Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    03-12-2024 22:14

General

  • Target

    447bd0ed5d5d87ca761482d0684a30a6106c696ed196d89e7500cadd3ca0c1b4.apk

  • Size

    2.7MB

  • MD5

    d44375020cc9a69c30442a33fa9446bc

  • SHA1

    48b6609b33676a53b5469087e896db161fcca848

  • SHA256

    447bd0ed5d5d87ca761482d0684a30a6106c696ed196d89e7500cadd3ca0c1b4

  • SHA512

    4daa4b29c50abfc23a677d40e151b1db719b2595f377709bf3f07f7f7c7e611c7b363cb0b8b5f1f03f35e44fe5a23fd13f28f269e85e610490e887f9a9929a68

  • SSDEEP

    49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQC:e4FjEI4iZaUzYH99yIx

Malware Config

Extracted

Family

octo

C2

https://45.88.88.100:7117/gate/

https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://45.88.88.100:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4259

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    96befda53750c480b74be75299770043

    SHA1

    7129d1c53b0bc420997d402358127dd59ab167ec

    SHA256

    ea5cf2b0990baa09d6b40cf88eefed9cd218af40a1f3fc4c862695eaf69539f4

    SHA512

    eb52b056549216883b867f88455af3851e77140883415a42c5662022d3e233ea1c1c09325508b9237db2faf82be6d10b4d6552e273d8749885d49a0139aab1eb

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    9e816d05853b3d3b27a3bee5abfa1816

    SHA1

    dd2a0fb299718ddb340d620853d294cdafaed642

    SHA256

    3471b1b992f71dc37ec7cca02a974274d4e1342e4b87d91611da2f147b72f103

    SHA512

    27f86b5460c7c89cb034df4bd55f1e35cc7a14a1a95436f930fbe8b2beb5901286bcb34dcafb165346de5c978d8000d1a4d8c207ff039ec7128ce60582ba5b8e

  • /data/data/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    049106dde04023ee7c0f0ec91331e535

    SHA1

    4d6ef7355b0b955188bfb34c04a95954eca2073d

    SHA256

    bc101f93cd294603c55f6bb6bac3ae4b97ba40053d4dbceeb12e2dde43631eb6

    SHA512

    676904b86db452f91ca1a736bdc9259698d892e283316995cfd82198748699c4a01306a1d450ad10b1a9e324d0a38a5d4453ba232f445435f08851eec5026e35

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    2ee2de593fb95ea639f069606bca4eb0

    SHA1

    f3ad6ce212dedc4acc6c80328f7532398e11d338

    SHA256

    f91c775ee31ad151aea1037e022d5a4744378a8cfc9e870f686cf186c9f9e60f

    SHA512

    02fa0e9fc5e52bea904130aa523dad349c8dc530aaf82a6d35e692189d612736ade1f6b1d6f98c5d21c7b220449b065f80030d3df57efbfa79ce0342ca0a6e24

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    be2c22f56317a5bb6297ad41e5e4e1f6

    SHA1

    f29881b989b05b39bc1a960543346c84c8f00301

    SHA256

    e31dd0c6d1e95897a36ba19f292caf64d0ed5b47fc041352b9cb8bf78a8c45ad

    SHA512

    394e153e8cd607364dd6d65a1cfe6d9e3bdc2caa07dc6899f5cae125224f23891b7d3ae56a508a46921cc28c52a0cfff8501d95f496e3bff9e920366344b1468