Analysis

  • max time kernel
    54s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    09-12-2024 22:03

General

  • Target

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176.apk

  • Size

    188KB

  • MD5

    b696c4783a18fb9927328ea52fd90ebb

  • SHA1

    b52559586147f8497ce18ef08ea842e23382c63d

  • SHA256

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176

  • SHA512

    62ea74e26e6989acb10d88a714831ec4f9691fb56d6b3ba03ad6de05073af6ae34fe08f1b4188655590219c7c8be270c8e829ac6c636f8cf588044f18cc5a500

  • SSDEEP

    3072:aRZ8bmdcEreU1STVizAbqMjFywt6xg2icXcplvKEslH2k9tdh+xKU:4FdteZSAbq8FyS6xr3XarslH2ytdh8

Malware Config

Extracted

Family

octo

C2

https://154.216.18.131:7117/gate/

https://154.216.18.131:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://154.216.18.131:80/cc36748fe5d4be90e373/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.adaxffsfzfada.zbsvxgsvbxhdgs
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4971

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    10f66580ad64463a11600093277e2a4a

    SHA1

    e8aa26465c3633fc46280034ba5e9571ca78f153

    SHA256

    1d858774f4ae82d3d207581218a782b5418168cbcf38690baabb1cb1ce4b94a1

    SHA512

    b9c2547e839205ccc05407a39811dde193d77ec61efa866231eecde89d57b121c5bcf494d52d738e401518a7b499a7d23a6081c0fe5043113dd02e5e1a5a2bd0

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    d192cc38de6db015c005c5a6f16e9dc4

    SHA1

    c3426d9f9150c82764624718fcbd42e80ed5e4a4

    SHA256

    85dcb47a673d11d60ba2b52afd8356d81d51e63c7644dcfa6bcf9dcd96abf60a

    SHA512

    dc277d2d85e091aa59e385d7b9d3cb0f9187933fb1a0fa59ec1889ef52911003b14487518ac75cd4c25371a0d8f0dac5a1133d90c46b0ebf3ec709d5d95df67b

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    41f79bfea1081c9c624f1598a0e11934

    SHA1

    d39b0a1169da57e85ee515fb9078078d2495237c

    SHA256

    67d1b0176202ba45ab0f4b9a0fc965064b61308ae5300c49dc1d606565a33e93

    SHA512

    3a3d5a878a7ca17489d81104905804695ec8f417d8da1909cc71aa13e88dd8414864751a15f4265f227009a91dfbbd7db728cc936bd03e8ffb680c9cc42b2b87

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    1988c643fdd4058d79e215774cf6723a

    SHA1

    3b4e4385ddddcea00e87119cbc9ce60a05c869ee

    SHA256

    549179169a13ccbbc67105aac1a3d1aba332f545c412bed420a833551fcaebde

    SHA512

    f25b70e919602bc78f38c2f60c03200e0e44725c3e0fbfd4609d5780f215adba7e9edf032417a8d026fa52144e3d348730f80a942de920106314083bc328eaf4