Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    11-10-2024 22:10

General

  • Target

    adfa87a348d1a638c4ed36b505bb63f95e21bdce83e28edfc5201e48c855cb2a.apk

  • Size

    4.8MB

  • MD5

    52d16675683a01691fcc9ec9cd9f5035

  • SHA1

    0785fa796cc14a394a330d754ce2a04bde5aa026

  • SHA256

    adfa87a348d1a638c4ed36b505bb63f95e21bdce83e28edfc5201e48c855cb2a

  • SHA512

    074b7e847120973a391329ad9a3391f8ab68640307dd10af5f89b05e91afb20a26ba85125f11c767792095580018b833ff60db9276258cfe04cdcb294c330f01

  • SSDEEP

    49152:lRsEXp3U/5Ktaj7H45iS7xrGyGiLYDdjVKScf47pIEZyToVFRcf:lRsSU/5Aaj7Y5iSRG3VVKuvioVof

Malware Config

Extracted

Family

octo

C2

https://e78bbcb47bd244af2c5d7a465901f74f.in

https://55992d2a1a6fa755a07361abbe940ea9.de

https://6f3aedf597b5b5b20718ecaef86e38f8.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.garanti.cepsubesi

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.nxprojection75trimhealth
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4338

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nxprojection75trimhealth/.global.com.nxprojection75trimhealth

    Filesize

    121B

    MD5

    a31f967eff255a97f3decb4dd4666a3b

    SHA1

    d1fcb0c29d63ba2f4a6eaba8d400260e39a0a1ef

    SHA256

    f5e745f9870aa12c6756452293e2c56308a5193a232858acb5eeda0dbfebbd64

    SHA512

    3cc58b069997cadc299d6b19eccce9fce6cf4b7eff70056c98b9ed83e46c41bc4faf34310b9a9ee07391e0391cc612c9837d1c0e2376f2ac78e1cc2c22c29c05

  • /data/data/com.nxprojection75trimhealth/.global.com.nxprojection75trimhealth

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nxprojection75trimhealth/.global.com.nxprojection75trimhealth

    Filesize

    194B

    MD5

    6a0bcb99ab9627b7b5c91c2f537fed7a

    SHA1

    0c4d566975146fcf21f6ec50bb8c9d29cfe80773

    SHA256

    088e596bbe5f05c6b680af8c87c675f6e6d9a57c7150d9410780247a7cdd03cf

    SHA512

    25bfeebe21f3bd45899af229ed4dd4b5e603a827bcfedcbe8a071835013cad2ae8be738ec07c913137c65b2a51ac52080d11a157ed6f0362e55178b2031ff4c8

  • /data/data/com.nxprojection75trimhealth/files/.y

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.nxprojection75trimhealth/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    bcb234658ccbec7ba9e724634d74dbc4

    SHA1

    739ce69f1cde01849533ae290e3be7ba1bf798de

    SHA256

    c491646c28a8c9cc50bb0f5a84544fc3f852b6abe105ebf47532066725236e66

    SHA512

    afe90e78be9962656851018cb39f3515f73e518e603c26faec29514e5ddfbc28eaeba0b4cd06f1d1861227946212f13b77434398a5e03e73c2a2f221216444a2

  • /data/user/0/com.nxprojection75trimhealth/[email protected]

    Filesize

    526KB

    MD5

    08ab8c88feb52cb056ad38389774c1e3

    SHA1

    42983909f95babfd9aebcedc4932a00e6c3c0d4f

    SHA256

    46420f858f6bfe2d8fdee853fda72127acc6b3ea22bc6f921e8f5216226feb81

    SHA512

    a61fdd4c25cee5b9cf1b50c659f7145105707d066920379c47eb66fb119f88b381aca2a7ee6bf0a34edc05b7202f2817864d9eb4fc2307f28ac176dcdd2becb9