Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    25-11-2024 22:10

General

  • Target

    34b3119212615259b0e0de389bf5a999c7cb54943ae17db345ff8f34e067cddc.apk

  • Size

    4.8MB

  • MD5

    ebd5c6ae82d1f47d01ee9e037c24cfb8

  • SHA1

    320d773bcafc94cb8a36bf5dde4ee7e0f4f8bde2

  • SHA256

    34b3119212615259b0e0de389bf5a999c7cb54943ae17db345ff8f34e067cddc

  • SHA512

    bbf4e9f308d41b7a03f4974bb5872377cf2428a9224209906d228b09b1d41de6c4c1252381d02a918aea267d35b49a9acf03ec465565ec538bf2df06eaefc463

  • SSDEEP

    49152:lRsEXk0YyZKKqj7fT45iS7xrGHv80LfMjVKScHpyTxIzTutQeymZiqS:lRsXLyZfqj7fU5iSRGxqVKXL/utZyWy

Malware Config

Extracted

Family

octo

C2

https://a04df6b6a89f57c0cb9124c07ed91335.life

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.uauto52packhint
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Tries to add a device administrator.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4342

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.uauto52packhint/.global.com.uauto52packhint

    Filesize

    189B

    MD5

    f3aa02018b82e9b9cf83e9d03a6a50e3

    SHA1

    701e980a0b70adfe427ff8ed3165fd5db09b99cf

    SHA256

    572620a068a3558f05b4ac4599872fd1d8299261f3d310631fdedd2b308605b1

    SHA512

    8bb989315fc268c532da20f3b1d89a275a8b721bd1aab4ad2fc31497fd65bbc639794490385d1f351b465b350c389f6831fe701635e260366f6c5a750450c1c7

  • /data/data/com.uauto52packhint/.global.com.uauto52packhint

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.uauto52packhint/.global.com.uauto52packhint

    Filesize

    260B

    MD5

    4e5967fed17a2ce2862e4424e50d66cc

    SHA1

    459544975725900cf4656e9bf3f2b1874dd63344

    SHA256

    f44c18a993a9cb255882a6004e6eb19cb6578666f6e1c7e75cee13c7ecc8e79b

    SHA512

    95625fa65e46506c2127d583c624b071079279e8b0891590344389bdd48d92e5351710a00dac991959f6d2c976ec9c558a9ceaa712b59179ddc00387d3c44883

  • /data/data/com.uauto52packhint/files/.a

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.uauto52packhint/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    a4ffa6684054e8212ba1f944a10b821d

    SHA1

    fb052a08a2d48976ad1372a196b3be20835a5368

    SHA256

    5d254dd64723b3bb0b2e87f70106ed11cfaa2c60ff1b0a2562de0a9056b7cb1a

    SHA512

    ae0c14ee1215cd7763e577b51439ea7fd710572e47a7dd9b68494f094aff80dd41be039c25a8c090b9364e79e3142a9816f214e4dc6540a45172bfc4a9f8db12

  • /data/user/0/com.uauto52packhint/[email protected]

    Filesize

    526KB

    MD5

    ec392ef4adb7c78df6c04b5809a9559f

    SHA1

    99e7a3fbeac1e7682699adc65c40c240cef89f55

    SHA256

    a6b8c6061633815052d7ea00afbe56cd7ef5c1adc8354f6e3c7a1076b24d0f30

    SHA512

    877896801f67f92b34da65eff0b3e316732a84e42c51a6d09259d535ef0a4b0088868e51ca87d7d2a3cb40fefb7814f17392b10eea28809db5ccb5060b6f2429