Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    29-11-2024 22:11

General

  • Target

    3631e96ebbe3e23adb14b70054610e4c942999b762a5ec525ec88d9f232ae052.apk

  • Size

    4.8MB

  • MD5

    b766e6d8c4a96acd224e0bb471db223b

  • SHA1

    94a6f156fd3b6fab30427a15677db8eb5bdb938f

  • SHA256

    3631e96ebbe3e23adb14b70054610e4c942999b762a5ec525ec88d9f232ae052

  • SHA512

    5aa7b831810f55769bc4b41fac7ceaaeeb17ddd3762a338b74ff226cdea6316537457abb3fe79f9d9e7805292a181ab2af9cf8ca6f34c565f147f11c4f5fff1d

  • SSDEEP

    49152:IlRsEXeeKFqj7845iS7xrGIvb0LP1jVKSc/uUDxzuH/9VFTyw6C:SRsgYqj7V5iSRGh9VKcCA9VFGwn

Malware Config

Extracted

Family

octo

C2

https://b7894f717e707b8ac8282b15d3e99653.info

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.tefor_menu01
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4224

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tefor_menu01/.global.com.tefor_menu01

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.tefor_menu01/.global.com.tefor_menu01

    Filesize

    260B

    MD5

    4e5967fed17a2ce2862e4424e50d66cc

    SHA1

    459544975725900cf4656e9bf3f2b1874dd63344

    SHA256

    f44c18a993a9cb255882a6004e6eb19cb6578666f6e1c7e75cee13c7ecc8e79b

    SHA512

    95625fa65e46506c2127d583c624b071079279e8b0891590344389bdd48d92e5351710a00dac991959f6d2c976ec9c558a9ceaa712b59179ddc00387d3c44883

  • /data/data/com.tefor_menu01/.global.com.tefor_menu01

    Filesize

    260B

    MD5

    484753cba9b35f0871e5a2a4021eb039

    SHA1

    bc427c1475306ce0f59697b7db61633492a4f001

    SHA256

    0666c8dc36cafc2d0f2d15a7b9099ae0f9cea4a3ccf3cbf9b5c68414a46dc98a

    SHA512

    87fa2c64e269364c7bdc8ef66549f64bbcfa7d09242bb1b7969e322ec6ddceb6a5e1e2c4e98233f3b071177b32689d19ca9aca4d51e4c3a08dfebc4ed2c7ab85

  • /data/data/com.tefor_menu01/files/.a

    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

  • Anonymous-DexFile@0xd0578000-0xd05fb7f4

    Filesize

    525KB

    MD5

    c4b2d3ac6fbf26656a497c1f733d4c61

    SHA1

    4923dd730b15bea44fb69fe0b5f5f3e22fd7b099

    SHA256

    9d08e3c3c9d027b352f4492195970166895a60e36ee64ecda57f04831e7491df

    SHA512

    27b9e3bd24d6c845a7fe4dcac64ff34ee1e4dae7cb0ed0e9af135f8877561268bf6f4690d98fd21e02f7b8b35c8ec9f96552897c386431e16f7f1eaba9ab18f4