Resubmissions

10-11-2024 08:38

241110-kjydkstdlb 7

10-11-2024 08:29

241110-kdjy1atclh 7

Analysis

  • max time kernel
    51s
  • max time network
    35s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    10-11-2024 08:29

General

  • Target

    Indusind Bank v94.apk

  • Size

    3.0MB

  • MD5

    f3b9b1b44ae0ba6b6d90ce886c5482bb

  • SHA1

    5843644659c2f24c5e3f95a60da4e4d179a7a8d4

  • SHA256

    085f5740451dd91c02aa1179a1cd0d315ce7bcd2f3867f9831afff48d8daaed7

  • SHA512

    de89a70cee16847a0fb0652cb04dae9d0b1e83e4a3a5f3ce082a5c318312e6f23bd22a1bcbf1a59557b58627038ca787635cc2b55ddbeac50adef41d25971b98

  • SSDEEP

    49152:p3g92KPXpundj3IBboLbzU24CXrZsrkmc1cnOrZ4NTPFHT5gr41H:UP5uZqoJ4uZsBGcnOGlX

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.divine.smsreceiver
    1⤵
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4264

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.divine.smsreceiver/files/profileInstalled

    Filesize

    24B

    MD5

    6db8e025523c0cef957f69f56885027b

    SHA1

    419f929df6ebdecaf24def9917f8d9ef6dee05cc

    SHA256

    2c86760cca7eeb4c3f6085bf9751fa61d978ca4ee01e13462a9845235e86b2f9

    SHA512

    ee044121dd5f10c62e5f1b0a0e5f07c77595df92d05cb18ff1f9991b6452bccac6c1422a63755332f2703fde48ef068b850a4c0ff9630739113640a73b061eb7