Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    15/10/2024, 22:04

General

  • Target

    a316406c294ed2ebc989bf3f306a66cce0f7ff738bba6430966bc03d715d284e.apk

  • Size

    2.7MB

  • MD5

    c6f9bbae866043532987ce2b616ec158

  • SHA1

    f64045df83883a37c29123f5b7a8ae713bfbff1c

  • SHA256

    a316406c294ed2ebc989bf3f306a66cce0f7ff738bba6430966bc03d715d284e

  • SHA512

    92386af9536cf79e5b35d8d4da9875f933bf0f4300a5e633642dd0a5a2c3ce0915c43fd85d6d5f2aa41ab6d061139b2b7fc457475259bcdaf51f6383c7429583

  • SSDEEP

    49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQL:e4FjEI4iZaUzYH99yI0

Malware Config

Extracted

Family

octo

C2

https://45.88.88.100:7117/gate/

https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://45.88.88.100:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4220

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.nameown12/.qcom.nameown12

          Filesize

          48B

          MD5

          046a414913add6f5bb60072c7db819b6

          SHA1

          451ee4f6809260aec622d772fd329c7d0297a842

          SHA256

          b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

          SHA512

          4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

        • /data/data/com.nameown12/kl.txt

          Filesize

          230B

          MD5

          d6522c53ecfc1a9faa930aa961e1f463

          SHA1

          3ca44b0ffb88fea09c6398d456e5afaf5e43e754

          SHA256

          93ac4bd8f610caabd49090f0dc6a9c082713255a4be506ac01ce11e10fd3e843

          SHA512

          5f4ac4a9e9449e4edf38b2398ec42b0545992af407bdf009dd9460bed480fc58297b6ff31fe7e17a9427138ec3f315a2aaa537638c1364c222ef19c1d3804b3a

        • /data/data/com.nameown12/kl.txt

          Filesize

          54B

          MD5

          e5d71efa3b512bdd464b4b120c5f41c0

          SHA1

          b4559ee75bd4f899511b45089dac42fb49a5125a

          SHA256

          c9dfbb633eb59da3921996412a2e1891e4b40be7a135730b5844a42b82a440ff

          SHA512

          3683407270a9827c887f2f988cec9b1522d63de5e7ddc505a82afe2858df4735b9b25d992440f7a6281e43c60b4e687e38bc1dd105cd3c16f7d56118a2661a62

        • /data/data/com.nameown12/kl.txt

          Filesize

          63B

          MD5

          67993e8599fc91c09da39e7c1ee6a878

          SHA1

          f923c43953f2ab820e358c37ca2cf611fd02162c

          SHA256

          6c06c41abc417f02e0d671466820f62eab884961e0cabda979f1a5d51b3b444c

          SHA512

          49761633585bdf43d1a1fb46bfc671842c964dcf67bafcf4f30ec58715d86c467009211412a004fca14fb401aff4ce23e460f6d2613e7b24d57741016647ce17

        • /data/data/com.nameown12/kl.txt

          Filesize

          45B

          MD5

          7ff223462f5c1ad740baa1a187b8790f

          SHA1

          a961a396a8cace6ac669c3bc08072f5c8e5078d1

          SHA256

          e840d92d261206fc716e8c0cb0a47ae0267a67663ae2f732f6688778ea654d8a

          SHA512

          feacdbf64a09ba14f159d8f4ed6a8f78c525bf12a4fc4b3f17981ca47da55b8250aa8169d890ebcbae60366748b625af00ac2a0f867ab2c7f4cce6aa3aeed2b9

        • /data/data/com.nameown12/kl.txt

          Filesize

          423B

          MD5

          4440e051c8d49c5a02898ba258d36294

          SHA1

          45793ac466051a0dfaaf2445f904cb75126172e5

          SHA256

          ba0d8e34f7c2b654de2eb2bdf5146a11d2f43da380dcfd1b70f9f7517648c9b9

          SHA512

          00719383ad5177c30c93ae3923ef0cc5c0741bd2122a46292d1979db0a3dc50b7f40a9fcb9af204e5f2bcbf696b929c091f3ea279bcc0206e727c5287feed9fa