Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    22-11-2024 22:08

General

  • Target

    bac100c830b7bfb620f44a905c44f29df1c87e6ebe0c3cb8c3e7cceaa608af14.apk

  • Size

    4.8MB

  • MD5

    898978e2e55ccb5882c21f196d930530

  • SHA1

    8fbf423c6bfbb483f943b9bac5c0126403af8469

  • SHA256

    bac100c830b7bfb620f44a905c44f29df1c87e6ebe0c3cb8c3e7cceaa608af14

  • SHA512

    7b3191463e606baf2a974117817f2ca6599e9b73d0b32b753652c2d1baf6afd6cc685a279424508f59dcff766e710916f07870363b9deae588ec5146cabbaedc

  • SSDEEP

    49152:mvRsEX8+0Jl0KuK3XMh45iS7xrGurpao+HjVKScI7neeaaXqQ951/LRQf:YRs2ul0DK3XN5iSRGJDVK+LXqQd+f

Malware Config

Extracted

Family

octo

C2

https://71bd4a03ddb94320016f0defd76e1ae1.com

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.dapi_sdk38
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5135

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dapi_sdk38/.global.com.dapi_sdk38

    Filesize

    334B

    MD5

    c93bc28cecfaa20fde318ab4e25c0360

    SHA1

    e17f8f079db102b09d2c28f551ef69ecdb7caef3

    SHA256

    9a048982238351421daa4ff0454dd7e56835dd0e01b363c6924aa6c630b25b1c

    SHA512

    90eb83e1effbe92ee5628df6d72fbae3603d86c0d9065a1d6e960cfe3136735cc5ca443ddb9a96d05e66aabfab6ee49f3560884fef6879643c33e732c18a2ede

  • /data/data/com.dapi_sdk38/.global.com.dapi_sdk38

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.dapi_sdk38/.global.com.dapi_sdk38

    Filesize

    334B

    MD5

    86697a58c61064eb0b7b0fead98e16eb

    SHA1

    99c00c628c4e6b033e54fae38a23f52f021296db

    SHA256

    af8419d873c2acf369a66941e9ffd908a665f7e232cb5e9b9f3764e5b279918c

    SHA512

    d7b2ada832290cbb4740e38bf7f60e8aa9c4304942612bece574451e714d39d27b21ab623865dd64152f331750217536196864ce950cb3151f148109d5237198

  • /data/data/com.dapi_sdk38/files/.v

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.dapi_sdk38/oat/x86_64/[email protected]

    Filesize

    157B

    MD5

    09b8ab4e9505b3a1c81ede7709fcdce9

    SHA1

    b7b263e7e16744092bb3cbf4bb1e78d5e0aa33f8

    SHA256

    76771733594696bbf6db90be24d893e2e1111c34c6e756643bfef0cf84594dff

    SHA512

    7f08c274b6a45298c35fbdd55a9e7fa042999e2fbd055693ae5940216f37278601720465c4a6034d2da115c95d3e06214e36f5025b715304245daa6fe48413bf

  • /data/user/0/com.dapi_sdk38/[email protected]

    Filesize

    525KB

    MD5

    3d24810a93b44ed0b6a5de27158a9831

    SHA1

    ccaeabca08afc2252fc49ce0a7f610e5b42dec26

    SHA256

    c346804609ed4fd111e287ddb0d27c5f1a85f601280759c5438ae381dd874f32

    SHA512

    a0fe3783d921347facecf45582839f7da49b8a8c444e5a83cf4a0c3bc220a2ee122ba66ba4171a3c710f60ef6855fed2de0d39148d5b5471c6c40db674b6bd53