axbanker | ICICI[.]apk

General

Target
ICICI.apk
Size 6.6MB
Sample241013-jsnp3azgmp
SHA256 e2ec88490db6ce8cfe986d6001317b6b29087a719398f37d33e06dd7d9b3b446
MD5 da495b745010c2a76b32068c97a97f1e
SHA1 ba9984a0055923e73d85d3dd3a7c8fcd2981ec0d
SHA512 6708447a924865500e9756a0ebe8cd2a4fcc7a877cb3931cf80a4bb414c6c7b68f5cdf338670869fd73c36775fcf2401bcb402b14c9c070d11d5a8f3ca5b6fd5
SSDEEP 98304:BS026zqPsE7Eq4YH9VZUSKqQv7YhDETQTdJagl/Kf5C6h70ahQ2aoOJ3M/KrOpCe:xL6EESpv7PTANKBC61vCToOJaCe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

axbanker

Malware Config

Extracted

Family

axbanker

C2

https://myapponline.in/api/user/step3
https://newax-d7dc6-default-rtdb.firebaseio.com

Signatures

Axbanker family
axbanker

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

File Explorer

ICICI.apk

.apk 6.6MB

ICICI.apk

SHA256 e2ec88490db6ce8cfe986d6001317b6b29087a719398f37d33e06dd7d9b3b446
MD5 da495b745010c2a76b32068c97a97f1e
SHA1 ba9984a0055923e73d85d3dd3a7c8fcd2981ec0d
SHA512 6708447a924865500e9756a0ebe8cd2a4fcc7a877cb3931cf80a4bb414c6c7b68f5cdf338670869fd73c36775fcf2401bcb402b14c9c070d11d5a8f3ca5b6fd5
SSDEEP 98304:BS026zqPsE7Eq4YH9VZUSKqQv7YhDETQTdJagl/Kf5C6h70ahQ2aoOJ3M/KrOpCe:xL6EESpv7PTANKBC61vCToOJaCe
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

com.rewards.icicicardaapp

Android Permissions

ICICI.apk

Permissions

android.permission.CALL_PHONE

android.permission.INTERNET

android.permission.READ_PRIVILEGED_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.MODIFY_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WAKE_LOCK

android.permission.WRITE_SECURE_SETTINGS

android.permission.USE_FINGERPRINT

android.permission.BIND_ACCESSIBILITY_SERVICE

com.rewards.icicicardaapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

ICICI.apk

com.rewards.icicicardaapp.Card2Activity

com.rewards.icicicardaapp.PinActivity

com.rewards.icicicardaapp.ThankActivity

com.rewards.icicicardaapp.CardActivity

com.rewards.icicicardaapp.PersonalActivity

com.rewards.icicicardaapp.ThirdActivity

com.rewards.icicicardaapp.SecondActivity

com.rewards.icicicardaapp.MainActivity

com.rewards.icicicardaapp.SplashActivity

com.google.android.gms.common.api.GoogleApiActivity

com.rewards.icicicardaapp.USSDService

com.rewards.icicicardaapp.CallForwardingNotificationListener

com.rewards.icicicardaapp.Service.ScreenOnOffBackgroundService

com.google.firebase.components.ComponentDiscoveryService

com.rewards.icicicardaapp.MyReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

com.squareup.picasso.PicassoProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ICICI.apk

com.rewards.icicicardaapp.Card2Activity

com.rewards.icicicardaapp.PinActivity

com.rewards.icicicardaapp.ThankActivity

com.rewards.icicicardaapp.CardActivity

com.rewards.icicicardaapp.PersonalActivity

com.rewards.icicicardaapp.ThirdActivity

com.rewards.icicicardaapp.SecondActivity

com.rewards.icicicardaapp.MainActivity

com.rewards.icicicardaapp.SplashActivity

com.google.android.gms.common.api.GoogleApiActivity

com.rewards.icicicardaapp.USSDService

com.rewards.icicicardaapp.CallForwardingNotificationListener

com.rewards.icicicardaapp.Service.ScreenOnOffBackgroundService

com.google.firebase.components.ComponentDiscoveryService

com.rewards.icicicardaapp.MyReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

com.squareup.picasso.PicassoProvider

Android Permissions

ICICI.apk