Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    22-11-2024 22:08

General

  • Target

    3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3.apk

  • Size

    4.8MB

  • MD5

    8cc8f36e6e6077541de7358cedc82df7

  • SHA1

    6979bc694aa59fb5e81325439004b99519328f4f

  • SHA256

    3e7970a5992aa0a27fb7fb9a9eb482290f50b6a1781844113437f647fc0b73b3

  • SHA512

    639990b999c44dede8e8afc7e31863ce3f0d8c16bb7a8a05252277e64a83031aed3b1b528084691f316ffd52491fac9f76faa611ad0f851117e57a36957e079c

  • SSDEEP

    98304:eRs94mA93Xr5iSRG4lVKCouMI7J6JX27QxJ:eRILq3XrrrUz0c27QxJ

Malware Config

Extracted

Family

octo

C2

https://b49f61bf4f619dbe7c723f3f45cd0a9e.io

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.lhole_framework36
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Tries to add a device administrator.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4269

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lhole_framework36/.global.com.lhole_framework36

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.lhole_framework36/.global.com.lhole_framework36

    Filesize

    334B

    MD5

    86697a58c61064eb0b7b0fead98e16eb

    SHA1

    99c00c628c4e6b033e54fae38a23f52f021296db

    SHA256

    af8419d873c2acf369a66941e9ffd908a665f7e232cb5e9b9f3764e5b279918c

    SHA512

    d7b2ada832290cbb4740e38bf7f60e8aa9c4304942612bece574451e714d39d27b21ab623865dd64152f331750217536196864ce950cb3151f148109d5237198

  • /data/data/com.lhole_framework36/.global.com.lhole_framework36

    Filesize

    263B

    MD5

    b618300d94b655d4c764a82280326716

    SHA1

    2f6b8a1b94a76e46901151e4d5bc38111b60ad8b

    SHA256

    4b286052788caafac94241fa50747619c0f4466089b66f153ccc15c45b4dd688

    SHA512

    e408bbc9acdbf1751f8dcc2327731a1dd445faffc95d189d89e5d2a81e8530db5687a3a0cadf5f6be62b61229952b43f34d9a5d82d824483dbeb0b61453972fe

  • /data/data/com.lhole_framework36/files/.m

    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

  • Anonymous-DexFile@0xd58f8000-0xd597b9b4

    Filesize

    526KB

    MD5

    2d831247d9be415d7cb130eb49627438

    SHA1

    9a7a14d70c6069a749b49a6ccd5b1c7b437cf57a

    SHA256

    546e255895c3517ebfdcb60e2f3eff5e7f18d8e65c651d8b4b51af2fcd693687

    SHA512

    95ce8202b35de68e2eb4a6f1ee2fcbd4e14a09df908a0f882804fc8ac5ef9612f83c0a29e295cf8118990037fdb8bb8f2d345ccd4c6e4dca424534406cc38cb2