Analysis
-
max time kernel
126s -
max time network
133s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
09/12/2024, 20:58
General
-
Target
db877682fd0d489d9cb9aa1083ca05aacd61d9e63675dee50c10b010e3946000.apk
-
Size
4.8MB
-
MD5
d3da3e52be0eb1ce46533f7e36f50e1c
-
SHA1
fc58ac245d61664428727ab4afbad68b7b86b0e7
-
SHA256
db877682fd0d489d9cb9aa1083ca05aacd61d9e63675dee50c10b010e3946000
-
SHA512
0ad81172b5b3aacfb13855fa3f300f939e7480a1857337e76dcc2d68ddf8eee563d6c817f7cea42a8cf4c107fc7d6a4699969789100764549fbba54b0dccffb5
-
SSDEEP
98304:O6PRNrPJ44RsVRdxaKgBemDx2+Po2DEN7Y06c9VreJ5L+UfVoMz0KpLpj:DRN7JDCRHabJQeo2mY29Ne/CUic
Malware Config
Extracted
nexus
http://109.206.243.54
http://109.206.243.55
Signatures
-
Nexus
Nexus is an Android banking trojan related to the SOVA banking trojan.
-
Nexus family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 36 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.car.debate1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD574ee6286df3aa4521e5fdd6ee2477b79
SHA1bce0760b786c0c6f0bcb2b580ead622ade38aedf
SHA2562577bf7ba7953d11b816c0174efb60f68d32fbc0fc484f1e83ec38e9667d78c8
SHA5126a355b2e3e35af509ef190de5b103b39bb594b3987f86b25601075a23a45ccf019f1ddfcce2aeee57136ff55c025b1dc210d5c9d9ae6354638e4d306d4f18366
-
Filesize
2.2MB
MD5da56247f322aa732e5c1b79e016339ae
SHA10b31c293536e12dd284218b82e3c596dfb6f4ddb
SHA256bfe9cab5cfb0353027005ad0cefbc43f757faab39435bcf3f76d8f1b19b076f0
SHA5127f4b95163fdada7574948dd8e528d377bba538907fbae90db5c9df9a0a50bbbb2fb831c7b11b0c4c2361c52508bbf9ca19d075c74777120acc4a6baec3b6f7c8
-
Filesize
5KB
MD5dcea760524ae7f589636e2c347e8c129
SHA1b0c4b1c0a2508959a4ec5867a76f5f947d74c791
SHA256eca1dc066749eac302c1e1892540a8b7acfcf1fa9df873a5c6de9c565adcc1ef
SHA5125ae04c611a068167b4eaed26140a034d6473acea0ee7a1b90ccb157928e9a16bcd3c352c3bf675744e79855d432ac7eb3fdda8228cf99b00f0f5afad26771844
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b2a487b475def3050b0f5f602324fe76
SHA17d87d5d80c603cd25748b83ad41c4e1d000d3e85
SHA2562a1e8232fc82f68dda90c94397f49c0b15e1c591d24453c6804571cc70975a6b
SHA512b464d137ef5a71e14be8017e217a661d9b7c98182277f0550e5b6c79bdfe078304581983f96d190b04c7304f97d4806030976419c97847d63f9c0686b318f635
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d3a5bfbb08babdd852de1d78a31f2d92
SHA1bfbc76817c0dad993beeebe29c5ce13c43633809
SHA256fa695f58172db7d226fdc4b7861966fd8d0f7ebb4692b4402b1f5380a9994cd9
SHA512a37f79c0b3c672c01546f0cf50ed8e7d9a934f5c94066b0046d349bdc85b16ae1e4402c1951468dab68caaea3aca266e88c20c60418deb1afef5e5bf1c24ff1d
-
Filesize
108KB
MD5888ba06e82fa6ea5d83cda81e17ebc48
SHA153a422b67de53f94b88d7abad5c149f1503493cd
SHA25639d8095d76dbd55c4d9ab619b49c64fc4ac78b598565d65eca7f8f419a3b1c3c
SHA51296ce49fb22ca92ae9aba9b8dc3152fcf1f1c149e3ba2f52fe834f9431d08fa155f17454f65857d7dc1aae8d791e15bf47ddb27d34321f003a531d9f23a6b0a72
-
Filesize
221KB
MD503bfe62e4b788d34efca64c31987d058
SHA194a484aa02fab030d2e0614bc1fc54a4b6744b48
SHA25663a15f54220317484c5ddbec6fce40b996e803dac4f6e805a9035ed209f7624a
SHA5126c28d351e2804dd7e9190dabe3cbb70f979c3cc3c9496b769925fd25689528c4b22b88e76de6d92bd818bd09078ab53e74614063782e35a7d1ef181267461bae
-
Filesize
6.1MB
MD5cc20cd55132e50678f89fd6c8b862801
SHA12e2bca371167f78001b13f73e2bbded35fac84af
SHA256e0f9a272f590ad53309e8d8aefb54cfed7c6d2113ff2255528bb739b09fc5579
SHA5123660bdc5a0a6e99c0de6595c1c365143f6f26a9e44e46195dce3fd570cbd65f5c558be69a7f0a60843908a607792b0c2bfb4009c818d8c50b1a65e44ba321b8e