Analysis
-
max time kernel
133s -
max time network
152s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
09/10/2024, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
psbmobile.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
psbmobile.apk
-
Size
111.4MB
-
MD5
8828f8690be3b802dcd998c0ce83eb4c
-
SHA1
2f4ae01348690b35838fd8ea73475724867b9ed9
-
SHA256
032e60ff6efa035a8490710ec133d1924425f9d8a0219a75a91011e6207d48f5
-
SHA512
c58fcaddac4fe5fa2ee142d41b54cb993f7cc78ef51ebded9d4d6250ecaff878af57a517f58859edad4570aa0606bbb01f712c127af41a0b4bbf107b6c7bdea4
-
SSDEEP
3145728:KYlp1LllGNTxw73EcMdeWh1cJ51BHgexoAFra3p:K4lg0UxbPW51BHLoAWp
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 8 IoCs
ioc Process /data/local/xbin/su logo.com.mbanking /sbin/su logo.com.mbanking /system/bin/su logo.com.mbanking /system/bin/failsafe/su logo.com.mbanking /system/sd/xbin/su logo.com.mbanking /system/xbin/su logo.com.mbanking /data/local/su logo.com.mbanking /data/local/bin/su logo.com.mbanking -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener logo.com.mbanking -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses logo.com.mbanking -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock logo.com.mbanking -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo logo.com.mbanking -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule logo.com.mbanking -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal logo.com.mbanking -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo logo.com.mbanking
Processes
-
logo.com.mbanking1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4488
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/logo.com.mbanking/cache/image_manager_disk_cache/04ba6188763ee018800c99eb1761316b6ec8f8a5bad8173960359c7268e3ae67.0.tmp
Filesize2KB
MD5a489edc1c858782c1403d7af41070725
SHA18bb0a87a3a2fbded0154506363bee18cf061bcaf
SHA2560f79ae81444b3ed29f0233035bc41b3f58fd3050cfdc432bfecb31fee63bee22
SHA512f5c01797e56b706bd474acc3feaa2e85db806b208e2cdfb5b44c77199d2c8b35bfcc595db53de3190adc2aa327d13088233269b215a3c19896fccaa5fb7fb5fd
-
/data/data/logo.com.mbanking/cache/image_manager_disk_cache/09a1fcee15da25cade91e53ba3a041714d7f5dc0a45402c602f60a3e538d8eac.0.tmp
Filesize7KB
MD597b2c8f90b5620823ed50463cae2fcb6
SHA1bfc936ba03f780c9cdf123dc4c0cb63cfdcc16e3
SHA256ad78e2567624e8dd07a47dfb974705db1555109dfdffb381ba625e640b6ca320
SHA51289ff594749028609d8817bc10630b112b08a1067085e06687656cda479ecd87cdf9b67c01840a7424cc14745e691f1bfe165d59f02b7f83b8340ee58d68f5677
-
/data/data/logo.com.mbanking/cache/image_manager_disk_cache/ad4c3b74f8e091ab027323152b730790ebb2285972400cff3a8b8af580c1271d.0.tmp
Filesize2KB
MD56231114ca19ed8235ca64e0e26636bab
SHA1f61d3371787783fdd0c187cfdae32e6665b4e134
SHA256c329ff2e5175d0b92cac1d1625b60a2e4e722a2f19a0e63e790ef515684d665d
SHA512dfacb28122984f29fbd6998ba0aeb5c483d1c659c42cda5b40e022bb46373651ce0656dceb3a57a05675e98e736bd55383bb8626074521e51a2d175f295a7b1a
-
/data/data/logo.com.mbanking/cache/image_manager_disk_cache/ae356ed79292de19087facd1424ce056c9f25ec04cea9a2eda4b47ca2352200a.0.tmp
Filesize5KB
MD593f997a78387a24f2af3011739b8e996
SHA1660b7a9872e0bfb7b9790e35e3645ace3d234aea
SHA2566759ed75aafef4cddd9e2babf65e879b153746d1141e6e257b99605846b85bdd
SHA5129f0ac2b78e926b055f0a83f164f56117686dd89e3cd944a5e8eae97e87cd9d1dea9aa466ec894a2d5be808f687ac6b010f91f7f02d8af7618b27a7339c54c30d
-
/data/data/logo.com.mbanking/cache/image_manager_disk_cache/d18d180e087b70f94930e6bf68e6d7753095143565a70b2d6f103426472f80fc.0.tmp
Filesize2KB
MD590f358fd544f246701fcb4081b0d14b7
SHA11b70604058afd360349959e01b876031cc72354c
SHA2561756adac641b8781a07e3e4c3f7d4245e334d1a2e177a2260abdb0951217089d
SHA5128b2d58f08e462e40eb63b72244e48c9fe4066460bb6fa1a2122eed4aed875d8925ca81f01051567c889ad06f096c80e5f820c916e70402f10e8d18b62ee3a999
-
Filesize
1KB
MD50e2d1c6f01edfd304f4300ccd5f43892
SHA12d863dad83e8f286ca1de1db8ebab3a524277cc8
SHA256ecfa501475ae030fdd75c2ada9073dda2568f3c82870fbe76034a52d8c6d16c4
SHA512fc408c9811d4516f42a0f574883453ce21c90ad23a3b0e3c3c91da21bac0b3fe1005f3b2f205b2e7269cdf86f14bc317b639aa5516a614828fb8e40f2ba66a87
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
39KB
MD58a3ad9b1e72409274e00bc4f25c2e562
SHA1dd69ec6bbe17955ae264d246ebba442683b5f1e7
SHA25611395f5b997083e8bc99ae9a24b8a3b99aad1036ecdaec04d7bd03c208afef8f
SHA5129548dd938fe57680b05c6fa42b0e8bdff40357f3bc312f4bddc613498cb8a77b35e388dba3b04451da6811ef19f095f13198b97c9b794d59d56c6f913f006553
-
Filesize
270B
MD5807e745951cc92a2dde180600847a03f
SHA1966b5293f8003fb4db2668e569ef11f5181bbd53
SHA2569cfe2a906520350f459f48be96b08d2f6e81c772665b79a6162ebc64daa75bd1
SHA512cd9ab218e007d0f8615ee55801e6dcc4918f8bbf1fbc6fccba588d2f4af57c86924c0c524fcde5a78b040200d90fd4f590b73a78b149c0f769737882055a7372
-
Filesize
4KB
MD50eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1fee434f784e73cc7916322e949f727caf8363102
SHA256b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
SHA512b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
-
Filesize
512B
MD594b488c5fffad1c0308f995263e7af2a
SHA111a8ef620f6f319074fcab53c946d3ed9967af68
SHA2567c70624b5992f93b2bf18dd3723b7443a2087a6b7e6b8765292867b6fb3596d5
SHA5121cc22f76c0d5186128a42bed7cb36838406bd971ec750f5edacc0b9cdd9e91d8d9b695a50b189e9d51a5d3811ba0b6d0e86b8646fe38b72038453cc3abc1bb16
-
Filesize
16KB
MD5de72958cbac065f656df52eb9c026260
SHA1edc31f3103dc49c3cc4f4f9d3ae1b4c9e9bcdc2c
SHA2568f5249e7c1fb0d3c654b2ab5a6a2e14db6a736f30b850cd869be34181c635fd0
SHA512b3145057bff7ceb0614320d9da699aa64c30eca6a6d7ed264972804b6cdb9278c89e6dc485bc841f3b40f8da1f67a6191a5486c978a630a682459d5e503aae20
-
Filesize
60KB
MD5df35c274b0af5570a8c21493f8cac509
SHA10214bc796106b7eda26dc4b332e4005e9dc6c1b7
SHA25665a9e6622d3c70d9afdd220320bff0b2fbfff1620dac1c94f01b98ea5a56369f
SHA512ca457b4e68aa363b7a8d5c09ff14855abdd8ecb8065bdf605bac8abfc2208cbdab405bcdbea70d6f54a9183f3ecb7c5631d664b1f160968cfbf124e4d95ee908
-
Filesize
68KB
MD56674623963d6f15e0c4afa86c075cffe
SHA125a3a068961a8d3b3590fff90f66620be872fc5c
SHA256a5a443d3f5d096d17b61401edb287e1150a02fe3a339d2200d78b321ffaa5d3a
SHA512ff01297455e0780b1ecbff342edf1044a22000a55682eb10be0c55c48041102a875bb56ab9246714f6307bfdac3fe8eb7382f57ed26358c2a5fea6b78f76f8e9
-
Filesize
32KB
MD55ee158b8e0f9135bc9ce3960a59be546
SHA1354135333026532dc1c7057a4e73158eecbdf439
SHA256eaada6eba5f810e5ecb3c2445ae489f5b217706628783ce1949343483d5cc59e
SHA51272257ad36029b9fdf453b885329e55bf89c995cb973ffc52c1214da075634619e24b0a4db77ad9996e3133a62f6e65d5d0fe5fe7016fdd5ebe92f474be69c787
-
Filesize
8KB
MD597a40135f2c78e09082155645eded59a
SHA1c17789a09de95b9bbc8885c1b6bd63919fa04b18
SHA256ba38b34e3ee27f2fb868558f34299549a4a87a7525d3981251c5661a508a9933
SHA512b6a3432b72ce44811c1134e1413180a067f84f27c58f793d703d1cefe986522f1c0ff01089408fb2127562abed1985765d48f7551b1a7c12ae488b3c688c89cc
-
Filesize
512B
MD52999691c7d3d319b0acc964981e77ae3
SHA17d686f8a952f43d389e0181f9166e5019aa5aab8
SHA25600eb146ace9890b5273b20666a9b3ba0277e2a3697da564287b427150771de60
SHA512a0d07b6815c1ebfecf20d97627a0ed6302e0d2f3df79252cad7fad6f08e4d2326a58f425d2ddb5126613609ef07af9b2e3dfe1310b2a717c033c5bd9149c1a09
-
Filesize
8KB
MD5727f5e575c9b448768e83b0175c609d0
SHA11444ba8d46b832c8b39a2ff19c7b97d2256144c8
SHA2565c2ab24b00facd3d44f341bd500a3232a1e7920084aa44dcc06f2b3ddc46ab48
SHA5122d612ab9e6e3e252f53eaf452fd94adda361b3e698992351599e8c998614f7dbdad2a8c7043f7a55f4e5ab505ebfeff49fffe0c6edb250635e093898ea43a007
-
Filesize
20KB
MD5585579181522e8fd13fef57f56b774d3
SHA1d8f115560afeeb712ebf36f19bab350efa2d0bfb
SHA2563b0bb6aeafa646aabe1a155fb4bc989f7791f359453d15e783c6c8359212edc5
SHA512421c365e6ef1eb1eeff867c330146064bbb25f5c69d4b2db843b6e8df7e01a60a6a377e5885af5d45456469723a6296e50423880a92b5a71ee58b6848724bee0
-
Filesize
512B
MD572899ffc4eaff96006970db5b86e4ec7
SHA1e5d1713cc7e0b61ffa480b70361927564b95ef3d
SHA256a481a53c51204d1f11871a0bf422085b31c6e903ed539b083f026c8a2b05cdb0
SHA5127da8cba0f95f3284575d1785454e2ed1f3f9ac36282bce3ef3663c2467e0aee1efb6908dc0d337303e614db6aeb8a24f34ed5a0532e21addbdde6b75927add48
-
Filesize
8KB
MD5c6d7ae936b0cdf7e40c6865b04e8935a
SHA11686a8dfbc670854cc852f683954053bf15c152e
SHA256b8ee5d91625cdf63c0cfe0b21f64198f12e570eb53be463a4e52fa99c7d1f63d
SHA512ed2812ff4711524431b951afb9ca12a3563830d752a58dafcb982f24a89766fdf7e66a3b4211589dd9d0c26f5e209312cc41d72eced368dc9fd692260f69ea73
-
Filesize
8KB
MD518c0766c59c34575dd39db58fb7cf010
SHA17b6ccb8d8baf77cc2dc804cb9eb060ebfbd14a57
SHA256b3f7619a6ca61c6ef95c59c8731b274821f754c082c29269ed88dcaa9b778631
SHA512ea629fc7f5779a07b51301301a3c8c4a0cd4ad0a3626c227c1b1507a7297c24a310a628ca64a79cf407578a03b8f07ed4bfd2c2c969a6a5d3199530694134113
-
Filesize
561B
MD5f7571646d65ca740c7733cd32d7a9c67
SHA173b0f6662cb1d5c3e7117d7c0fe2ea4a48f3cf40
SHA256101ece81996401380686f81247942cf4200ed0e686520f3a21fa6509ff638669
SHA5123b2a7084eee88c1aa42bfc77ace341872a7f555c11a55968e428abd7fd480bc5aa3d2e99ca61e16e8662d8de0e9e9be8fa6e9da25c99de56120acc747be07b3e
-
Filesize
90B
MD50e0d9fc44ece917b040ba3e38d873be1
SHA1e2193ff4f585ba7bef06078ff7b5b2c745ec759e
SHA2560c75e1d63c4aeecdd854a0db2d4214ddd12f6a14bf0c24a999d05f77158b6ea3
SHA5124ea67f9de5121c828726c7011d2247d85da7a602bb23e8f4224e0f65b8ba4bfb64f1137d75eae80901a19e6e6ec3e059899396bad9b94c9ab69b7da973907180
-
Filesize
69B
MD594f58956b2ffd710e601233347ba8c94
SHA1c3e32c951efecd2ed9cbe1977a37c75c6c4d00f9
SHA256bc91c890f900d8970dc64d26134dc7eaf96dc9a10a9b1057418cbf61b57e1e05
SHA5127e3fc89ccb6427a37afb84108e689c46a7a56a3072e52df3ff744d21f7d61f238d0d0af53dec37fdb72abc2c7793a232f32b26f6482c08963baabe43b9c38224
-
Filesize
192KB
MD552ee05b45f85b0dac893f08ff2289fe1
SHA18aeb8b1f07e3269a0bd9fdf96888618ea29e9762
SHA2563e816ceca6401edb1ea5f8514efd6547b501214f9289124811b0620ea3383077
SHA5123fe972983753cbe56157ac36a54cce9b46fca1150dc26bd72a60e159433458c0132b56915fe20c25b8bd1261a18cffa0c9317700ef2c19c44fe692459f9a24e9
-
Filesize
10B
MD570d5d7cda0784e33c2f479717caeef0e
SHA18c185a8a16359752da89c062455ffd185d2531a9
SHA2562d1a584be27633517648c98d910d88fba89c01ea1b3efeb7f6ae51fad2b74287
SHA512001beaf965bd4c87409166fff02ecd8c9ea0573631a2d14ec8883080b8f1967e0bc7da10a94ec840c0de0f14c43a8fe6ee3a4424fa65c6c8a9e27566d7911278
-
Filesize
96KB
MD55b060960cc98cb1b63fc33d7709c3656
SHA1b52023cc95fe8b2c7abe365927e224dc827c762c
SHA2567014781890363410a7c93b7601b2f7fe38ec43bb7100a711726c75d31af7c224
SHA512d59ffd5e33eb278c1640248849255b713e27e28c525667a0c9abf1a1a50d907b1e4cc9a6f79ff1d8c7995a0996ee649d0e5759a5df107d7d29f06b5a84b94aed
-
Filesize
512B
MD5d43ff3291191df4234d0dee9a5844a4c
SHA1cd9ab5a7a7bdfbd62c38e570f38f427c35246012
SHA256e5f3935200d8e317fee920c2e7eb1882520ea1d8749cba4d48c8ee3bc6814f6f
SHA512514e7569146b7d4cb0b353362f69b6d6cb2fad9e1488f47a8fdc1db23c20f974f12cdc1ae123c6bd20f209d6a7633bcaaab1fa05f1946b3c1b8a7ac7ff274f3f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51e4e9024db82b1651ed67deffa5ffcb6
SHA1f240db378345967a077dbcf715222210ffd501ba
SHA2563ce8874bae13719204bd6445e80550f55c10e124dbb3b2e56bf94cdbe95bd1c9
SHA5121abf42d1c0923c95813e698fa05f08b7c87b5c738956f8e16e26ba4a042e085e798b32f521b886afd82a70ca4676ff861102798daaad131d7593bb7b21a722ba
-
Filesize
108KB
MD5b7b159c954af72f810bedb1b4b0dd300
SHA145026f36eb2166762678f7689f7e05f5552b3de0
SHA25654e123bbfb89bbc1a643f95bc3962ba69647650febee518b63df833328fcc519
SHA51260ef6de86ab59885b6a517c30a6b39d18ddb10b25877fa8a056059bbeba956a306562e69ceb80a8f898b8fc13e1f531c656785a4333b7f9955544436bbf092bb
-
Filesize
406KB
MD55ea82d432e82b4e3d678bdbce7dc8988
SHA1f3df8495c0a557e09f6ff1297631c641a11c295c
SHA2564e496b9a83eeac67faddc9807b10d771194c6ae88610195fd92d2405f03f2cdc
SHA512bc056216c9190849ce0ea1668134f337d1fab1ffde7a8ae7e42ceb6cda5e6c649ac4e1e64b597f1779f0f398eadfa626874714955c17c66a67cb16578f3e5def
-
Filesize
827B
MD5084614ccdcc3ddeb3b26a790c9d16220
SHA1e122ee50e32d2730af483ca18bef1e519d87e0ce
SHA25680ea1f1fd21fd841af572f41161a9be6228ee72f3eb3705ad74dff9815350823
SHA512ace3c3cf36d845d5a390cbc51254ef3cd3b9316ef3723e2dd2fe6b97dc07d7764e3741bf3237062ecb1376ef6d0b43fce0b3cffc71de2d346c803fe0ce4fb9e7
-
Filesize
64B
MD551958b4f794a13787d4e30c6be4b880b
SHA17f888c666ef9480e1e17f371139d27bb6b377728
SHA256aebdffe092dcb800f4d317d9213c41d23271c6c8bdb084c97c975d465c09c55a
SHA51294c42de93e0a828f6306fa52b9420388a15e10bbeabfe1eb2156d06cf06dc75342c5e62a0939d9ec2e683556f863d3ee6ef0f17c7a9c7e6f3dbe2bbc364e7dde
-
Filesize
64B
MD5a4755b758509416d8d67400b980265fc
SHA1d36d2b16c8532c514ab9d444f060e5b3823712d1
SHA256ff8d5a00e655448acda20ef5f58c577f7d875695ff76105fdfd1588f819bb37c
SHA512b4d5cec98ac8dd90624d5547eb6ac016448b74b608656b6ebf14fa259fe63c4d7189a4036b6e769d325277bd6e43e472b85f65d5dd3238ddfcd743d3be7aa6aa
-
Filesize
64B
MD5fb56c006f51338224b179f23d94c5eff
SHA154f7f380b1ea97723ee2c71d21329c8e29c25a17
SHA256d8a3cdcf9e094a99658a767034dd31ab58aaa4483cbf9302412d54f97596ab32
SHA512d93c5b1341edb76de3a95979239aa54f178116d7b0440a1da40ef4512bd64a596ed7087692bf8faff5ce148c0d2fe4c304cd3a39fae707f246c7064d73b1d404
-
Filesize
64B
MD5284076f13eb80a97d9dab7865b33e9f9
SHA1e304c2dbbe9dc1cc557cf1e384af7b3e1125dc17
SHA2566020f907e68fa078ac7e9000fd56598b253fdf029c2f8fe6e1184131d8ba2a16
SHA512e393d4c998b6b3e311b8c8b8d37979e8bccffd8d4393a8e16918ae41f09fad117232bac3228407e1010d497668b6502eaec6d6072d0ca7429c9354d80496b0ee
-
Filesize
192B
MD5d6402d9c10a69df65567e05dddec6373
SHA159e3a2d779120addbcb6e5de5d8c41ef828cc7b9
SHA25661e2ac97ddc82c66669f02825d1d7ade5646117eee6f8afd1e15d25a52869a06
SHA5124811fefbb3abfd30082cf83cabb7414e60387135f2dd36802a94fff3e67be8f4ec3f061ae02f7f1a24807df218156acfcdca5320cf8c3909d2d6c4e560613d8f
-
Filesize
174B
MD525c7a3277b0b826d4807ef77b3f4e9a3
SHA140cf680a806baa4d53f4948b52a758cc9f1c06ce
SHA256a8d0e75f1d86afc6560d949eeef9a592a55aefb65d592a6e7b8c73ab868e9a7a
SHA5126033945524075ef2c36d9216e822c5dd5d366e4958ca8fea9ee3dbb1e797ba95b88d09f0c7e48685c478724f5413e820dc79255c5406c5dc43ab01edcddec2ab
-
Filesize
126B
MD5fc6bf10a43687f0628782fa01037f6f9
SHA158dfd05138472178b55b66dc86008428f260b9be
SHA25696231eae343e85be3d03f8a2f566eec0f06ad208f063bf8e33b770e721a16e7e
SHA512bcce7a53b2ed63f13beed7772e9c9eea1d4ff2173f746bb1e34ce158b6ed3bad98f48632cd11521c8ed5f178ac41c823cafbede7f582708ee28b352f3b0a4bcf
-
Filesize
8B
MD533cdeccccebe80329f1fdbee7f5874cb
SHA13da89ee273be13437e7ecf760f3fbd4dc0e8d1fe
SHA2567c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
SHA512991294f43425a5b80f8a5907ca7cdbb611401282585a58bb415077005428e3b4c0f661fc07ba5c45f627bd8bdcb172389ce2fda461c029b837abc70f0abbea20