Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    27-10-2024 22:06

General

  • Target

    c8effd8bf503ad0e6ead2bd1e18c9192dfdf7bf22a730823fb68f4dd38312d55.apk

  • Size

    561KB

  • MD5

    a9d3db09312a4a8d7fd116f26773677e

  • SHA1

    d6d29243d4685f30a1ab9d3443e800c2e5702130

  • SHA256

    c8effd8bf503ad0e6ead2bd1e18c9192dfdf7bf22a730823fb68f4dd38312d55

  • SHA512

    ed68ad94cec7ec2749562c1e6bc4923d88419e5ce2b4a42a58c68f4a84d1f9b9c8a467b91624d877ae8b094889d12eec772f6b55311310c2f891b3d0f25bf49a

  • SSDEEP

    12288:mZAUYB8qQVvhDvqzQDomx/xXxya7KMh/Gq9SD85CHMfKqJniQ:mZAUYB8vkwomx1xJuMh/G7D8dfKqJniQ

Malware Config

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.holdtableya
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4341

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.holdtableya/.qcom.holdtableya

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.holdtableya/cache/hkkuyuawvx

    Filesize

    450KB

    MD5

    dbac07159d1cc84c975afb9d3fb81cae

    SHA1

    b8c24edc669448265ec8e80d97fe7ef436a5e561

    SHA256

    9209c96aa7bfefe106f361358857a21fcf8a78af604a2e8eafaf096ec9e3d01b

    SHA512

    2ce9b61da488c19d885547ca9df493ea59bb424e757fa0d0a5bc978f278a6837caf5717f2141c0ceb3c55ca57a495882249a6abb646bee3582a07c193f458de3

  • /data/data/com.holdtableya/cache/oat/hkkuyuawvx.cur.prof

    Filesize

    515B

    MD5

    74f5b7d3424282b3ddcd7f40586f30ca

    SHA1

    17cea13303b1be5f12ddf74511088700a92c314d

    SHA256

    bdbda01f16462bed873545107d16b94c1b20ebfe6dec71e4aa2fd282de279d38

    SHA512

    db5addd94e1164397d6ffe6911ae73487e7e09572b09550ed8d7fe0e61173fcd5fe3c59320efd7b2d9296792c3fc4ff9ca25bb42d0b7d1491a8fe03ae03fc6be

  • /data/data/com.holdtableya/kl.txt

    Filesize

    237B

    MD5

    4888f9e8c1dc4e64af635f8129382129

    SHA1

    31dab1996dde458a0e3b436ee5ffcb0f6527af2f

    SHA256

    81fdc1ee372bff3b448577c80034c2c1526e799e86fa3eca7ffd91a37c2bb4d6

    SHA512

    ce6b56e893cba71022db611f3bf734be962cd780a74e5870e34d47ed4c0f9820d7174822a3da14c59bb766bb35baa7a03d22097d890780183b2bf11f441a5a72

  • /data/data/com.holdtableya/kl.txt

    Filesize

    54B

    MD5

    410ef5a5a3b71caf47d452254657c6fc

    SHA1

    ce48313a3d5f7c7a863280cb6615d256e435757c

    SHA256

    b85a5056357f195f2737f82a101077340bb7093bd40e1b7ef7343e7b568c6ede

    SHA512

    cada3de96b8646dd9a3060b3c686d5dabd5922378df74c5219f911395092bdf8076188cc5217a5bfc48fb985e0c6518a769fd0fafeb7db551c9abc6c33138779

  • /data/data/com.holdtableya/kl.txt

    Filesize

    63B

    MD5

    814c6fc9e6a82d0c4c4023cb11025c9a

    SHA1

    82419636614942f5622149bb3fd878fbc2a22394

    SHA256

    ec869c0b8dece7a6503fced392a231f98c1eaf184aa21fa10caf2bfe0bf4ee0e

    SHA512

    53d6bca9983a4eebdfbf13b0a6bf73f10cbaa55aa99002b43e66a315eaf867da1c139ca709e22bca050198ce4624d353e45b19e170e431045a1924bb1dc307d2

  • /data/data/com.holdtableya/kl.txt

    Filesize

    45B

    MD5

    047c68f5a918112bb7505573bcfea2f3

    SHA1

    4a5873b287d588ac24d4f88d7a28a8f3eb322dac

    SHA256

    58091b81630735da58e2f9e977d9f0d94f2f1c2875c01392987e02acadb6d8f2

    SHA512

    a6ca3d2d4d0648df541224232be10e0f4088f6f3178d6a533f241acd1ed1b69ff74e0bb3c0788431301753dfae9aac392f0824a64b566532a74a89a1b948b6b5

  • /data/data/com.holdtableya/kl.txt

    Filesize

    437B

    MD5

    9b51239c944b2e4194827d5e71bd2308

    SHA1

    1122f30139f6f470236e5c36e214e63ff18d7cd7

    SHA256

    3bc5dbee51c0a12c3b2bb0dc021c7068604d7956c080865a27944aeb51baa993

    SHA512

    37ca5289a7c49f4f9e8b065c0071b3488fe37b99198356a5c5c4430192705458d60246e86bcfde28cc3ea9bc7680936364bdfcdafdeea0cfe59c054eed56be97