Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    09-12-2024 22:03

General

  • Target

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176.apk

  • Size

    188KB

  • MD5

    b696c4783a18fb9927328ea52fd90ebb

  • SHA1

    b52559586147f8497ce18ef08ea842e23382c63d

  • SHA256

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176

  • SHA512

    62ea74e26e6989acb10d88a714831ec4f9691fb56d6b3ba03ad6de05073af6ae34fe08f1b4188655590219c7c8be270c8e829ac6c636f8cf588044f18cc5a500

  • SSDEEP

    3072:aRZ8bmdcEreU1STVizAbqMjFywt6xg2icXcplvKEslH2k9tdh+xKU:4FdteZSAbq8FyS6xr3XarslH2ytdh8

Malware Config

Extracted

Family

octo

C2

https://154.216.18.131:7117/gate/

https://154.216.18.131:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://154.216.18.131:80/cc36748fe5d4be90e373/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.adaxffsfzfada.zbsvxgsvbxhdgs
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4820

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/.qcom.adaxffsfzfada.zbsvxgsvbxhdgs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    76B

    MD5

    bf73c89f1aa9d325b0614e8ff12a97da

    SHA1

    68cd9d7c922012c16d90705bc17240f6f347a236

    SHA256

    614e13a438f0f4d2b86c75c16d53d90de89201e013d3edd0e70330cf4be46ba1

    SHA512

    eab0ba7396f199c76f2eb8672275cb12efda328f9d88fc8b18e9040b3a0ff79c0d2c02b85afb7ab91379c9a785f870ad3606df94c33689f35d405cce48250edf

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    9bb476e90a4070874542f6888f56062a

    SHA1

    54b3f6744bc347c7949637bf4223ba2cf1a51ff3

    SHA256

    5f0ea52c5b8b0d4e2e433ce23911f2181e97a95e7bae4a662501ebdd8393c200

    SHA512

    542ac11e15ea87d9bc038658679bf08fca90d8451fd500745e980038c5597cd2fc015fa326c387c7f7f32acd0c3d9a1dccf276a761f87895fad392ea981b9f03

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    4ba10c102e87c8396514a32dc36976c4

    SHA1

    c951a024819aae8f98a96e0ea92d84f6103cf9f6

    SHA256

    b173282a89e903b0e3b6f05213114469b371ff35767a2529af0f5ee441be5694

    SHA512

    1eb108969fd0768146e6bfc74e1f93323c6ece0c5c63937abd1b77ebe7f7124bbff015524f0d19c227ca09b3800c1b106309d89a15c0d3137d9409f9a50a2b74

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    e8a0fbb53510e265681d8ad1c5fb6a2b

    SHA1

    0daa8a9a990f7f90c5e618ab350fb6bcc722f8bd

    SHA256

    d36c9509f7bbf46b60b699bce47244aebb896e6f15c0fc9cbb8418789bb85be2

    SHA512

    ceceb93c5f514cbc3289f562096382a32770ab9b6e1a54edbed249df90ddf0373ea901be7c3d94eea19110b91e563b62a79de58ba1e416f91552152386276944

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    7aaece43c088c701357c5f1aa1309b2b

    SHA1

    f29b785646948d3819372229136ea35b2f2689c8

    SHA256

    253329835b77bea79b9bfc655faefbaeeb322905e9cede3e8afc9e85f307d814

    SHA512

    4cba3f8b1ec76a757add5ad6f20d7818a04c330d58592c5e664cc0717224f83265310347e564476f64a01a36703bb01ca2e714243f4ec669d19aeae520d9563f

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    466B

    MD5

    440fa72d4932d256395ce1219057914c

    SHA1

    f5fbe990ba6df53ecd4d97909f3c1c74f732969e

    SHA256

    25e5e1f0c0443c006823d1375080a13f72227322383ac891bd39221694d0c0c5

    SHA512

    d5900abccfb3c41357f80ef6c84853cb24739257d647d8fb5317db3ee388ccd9050224ba8b15044e8d3829e0cb7ec8b3b7e0efd495a6da1980f652bb998e014a

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    dbc107b6a630be3d0cbed9a034491afd

    SHA1

    a3b6bd48fb5f6020b30210758720037dbfbf7e26

    SHA256

    ab2effa65287ba093d165342e05a189a6ab01a47b7d44b5d07debe7a69022e93

    SHA512

    613698d71aa8ce12b7885f67d7e86d73262675c99d1fcba33d2dc5bb3ce79331314de93d5ef1886c5e482e9c82541b875d14a6a533dab7dfd10e21eaf3f3236e