Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    12-10-2024 01:39

General

  • Target

    918e15fd1d77f87eab0f24e4cc6f8dad8de96b38c2d7d3e0302ebebe36b3ff3f.apk

  • Size

    7.3MB

  • MD5

    a7a9fd154b9689129a44b31e4b8ec828

  • SHA1

    bb99a188993a557485e0da88e161bdd50fde23cd

  • SHA256

    918e15fd1d77f87eab0f24e4cc6f8dad8de96b38c2d7d3e0302ebebe36b3ff3f

  • SHA512

    6e831db35a4b8cdf7fbc68bca07deae79afe1a43653d9c983d881b9adcea8b9f82427952ba62b8e448dca5fe4494a3aae8f8d3d7e6f49d3b89e1f9281914297f

  • SSDEEP

    98304:GZsp5iSRGH2V9Qbb/3lL5Rs2x8+3XAVKdmexsOX:SsprDIDd5Rvx13XAUMexx

Malware Config

Extracted

Family

octo

C2

https://e6d3c4622b5e1bd14da3e5aebd478810.org

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.garanti.cepsubesi

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.login_extwa6
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4463

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.login_extwa6/.global.com.login_extwa6

    Filesize

    194B

    MD5

    3d2a5fb09414a26d17975382f67c5c2a

    SHA1

    2b1f11b12d815a122928cf8d9b5859fd7160977b

    SHA256

    dca14491336c1fa675d425d19bd88c6e7d44ec781cfbd20b1ad0beb8e0f6ba35

    SHA512

    c54998fc0cb26da977cef11b9a258ae58db15e05a29492d9511d33892016d6e189c5a5b64c9a8672a946a4f6d7e0cba71d0497aa57fb03005562f96cd54b4581

  • /data/data/com.login_extwa6/.global.com.login_extwa6

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.login_extwa6/app_pottery/HYft.json

    Filesize

    1004B

    MD5

    7fe5cdbfd7cd686fa29cf129616e8396

    SHA1

    43a8387103fb42bb8401bc4e74cd4fec2415a9a6

    SHA256

    4ba7f8185245cacbf64b1411615b5968d745e542a0f8c4ea74a84a3b76a56cb3

    SHA512

    2ef757205e713eba2b05b743dfd4ce69ec97c6fdc0af571e978c0d8858cc9c4efd12ffef3f054fca826b71f0aa7eb19d3be225fd0feb5aa2e38a11b7ff5e806e

  • /data/data/com.login_extwa6/app_pottery/HYft.json

    Filesize

    1004B

    MD5

    4300bcbda0589c2a598e7700ed1b3b0f

    SHA1

    3811042b0f979810d30dc0e22dac56c0dd9f9ae4

    SHA256

    b287a7749552b8702f00785a113003f15dd70d2f45175723fe30bc1b18bb9dd6

    SHA512

    0e8a1cbeaa73441138f940b401aded5bbcb167f0511bf30c0f68894f14d6c03c66260757ef0cfa7d13165ae4f3ea0603e388a2f1ae4b7d20889cfd226296ac68

  • /data/data/com.login_extwa6/files/.s

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.login_extwa6/oat/x86_64/[email protected]

    Filesize

    469B

    MD5

    06deac933197be6bc55c588128e37b34

    SHA1

    9dbbcc765555b97871cba514f5f94f520ccb0c40

    SHA256

    f3b1593fc29467e7cbfe604ec11b1716d3af532eb0afbb0a2e4ca4f05e95e7ac

    SHA512

    ebcfe71675b962250012fcf7c466f7ca0b1afb2032110ba628eb1b8cab84a049016817c24c15e2aaca389c5df75121317c6adffb79c12fd00c2fbc2ab28e1f7b

  • /data/user/0/com.login_extwa6/[email protected]

    Filesize

    525KB

    MD5

    ed479ca74f51f488ce49ebe451bac150

    SHA1

    ec5e85bc30b6ab2b5d1d83775d947ac7aca803ce

    SHA256

    fbeb6c876f6945c3e90a0478f76c6ba576acda6986170e0e84d1a746249859cd

    SHA512

    31f2a298ed7dadcf17ccc12e909d4bc6f82045f89a1471c11b34a1048ae9aa24336c5f3a8f568dcb99d99f1dc0eb37aeddbb7e145291ad1d28c4d486e4a45cd4

  • /data/user/0/com.login_extwa6/app_pottery/HYft.json

    Filesize

    1KB

    MD5

    f89140b872b2ba40acf839bb5005a6cf

    SHA1

    924af228bb8bde174e68fa85b3e40caa7d36f10c

    SHA256

    7235e82db0db62429039acf9a0d3df94422fd422348af7f363df57596b5696c3

    SHA512

    ba506b4b6ea24ebc02e2d3b11dccdf50932aedd38819bfee6be4b1b3732de6f8c3d04f74f1a1047906fd1185de2714c8e616312902d2d4fa965f4be809e6c0db