Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    12-10-2024 01:41

General

  • Target

    98e6fa309945a18befeb715cb8992b9e8bc41908ff13fa5e9eeedd733bcc8bb0.apk

  • Size

    7.4MB

  • MD5

    83afe4091993fa1d733310b595e1d131

  • SHA1

    6179956c01a715f2d2c4b4f6bb8228fa5933e959

  • SHA256

    98e6fa309945a18befeb715cb8992b9e8bc41908ff13fa5e9eeedd733bcc8bb0

  • SHA512

    fe99642eac6b772c53fd2e31195188472509b7d96a568079026ac237e68541abd5d01fd14d219be1461f2a1c1212b4a554432d8dd717ecb0438364390e305fbf

  • SSDEEP

    98304:0QPUcRsqV614dCkqwDaRsu85iSRGDWfbj72VKZk:0EM14dCkqwDaRv8rFTj72UK

Malware Config

Extracted

Family

octo

C2

https://0e97556072acd897b127d53221a49ecb.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.dmulti_scribez
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4727

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dmulti_scribez/.global.com.dmulti_scribez

    Filesize

    194B

    MD5

    02bd9744c3fdefb07f727e43f6ed3ed1

    SHA1

    d04c7e34eb28a34b75917c7f74b591912b810583

    SHA256

    44191dfcc2d33febd0d4cde3b1813512d5271c4c32e08e2b57acc82fd7c3f74a

    SHA512

    b174aedaf1360ece27417f84b1ae39ca68d861af2a65719e083b81d1c36359e7260c5508fe2407682292e4c7fcdfb52369f236999df3f44b09e0ea1a93c42317

  • /data/data/com.dmulti_scribez/.global.com.dmulti_scribez

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.dmulti_scribez/app_save/pXM.json

    Filesize

    1008B

    MD5

    cf7a62dad1503641548162c68daddd00

    SHA1

    d2ed464eff1bc5f69b768b66d09340688475c321

    SHA256

    07a30e0edfad8a8a49d1847b6223ba776a013beb7a632d2abb1e90c51ba2ef85

    SHA512

    c83b516ddc956469780e35fac464fb3e183d17af1f8cf9fb5a7ac930ec7c3a62c7653df6be7c84952e8b81bd86015a2deaf16d3c96d83c4be2cd9f2d34422f2d

  • /data/data/com.dmulti_scribez/app_save/pXM.json

    Filesize

    1008B

    MD5

    49d53095ba40cb86cbca3a9a4735ca65

    SHA1

    096a6c0ca67375c9509d0051cc6135d24c47ae1c

    SHA256

    8e29ddd396129bb425a86af8b5a1ce5f6eaabaebc337ce90184fdcdd3b106f4a

    SHA512

    c87edad26fdf8673ec757fff8015f1816bbe10a8b9107b0a19a23f26e5dfb3f989429c559f0d45fa0f407b63bdcce6c2473e37b0a77049b2384cce66ce9ef550

  • /data/data/com.dmulti_scribez/files/.m

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.dmulti_scribez/oat/x86_64/[email protected]

    Filesize

    469B

    MD5

    4503082787e7d0a5b0e0d2791737d53f

    SHA1

    3090f1811de20dfc5b5ef243665da2a9f8c64b37

    SHA256

    fadc54f46e5e2f41be68611559b263e94f50d6169b63a095155035e82a9c4150

    SHA512

    f9710c94602e81f20cf24a3cf1bb535210d870a420f7629dd2cd162846ad82445fb241a05971a61ea86eea330945266b97e07ee303371cdbbbddd924b9e8dbb2

  • /data/user/0/com.dmulti_scribez/[email protected]

    Filesize

    525KB

    MD5

    3cedff3c2d3b8bd9b4ac44c4fda9f097

    SHA1

    c17dcebf5774aff70d291ba55c7ff9c800410a9d

    SHA256

    d316551157d83057f0a07421b37fd05021d295e4fdeeb6948284f7482b625afc

    SHA512

    b716cfa284276a0eec3b99f1c54f1c779170bbc227483741c206274da19967c909431d218b3ee3d201423492d29d237278f45081102339f6889dca088e70adf2

  • /data/user/0/com.dmulti_scribez/app_save/pXM.json

    Filesize

    1KB

    MD5

    3d78466297360fc4f4244bf777747286

    SHA1

    62611a4a3cf6df1d53236f9b2fe91378cb7fed9f

    SHA256

    be81e999e3b62e06fe2bb894ce6b12788c4b4ac6593e42fec048d47562aefea6

    SHA512

    0eb570e316b7f449b580c89ad1c52ff73134e338e7646805e4e7cc3f1b49a7466c14ef45d7057d921e6484950e3b5c76ae0c14308d5a089581103be898a35a42