Analysis
-
max time kernel
129s -
max time network
135s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
09/12/2024, 20:58
General
-
Target
db877682fd0d489d9cb9aa1083ca05aacd61d9e63675dee50c10b010e3946000.apk
-
Size
4.8MB
-
MD5
d3da3e52be0eb1ce46533f7e36f50e1c
-
SHA1
fc58ac245d61664428727ab4afbad68b7b86b0e7
-
SHA256
db877682fd0d489d9cb9aa1083ca05aacd61d9e63675dee50c10b010e3946000
-
SHA512
0ad81172b5b3aacfb13855fa3f300f939e7480a1857337e76dcc2d68ddf8eee563d6c817f7cea42a8cf4c107fc7d6a4699969789100764549fbba54b0dccffb5
-
SSDEEP
98304:O6PRNrPJ44RsVRdxaKgBemDx2+Po2DEN7Y06c9VreJ5L+UfVoMz0KpLpj:DRN7JDCRHabJQeo2mY29Ne/CUic
Malware Config
Extracted
nexus
http://109.206.243.54
http://109.206.243.55
Signatures
-
Nexus
Nexus is an Android banking trojan related to the SOVA banking trojan.
-
Nexus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 30 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.car.debate1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.car.debate/app_DynamicOptDex/LAGt.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.car.debate/app_DynamicOptDex/oat/x86/LAGt.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
3System Checks
3Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD574ee6286df3aa4521e5fdd6ee2477b79
SHA1bce0760b786c0c6f0bcb2b580ead622ade38aedf
SHA2562577bf7ba7953d11b816c0174efb60f68d32fbc0fc484f1e83ec38e9667d78c8
SHA5126a355b2e3e35af509ef190de5b103b39bb594b3987f86b25601075a23a45ccf019f1ddfcce2aeee57136ff55c025b1dc210d5c9d9ae6354638e4d306d4f18366
-
Filesize
2.2MB
MD5da56247f322aa732e5c1b79e016339ae
SHA10b31c293536e12dd284218b82e3c596dfb6f4ddb
SHA256bfe9cab5cfb0353027005ad0cefbc43f757faab39435bcf3f76d8f1b19b076f0
SHA5127f4b95163fdada7574948dd8e528d377bba538907fbae90db5c9df9a0a50bbbb2fb831c7b11b0c4c2361c52508bbf9ca19d075c74777120acc4a6baec3b6f7c8
-
Filesize
2KB
MD52c6ad987068abcd456d2c75adfd91013
SHA12bdf5eb037463a6cd79acf4727b2733c04867692
SHA2563e6ba8e4268f126a92519f35b96373ceab51bf32b744e35d978c90e7e0ab2c4f
SHA5128e96b1ee01422825b3448e557c8d2e2547c69638ad24bbc4da2dbd8ecd1291577db56a047a84a1e6f251ec660b7790a8fd231b6b20ce93ae95db60c90f999211
-
Filesize
2KB
MD511fd43fbeaf35a81387a4ef1c1483c0a
SHA1428007d445d75d99795f4d414e44034e39753934
SHA256d74ed122828f73c1a97a0e2c9a037ff831a24a774a148db2658ca6dd8162a991
SHA51287327731c2e2bb9d0ecbb855d6038bcb07f794f93f76422f29b9b492626a1c27a2a501d2dfadd4a443f4c3a3ae4f93f2df893d01237e8b051a8a588db37be138
-
Filesize
2KB
MD57415c82e02016d11c8e0f55b5903132e
SHA1dcd49ae4f5f9947cc1a73f35494ca1f98566c873
SHA25656bd630f4083ec199c1d2a5cbd12b3964d3604b36503c100e58cf3a3090c251e
SHA512b54c21235b0589839948b5c98e1049206fb587245aede3dff887dcc78cfbb8d99e81f33ca3599e24d1ab476c1bf142d97d66f15ba3f10c27d9b3c203a63c6e7a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c5507645ac4dbe10b3a124084aa959be
SHA1d4bc38a978b65fe0f00a5ca25b9b4463d04af016
SHA256596595c90943d7ed46e3e07b322a2739d85333ab62942b289681d48664857a98
SHA51250a2430e379ef98a62e18550c4772788f99a26ca14d71190d156d6f9e0cd42d3625f01e56ecc7842a4965e4ac8b9b9caa6b531abea086c1f79b77c85efa061de
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD53e6364d226afc9db8d5e192052d02b4e
SHA138c31bd6342761debe2afbf72a6f26e047a97213
SHA2565c3c7200d25cfee1562d7ea129ef9579add269985af3704769db15f355a0981c
SHA51241f29d9eab3a3f611ca01160c9044e788c7ddd1be2fb6089c66a9361e9cf6e1cb400147aa754fcd76b42a513ceb342473dfca73220f15479cd7734f1dce6bc6e
-
Filesize
221KB
MD5efe1888d826f335aaa8183277b680ed4
SHA1b6b516b3e6544ecfca24a38d0278a03a9edf0dbd
SHA256011bce867fb9d8d3c7a2939fbe256f43e8b0385458535b393e7b65e6dd10407a
SHA512d216691da85920b9bd1d50998c34d94346a6e94d7153648fdc28a5a89e0ce6e106eade0a9c54859636aa94f17cd8fc1dc7cd5a032e998eecc970a77df1d7e1c6
-
Filesize
16KB
MD555b71a07a4906ab9baf38dc8df3f7746
SHA189b60ecbfa3a31e36d2531c70ccfb82ee242b762
SHA2563e77c19d940a5bcb9e850a1ca086b59139cbc574fc098df5125aa622df3defb1
SHA512aca441775488807550a9de5682ebeba6b1709da0965cdb9f3d318670d3f268eb1f4bd024bfefeff8151eda3761100fb5a2545fac4b852f20736e32c367baafde
-
Filesize
6.1MB
MD576f89ae779d54f4a3f40adfa812958ee
SHA1b02ee57fa4c9e81d45be9aea84b08ec167d8fa31
SHA256e65d6945c6f4dec090e4bea1417bed015e03aeb4bbe7e3a8a32f730a58f36e2e
SHA512e4a77901e5f69d80e218aa80f6a113786b8d91899ddf576af9b7448966e47e1a2ab6b3c1c0441a77a3e8dfe556d45019d410acc3deabff4b12ce79c0a8aff704
-
Filesize
6.1MB
MD5cc20cd55132e50678f89fd6c8b862801
SHA12e2bca371167f78001b13f73e2bbded35fac84af
SHA256e0f9a272f590ad53309e8d8aefb54cfed7c6d2113ff2255528bb739b09fc5579
SHA5123660bdc5a0a6e99c0de6595c1c365143f6f26a9e44e46195dce3fd570cbd65f5c558be69a7f0a60843908a607792b0c2bfb4009c818d8c50b1a65e44ba321b8e