General

  • Target

    Mi Claro_6.3.apk

  • Size

    25.6MB

  • Sample

    241207-nezbvswkgl

  • MD5

    7f57038559a8efaf1b1ee49d7cd7f3da

  • SHA1

    f319e1297e5353fb374a11ded4470609f3d0a356

  • SHA256

    539704e94b7c35db615c77221edfd1922a354caff36afa4c843ea29e1741d072

  • SHA512

    71ec2afc3d31f2947b751cfc9e06b9468dc39fa73abdaa8e710bc9ff3a53a7cb25a257db6e3a02d03475c756173d9f2199e592a7b4c4ac879df6473bb83e526f

  • SSDEEP

    196608:kEbFmmbWHwgF7DbhwwRG3eQ/+ElmHJXLvHF347Q4dwPmwDZbcFqZNYUmEwLCO:5bWQgB1G3esQXLvHG75wFFcFqMLCO

Malware Config

Extracted

Family

axbanker

C2

https://claroclub-app-firebase-c7c4b-default-rtdb.firebaseio.com

https://claroclub-app-firebase-c7c4b.firebaseio.com

Targets

    • Target

      Mi Claro_6.3.apk

    • Size

      25.6MB

    • MD5

      7f57038559a8efaf1b1ee49d7cd7f3da

    • SHA1

      f319e1297e5353fb374a11ded4470609f3d0a356

    • SHA256

      539704e94b7c35db615c77221edfd1922a354caff36afa4c843ea29e1741d072

    • SHA512

      71ec2afc3d31f2947b751cfc9e06b9468dc39fa73abdaa8e710bc9ff3a53a7cb25a257db6e3a02d03475c756173d9f2199e592a7b4c4ac879df6473bb83e526f

    • SSDEEP

      196608:kEbFmmbWHwgF7DbhwwRG3eQ/+ElmHJXLvHF347Q4dwPmwDZbcFqZNYUmEwLCO:5bWQgB1G3esQXLvHG75wFFcFqMLCO

    • Checks if the Android device is rooted.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Queries information about active data network

    • Reads information about phone network operator.

    • Checks the presence of a debugger

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks