Analysis

  • max time kernel
    23s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17-10-2024 22:03

General

  • Target

    940b24e003860e61dbeaa4ccf27e08ed708fe503be0f7ae2375de5bd2bdb2c31.apk

  • Size

    1.8MB

  • MD5

    3e7e2839f85b18876e68faf9dbc12bf7

  • SHA1

    f15cc5a158bc3411a02db9eff30c2fce28d4db7b

  • SHA256

    940b24e003860e61dbeaa4ccf27e08ed708fe503be0f7ae2375de5bd2bdb2c31

  • SHA512

    8a43391749404da04ac0e9cb7064c6dd71b7881ea639780ceec071fd5a4828adf2ed84ae7b9252a9349a7c125e714dec469250665e0112bf3a720b30933501c8

  • SSDEEP

    24576:TdbX5mFfvPhpd8IgBiMUTLI4FWhhNHpAWJkcjaoq6mQYY9GamH5++Ntr:w3ppd8VwnTLImipxkcjuZQTeH5++NB

Malware Config

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.chair.suit
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5102

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.chair.suit/app_arrive/Wq.json

    Filesize

    153KB

    MD5

    dddc1d0151a20d3d1bcf3072f4009ffc

    SHA1

    8e1933a24e34a6661b354ecfd8c89f8d9eba05a4

    SHA256

    7b7a20f72b5e50cecc5064cc870cb75080a5cde868cac30872225d70ebfea686

    SHA512

    13aa356f891f3a72140d201cde196f068993fa4d3fc7ccf0b722afb697b604cd66013837564422f00c223ef57e9ea542731536fd0d8963f24cb7bf6563c16d36

  • /data/data/com.chair.suit/app_arrive/Wq.json

    Filesize

    153KB

    MD5

    ddd88c92b309d00873db9222c3d97b7c

    SHA1

    8a549b0f2828409674739bbfbc318d2bc26265bf

    SHA256

    9713db17420f2b845bfdcc9f5377fb77e9565dde05e85b98893b134d71acda57

    SHA512

    640877dbc97ff1e8eecb1683c096fca0ea69d76715a6cf0ca7e4a976c6aaf74434ae754f9330412141ddf08449dc76c119fb72ea52a010d7302dbdbd37d43a21

  • /data/user/0/com.chair.suit/app_arrive/Wq.json

    Filesize

    451KB

    MD5

    e4dc9ffcd30d7e5b7f3632158c011d9e

    SHA1

    3fddc54f690271b24158169315cd2e7db4cbe40c

    SHA256

    dd6b331cb81ab55eb6c0efb489ec3ee15507e96c5d5e4e155d623eeea5e5e968

    SHA512

    7a8f20684a2107e9e2d0f1113a4d1d6cc7ff3ed6c19e7a9af7f5dac735076fdbd06544bbda64fc0e07660f394efcce6656ba77325025749a189a3c5443139ea7