Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    14-11-2024 11:34

General

  • Target

    base.apk

  • Size

    7.4MB

  • MD5

    1f69da93d6390a1a8d7b9c5bbe00a216

  • SHA1

    ab7604bb897acce353d5e6daddfb367b105a6658

  • SHA256

    7cd88b2bdaf20440113eba9e804286c061f465f5729fb9c3388b7e27a1565b7d

  • SHA512

    9dbda31e57f469d2254c569a488e870167bf70189dea20df47d7cc1a8e305b1a24823bcacce6296ef36595171a615a16a48cb00b33c1472d896122df8af0d7ab

  • SSDEEP

    49152:O15qVGjHdLuywEpKPV3XKs8XRsEXoq45iS7xrG+vDwY4QjVKScyGNjBn39m5Fw8X:O1iO7fpOV3X6Rsr5iSRGDOVKLTceM

Malware Config

Extracted

Family

octo

C2

https://4b3e469faca52fed85676f94a00f4a69.info

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.clphone_new1
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4508

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.clphone_new1/.global.com.clphone_new1

    Filesize

    338B

    MD5

    ab410d06c1379043cd1a9cbc4d9e603c

    SHA1

    0a317a72f86e937d40cba1890ffabe76f4fddd00

    SHA256

    d3b22df749d76e2adb68d5e4b0bf0ec568e898d2a775b7fe8fb10a77b2b957d8

    SHA512

    2a27d2ee4c288a9f2b6c9a06ab8d4c9038d034e4d17f30ea690c9dfbb13b411bbcabd9715ec5b500c08ceb86f15e06bce8c15b40ef3c93c6400221306bfbd807

  • /data/data/com.clphone_new1/.global.com.clphone_new1

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.clphone_new1/app_spawn/IPgq.json

    Filesize

    1005B

    MD5

    9b9a3cd81d7d261b9c8dd48a91037768

    SHA1

    f82f3ef429ed8e39cafece115b1dacb540843d69

    SHA256

    86a5d8a4318b5e482a0d77f046980f30db924c4c4c8a12fa80c7673be5db9d59

    SHA512

    9f79d41000593883c7eda8143e688177f30622df6fbdbfba46b139bad923ac60088e54b0f09ec9be863d6ba7c677301f7c2e2e1dd48aef49f1674870254e8729

  • /data/data/com.clphone_new1/app_spawn/IPgq.json

    Filesize

    1005B

    MD5

    32285e0b133bb0f99c9bf10e880ea5a1

    SHA1

    0f1cfb5098de4dcd0cf08a3692afcd361e9ea7f1

    SHA256

    401e080c89bd87e3063fc343f591afde7ed683ee01783d7ee0e0af5b4c79253e

    SHA512

    de73074c06341acdccf6a1bc436b9b7c559b205528d956ccba9d35309ec2c13f737d95101c1f1e1c5127ab7419a3cb933582719c11c67c5a60ef9899b5f03d98

  • /data/data/com.clphone_new1/files/.i

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.clphone_new1/oat/x86_64/[email protected]

    Filesize

    467B

    MD5

    6c35e9b2a2e36eab0abb854e770db348

    SHA1

    67765d80646412e69a9efb41a829e5f2ca9d3a79

    SHA256

    db1b4b74e0a2a4039c6fa5669b3ef87750f3ede396d94b30b47911bcf1fbdd7a

    SHA512

    c90f220a18a0e816fdc16a5ef270e358988d7add8aafd44a7f33a8a2b0980ef00aa612013345874ca49d73664c755fbba250e0958c66dcfd1b3abfb4a8f6355c

  • /data/user/0/com.clphone_new1/[email protected]

    Filesize

    525KB

    MD5

    e382217be6b81b82eb84ab293937c2a8

    SHA1

    b261d01dcfbf21eab62b56f8eb0a2c023b2a42d6

    SHA256

    029fe892400ace26bc348095dd6f35fb957b99d46dc870059ba0b2aece259111

    SHA512

    85093ff904c4ee84fb94b9568ff989d0f7acab04a282d133c74298b04d4a6aa99d66ca715ae226531d11a20065cbe292a13717c5bc3c71df72469ca336ca9e16

  • /data/user/0/com.clphone_new1/app_spawn/IPgq.json

    Filesize

    1KB

    MD5

    c7b731a5c62050b5347a9579d33bf74e

    SHA1

    8d0caf7da0182a85cf04432fddf2de9895da526a

    SHA256

    54a3ca49bad96bf95f39a398b2bdcc2834565b6b0381aed5c80e14ed52b1d01f

    SHA512

    43faf474edd98c482b2761c52ef981c4f3cfba6184683de4410438fab8eee6ff15190177935a690a1653cb3bfc298ed1c47c63c9f84306c03c1e7257ff6dc954