567edcc98c52c501d4ade6742790d461063b7bc108c42d44818128b6fc364e8919
SHA512f4de9e5439b2e86b3352b9829999be0ccbfdc15ec33d8e87ef018d6f7481d3148d3ada96d12c391ead09a804fb5e21d18970ff2b119e01adaf2923b61bdbdf14
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD52f86a417ab67936332e360d09ed51d7a
SHA10ed9e2e6752c9c5c12f798f74fb2d4307bea673e
SHA256529911a2445d63f66ad9eecd4295361482952c580a89b3515765042ed741178b
SHA512879b6b44fc4d77ab5e281e959a89984a401bca86c7b83988d9648b2a42a2ba73abebbaf4ea85b4872d55da529d4f93f21f02b2fb8bf66cdbe85b9438bd1363ee
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d99385fe600f9fc9fa85bf81104e16c5
SHA1f8fdebd3ccf485f2259d17365327a0c29dc905b0
SHA2564af0404c3753ad5d4ed8fcbfb14bfc27406eab537386ef05e9f70fb2e1045917
SHA5125836d1184cedc5ccf62a2e49c88f65eb948b6cc24c056ecc216d04feebcea94bae14f90304051040337ef41e576ced60a2f78c2975cbb44e0eec7e26e8c24707
-
Filesize
108KB
MD5d8708cea352a6214c1db201c9a3599d3
SHA1b6072a9fb887d05afddfe209e2115f093eb60d97
SHA256d20d96ea71e13f3583b3edcc24252920294b28d8d0c07c23823e2cb4810221be
SHA512058c19e6f66e83486c72534b441b05f48f8818b69f9cbd19dd881406378cc8ab49babbe1f529712f39335e9077b2b3d7e01c22497203934e2064570081a4e991
-
Filesize
221KB
MD5602458126b1dda2fc767b44d5f2f91b6
SHA17ae855114bc65488423dc838abc31c411471c85f
SHA256a848d526028c36a1074fa8e86dd0ed2a10581d9209fdfadb33e25d0b10ea5264
SHA512c81e081c72373ed29732dd16b0d5cf131c7b11656252a9f038831d484f13b49537597e141c8f8cce6fdc6b973ee2faed9cb4b3bb9887b4735facfa4f03b54eb1
-
Filesize
6.1MB
MD50c1db3674754c44e368139d9563a5632
SHA1f14d6c43da9158fbb817a7becd460897f8ad483e
SHA256cd7e5696a7eae1f69df25d0617dc87696880ebf83a64cd1920cb4051e5e30c8a
SHA512252d15da07d538b4cd6dcc3f91b00770e71af6762b3337800f43f9da2afc59381e626704ea3d62ba43eab0d60a99c4f6930daeae017860aeec1be76f5a52307d