Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    28-11-2024 22:06

General

  • Target

    b96bec3fa696703a87da65f9d960035efdf896efd7dc21ac317dd4a05d65f468.apk

  • Size

    4.8MB

  • MD5

    f0a917369d06f12a708817c9bd91003c

  • SHA1

    8656050e1efbf940e3e65843f97c7d91d1bd0a13

  • SHA256

    b96bec3fa696703a87da65f9d960035efdf896efd7dc21ac317dd4a05d65f468

  • SHA512

    fbec6a6e3ad771867c32b3cfab8ac6191ffd1dc99dade4c1d421d90476a7deec1a733a14460fe92b5c94af4b7e1c60eb36490e079a73a3660ad19c107c7e1d3f

  • SSDEEP

    49152:0RsEXOa31x9KQp3Xuv45iS7xrGHrfaR3Y/jVKScIzn9ea8v8feN7r:0Rs43H95p3X55iSRGcOVK+qv8feZr

Malware Config

Extracted

Family

octo

C2

https://b7894f717e707b8ac8282b15d3e99653.info

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.gestural_systemb60
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4998

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.gestural_systemb60/.global.com.gestural_systemb60

    Filesize

    119B

    MD5

    dbd003c436edd3a6706650a4cb0a6948

    SHA1

    fb8b74b100247215d2a81db468912045d8a4dab7

    SHA256

    0bbef4af3dfbda7b9623f6954b5e70835ba7d7419f237ca85bddf40ea934b2a0

    SHA512

    6baffa62bad835452fcc40f7d181581730b43e400031550e4f6469e4e7a1570c4f667b87940d05d14498848d7d0acd1a9d8e53e53a74ffe4758afe0ff60ae84c

  • /data/data/com.gestural_systemb60/.global.com.gestural_systemb60

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.gestural_systemb60/.global.com.gestural_systemb60

    Filesize

    260B

    MD5

    4e5967fed17a2ce2862e4424e50d66cc

    SHA1

    459544975725900cf4656e9bf3f2b1874dd63344

    SHA256

    f44c18a993a9cb255882a6004e6eb19cb6578666f6e1c7e75cee13c7ecc8e79b

    SHA512

    95625fa65e46506c2127d583c624b071079279e8b0891590344389bdd48d92e5351710a00dac991959f6d2c976ec9c558a9ceaa712b59179ddc00387d3c44883

  • /data/data/com.gestural_systemb60/files/.v

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.gestural_systemb60/oat/x86_64/[email protected]

    Filesize

    165B

    MD5

    b8dddd328a78e3b9e9d6d9f3e3807677

    SHA1

    4409193f3ba337ef69fb2cfc8897becea536024b

    SHA256

    737bd194360ef6b586cc0bcd9827174a1b85d7c7e8eaaf1a599133652b27e624

    SHA512

    35839d6e08284635c03992fdeca7dc95223c86a74511d9fb6361066c7ae4b9c3ce9c1594d7ee1c2490c9a44e85e5d27de2315d9c8e6d89d38af76ea8f7407ba4

  • /data/user/0/com.gestural_systemb60/[email protected]

    Filesize

    526KB

    MD5

    32cb131b601b7d9ae1d35a32fc9fd36f

    SHA1

    bdfc4f2c5e60021ed890670d82ede847b5e62cdf

    SHA256

    888bdfe3073d2f123bfbf537a27bc466ccda9cd1017ad1e8afeb67a100b2c72c

    SHA512

    5b5cb5f4a80fd4efd6a21f76eedca32807da59e59bc25ca39fe103f6eb8cb92c64178e38c65f9c09b007f84feb380c3e58b6939f9120f779856d6540355b734b