Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    05-12-2024 22:07

General

  • Target

    2d9f71eb5fc64f0e1a5ba3b03281a036c9106525c81b459dafd9e77b62c721e2.apk

  • Size

    4.8MB

  • MD5

    bb7e458ad3d6747bddbce5d1ad9537d7

  • SHA1

    c23dcdf3e40057c6af4b8ec820ba3ecb06715648

  • SHA256

    2d9f71eb5fc64f0e1a5ba3b03281a036c9106525c81b459dafd9e77b62c721e2

  • SHA512

    5c4949118ecd6b5e6708c99a966c86a19e4ff8e0da46fbe947ff9babf24194e364bf1380c40fcd5a2c9648ab9f40744589b9356987ce6d9efeb9dce9458a36e4

  • SSDEEP

    49152:MRsEXxwBGlAK3c3XDf45iS7xrGBGpfFRwjVKSc0sLQoXvLjW8JDF2pS:MRshBGlA6c3X85iSRG4uVKXPbd0I

Malware Config

Extracted

Family

octo

C2

https://1d99bd214abbc152dbac8d190004a234.tech

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.estsoft.alyac

    com.ahnlab.v3mobilesecurity.soda

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.customizations_turbon5
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5088

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.customizations_turbon5/.global.com.customizations_turbon5

    Filesize

    260B

    MD5

    484753cba9b35f0871e5a2a4021eb039

    SHA1

    bc427c1475306ce0f59697b7db61633492a4f001

    SHA256

    0666c8dc36cafc2d0f2d15a7b9099ae0f9cea4a3ccf3cbf9b5c68414a46dc98a

    SHA512

    87fa2c64e269364c7bdc8ef66549f64bbcfa7d09242bb1b7969e322ec6ddceb6a5e1e2c4e98233f3b071177b32689d19ca9aca4d51e4c3a08dfebc4ed2c7ab85

  • /data/data/com.customizations_turbon5/.global.com.customizations_turbon5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.customizations_turbon5/.global.com.customizations_turbon5

    Filesize

    260B

    MD5

    4e5967fed17a2ce2862e4424e50d66cc

    SHA1

    459544975725900cf4656e9bf3f2b1874dd63344

    SHA256

    f44c18a993a9cb255882a6004e6eb19cb6578666f6e1c7e75cee13c7ecc8e79b

    SHA512

    95625fa65e46506c2127d583c624b071079279e8b0891590344389bdd48d92e5351710a00dac991959f6d2c976ec9c558a9ceaa712b59179ddc00387d3c44883

  • /data/data/com.customizations_turbon5/files/.s

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.customizations_turbon5/oat/x86_64/[email protected]

    Filesize

    169B

    MD5

    f973702f4ceb5027fbe72f7407acce32

    SHA1

    22cfcd6120617f5b440e4da2ef60d2f4733cf9cf

    SHA256

    70b67273e032aa31d42caeea572fad864df4e2ae3824256ed61d8a5a706ba061

    SHA512

    ed621a5e322d863fe7b089e3b60092f2d8b945622a4e9aa32759d8d787bcf01a5870acb26dee32ad183702ab27c5750f6ea3fdbdcd92c506969abbd071cb34fe

  • /data/user/0/com.customizations_turbon5/[email protected]

    Filesize

    526KB

    MD5

    cd3780db73f6726a0b309fc4d47bb3aa

    SHA1

    10913262e78e32fbebfd3d531546f838c97fec72

    SHA256

    603414e7f2d3b237b65c2b6848940d7a0712310db00a9cc0bf5df697849f7176

    SHA512

    a192c69e5e6cb18034b87d85d9ed45062ff9baba322248c608017e697beaad15ae2058c23b45b78a829c8afe640fc7e89344a7299b474a66e8074baaee6be901