Resubmissions

19/11/2024, 14:32

241119-rwbtnsxbpe10

14/11/2024, 22:11

241114-13x5xstkf110

General

  • Target
    91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.bin
  • Size 1.7MB
  • Sample241119-rwbtnsxbpe
  • SHA256 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • ajina

C2
  • 46.226.160.5:8080

Attributes
  • target_apps

    air.com.ssdsoftwaresolutions.clickuz

    am.easypay.easywallet

    am.imwallet.android

    am.mts.mobidram

    am.upay.android

    app.ab.banking

    arca.am.arca

    az.anipay.usermbanking

    az.cib.app

    az.epul.technopay.android

    az.portmanat.app

    az.portmanat.newapp

    az.pulpal

    az.tezpay.app

    com.binance.dev

    com.eg.android.AlipayGphone

    com.fastshift.wallet

    com.haypost.haypost_mobile

    com.intervale.baitushum

    com.ipc_app

    com.kp.kompanion

    com.kp.megapay.kg

    com.m10

    com.maanavan.mb_kyrgyzstan

    com.mbf.fsclient_android

    com.moneybookers.skrillpayments

    com.ofss.digx.mobile.android.allied

    com.olsoft.mats.prod

    com.pyypl

    com.safaroff.million_android

Signatures

  • Ajina family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 8 IoCs

File Explorer

  • 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.bin
    .apk 1.7MB

91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.bin

  • SHA256 91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86
  • MD5 SHA1 SHA512 SSDEEP
org.zzzz.aaa

Android Permissions

91135fdeeab900ad00302f025096741e3fbfe3e5ba2aee57c7d513564ff24d86.bin

Permissions

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.READ_PHONE_STATE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.CALL_PHONE

android.permission.READ_PHONE_NUMBERS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.GET_ACCOUNTS

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

org.zzzz.aaa.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION