Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    27-10-2024 22:06

General

  • Target

    c8effd8bf503ad0e6ead2bd1e18c9192dfdf7bf22a730823fb68f4dd38312d55.apk

  • Size

    561KB

  • MD5

    a9d3db09312a4a8d7fd116f26773677e

  • SHA1

    d6d29243d4685f30a1ab9d3443e800c2e5702130

  • SHA256

    c8effd8bf503ad0e6ead2bd1e18c9192dfdf7bf22a730823fb68f4dd38312d55

  • SHA512

    ed68ad94cec7ec2749562c1e6bc4923d88419e5ce2b4a42a58c68f4a84d1f9b9c8a467b91624d877ae8b094889d12eec772f6b55311310c2f891b3d0f25bf49a

  • SSDEEP

    12288:mZAUYB8qQVvhDvqzQDomx/xXxya7KMh/Gq9SD85CHMfKqJniQ:mZAUYB8vkwomx1xJuMh/G7D8dfKqJniQ

Malware Config

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinezipala4esdim52.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaeldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idaesaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdeaayaq.com/YzM1YThkNDFkNmQ0/

https://hepsi010malltim21.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.holdtableya
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4330

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.holdtableya/.qcom.holdtableya

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.holdtableya/cache/hkkuyuawvx

    Filesize

    450KB

    MD5

    dbac07159d1cc84c975afb9d3fb81cae

    SHA1

    b8c24edc669448265ec8e80d97fe7ef436a5e561

    SHA256

    9209c96aa7bfefe106f361358857a21fcf8a78af604a2e8eafaf096ec9e3d01b

    SHA512

    2ce9b61da488c19d885547ca9df493ea59bb424e757fa0d0a5bc978f278a6837caf5717f2141c0ceb3c55ca57a495882249a6abb646bee3582a07c193f458de3

  • /data/data/com.holdtableya/cache/oat/hkkuyuawvx.cur.prof

    Filesize

    391B

    MD5

    2ad216df5026b11808d54b19db563bb3

    SHA1

    3414fe4864c1fc67c3facb02e22f0b4d3179966b

    SHA256

    edae2e98a8d0057b886bd5eb5fc17f4c05524b9978147cd2fc95b8c6405affe9

    SHA512

    37b9e145db770b2af60a00465e75c01a2b9af69fc5d10fe48d61496930745b11e505dc98435c66b114a2eceb971266920e45ee474c476f454e1a33667075da28

  • /data/data/com.holdtableya/cache/oat/hkkuyuawvx.cur.prof

    Filesize

    377B

    MD5

    48036c7c116ba7a7bc94a39585bc2aef

    SHA1

    26ce7d26d286e7ab3635cab87e42672a80e8fbe5

    SHA256

    a95af5b5a71da8507c51061f7cf315bbfae299bb2bd0012fc96e6f7e4881afab

    SHA512

    ebe640fa71b192b5affe8f3df1f6c950f6a0886d83f6686f82f80d76e5224cb7ee03f83a20c9785befa09173b2edef898c880e9cb59110ddf4d360b1aea3d62a

  • /data/data/com.holdtableya/kl.txt

    Filesize

    221B

    MD5

    f48dc1ea096a83deceb0d315d4f1bf99

    SHA1

    403a6f65b689e032c4c3f5bf2b3f961d298c44d8

    SHA256

    917aadf499e69c295615c7bea7235840ff1b37585b99468949395f768322179b

    SHA512

    1da090081d5b73d5714ac1443ea925e8b92bd65fc1b224633de4643dfd64d7d51ffa320497cb0c16af16610a7be7c4df48f5561c727eb705297e3f165abe76de

  • /data/data/com.holdtableya/kl.txt

    Filesize

    52B

    MD5

    f2b5b93656bf90dd20dfe35cc1e596e5

    SHA1

    ce81266fda81682133dc815da9e53bbafd37c849

    SHA256

    7de039f15225a06a7c033e9d6b34cc258cb5dbedded05e53fa614f7421d81b80

    SHA512

    74ef44338b6ac1baae1f45a1c1594a790a9ae6345abbbb6354897fdf029227fbebd1b5861b1a4795649c1318b08eadb46f0d6bd91f07ec6f010a6ac8d5561969

  • /data/data/com.holdtableya/kl.txt

    Filesize

    70B

    MD5

    a469ee98a08725a9b71a2e0fa923489b

    SHA1

    9e12d3acb4b55e613c642e23ba21c00bb022577a

    SHA256

    db4ec62cde941428e3cf94829b937e69c9ea4a22a6e12b4e1433b645271b1d08

    SHA512

    e0db64b248e1d5bf73bfc9e36c455a34009336179e2661d3e8a966ea5c601145a1c92df856e89592f867a5de31dd9911958e277ed0b749f9a3f738fb0651a3d4

  • /data/data/com.holdtableya/kl.txt

    Filesize

    62B

    MD5

    cff912f9ddfb9662f1f8fef506fc0299

    SHA1

    46918338f971020ed16fd4726850e0edf2352408

    SHA256

    ebc414aff5c551905c28d6f037f99f872f016bc41c259c1096c9a7ffbe4a27e5

    SHA512

    c06e4e1480724f5c488148fc3b02972864f5dbe871c2ccf7005c4a87dd8c9b2a65f327e0ea6aea975364b8c9fd1f36cd9a7a383364813dfcbf3506120e4dac5c

  • /data/data/com.holdtableya/kl.txt

    Filesize

    504B

    MD5

    143ce0ee58a337a6efb58c9c686bd1b6

    SHA1

    cc22302efef61fbf699a8fa48cbf8ba3cae9e447

    SHA256

    c597afedf9433b2b4bf7fa2e5e970180e7f466da17785f3056e8060db0667e11

    SHA512

    f3492d738e744e1317702c58ccc356e9b02352bb64b9194c701837c6b390e3487e36877d49060e98a18a54c0947f918d8705899587b8796970a4f7f87dd5c257