Resubmissions

17-10-2024 06:15

241017-gzygqswajc 10

08-10-2024 15:05

241008-sf5x9ascnk 10

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    08-10-2024 15:05

General

  • Target

    a38001f2d8f3c817f3579e676dd57dd0826bc7e07ab9c64fe279918da9a49374.apk

  • Size

    7.6MB

  • MD5

    b8411f981726df894bd3be20fc905be3

  • SHA1

    91a1455e833505c864c7911524a2d92bb66f6de8

  • SHA256

    a38001f2d8f3c817f3579e676dd57dd0826bc7e07ab9c64fe279918da9a49374

  • SHA512

    4006968afe1de57608235e18d2373f19374b9c2270f9d440d3f4607bdd19ce12215afd9e513d6128ff694fa9c991d3b94f7ca184f17b429bf0bee61f2120780d

  • SSDEEP

    98304:MElSb73N1O86wj7KRstD399zlZVKLnc/9/5iSRG0gVpsk:MBRNj7KRm99zXUrwxrW9

Malware Config

Extracted

Family

octo

C2

https://aade8bc3ff0ff0106f5f7ca08a81ccca.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.share_applicationa19
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4315

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share_applicationa19/.global.com.share_applicationa19

    Filesize

    335B

    MD5

    8994594aec4a0cdc3e40a764d3ca3457

    SHA1

    e821b0e735d82b33db07322e1b219dd6d72ff6df

    SHA256

    4eddd088b1cf89fea84b14ca7ca6cbfb67d133857fbf1fe4230e597e5f385103

    SHA512

    534483735f4dd6389b2d3ab135197c245548f319c8129b0aa98d56a13f46c26715245ff2098708712e9df5bff6426ea310fb8dd4cc493eadeec600711ab4d979

  • /data/data/com.share_applicationa19/.global.com.share_applicationa19

    Filesize

    194B

    MD5

    1469e6418b2647697cc70c6e3f123966

    SHA1

    264b97b144b231cbc4793cf83117f55f06e13a8e

    SHA256

    064370a4e69a29d607fa07bd20f86fc7cb152db2c14c0857d369c2ccd37a6fb2

    SHA512

    ae8f16954bf3d777675538633c4bc66204685949b073f02c04c492edcc9630f8d183d085a2f816d8b21cf4cc6dc090c57f65fea9deccd5ede795db96078f6590

  • /data/data/com.share_applicationa19/.global.com.share_applicationa19

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.share_applicationa19/app_business/PBgBjr.json

    Filesize

    1020B

    MD5

    37027d1d2c87f24f86e2390229bf180a

    SHA1

    eb7db3d60b2ddc0b7d089033ddcdc82b107deb06

    SHA256

    f7a9914ec57789f5ddea4757d31ded0d0d4f1871dc53169074db83f5bcdb0411

    SHA512

    9b9a1325669279499a70173ff3ca4418c00caaf1c75df30bc41fcfb8ac9e3ccb3eee845526f559e76ed1bf4dd04ec52d50296d0fc7bdd10336eec93b9e32f03d

  • /data/data/com.share_applicationa19/app_business/PBgBjr.json

    Filesize

    1020B

    MD5

    4757176b551f5bcf4d24eb4201492ad7

    SHA1

    6c85ea10c5945d41463f89aa5fc58bf9f61034e5

    SHA256

    140d5d0daf9d074f0f4109a165489aaf055d4a70f2bad038bb55c9207dc27483

    SHA512

    1bcc43430dcdcde6170bc66e139291259ff457cf7419ba5028399ecabee89ff94201241cd7fe961e59221ebff2bdf54d8f8e6795e1cf6f98b1d25a035a13863f

  • /data/data/com.share_applicationa19/files/.d

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.share_applicationa19/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    459ffe77fdaed7c14eadb8ff172e5395

    SHA1

    e4313476c8f6607f0887d0fa46d91fe2dae23f5d

    SHA256

    0f96f8d7449ea734dd3d24a69dab4a894a45142ef119485a6a52ebbea457d3c7

    SHA512

    1d3883b6108bc564f4b22bf5da5ecc2f871ab895e923a8837283138d2e90fdcda168dc8bac0650b40c1e3ea35d13e33c39fd2e0e0cf22aa30f74e854a0d4138c

  • /data/user/0/com.share_applicationa19/[email protected]

    Filesize

    526KB

    MD5

    d245ba43d4cbd34f774611b5eb35cdfa

    SHA1

    a68735aac8307227b30e5bab933eddfb6bf38baa

    SHA256

    b9406de6d1af34f61af4ccfadaec06c2fe4bf93096cdbcfd774ea13c78624b12

    SHA512

    e90c1b2e16c7d2030e15ab4100cf20a37c81c0cc4ec8212058e9f5223b887be3e3036c957bfcb1878a37507ebfbb42f751c1dab06da487e946371cb01a2a163e

  • /data/user/0/com.share_applicationa19/app_business/PBgBjr.json

    Filesize

    1KB

    MD5

    4b669b81390143cf845142e78ab943de

    SHA1

    50288112a1743d2ef9ecaac64e7eebfeb51307e9

    SHA256

    4b5b98fe5728e2d37c686b7341bfbc3cb5ea07fa2d1cf499102baba56b855396

    SHA512

    995dfa68e454bdfef2a1029fda3de9312a09656aeeba6f82f422b533a3662b7ba9947f0fdd26bcd98e9bce974e27f7229e92e7ead3581c81f57e0d8f519c8b6f