Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    14/12/2024, 22:05 UTC

General

  • Target

    4a3419d3489e95fe32a925a71a8484867932f289f63099d00c53f25627e7e411.apk

  • Size

    2.7MB

  • MD5

    13513929f42048f9d3fefb03f48df81b

  • SHA1

    8b0fddfac6a2bff128f2f24fa7c370973f4e7dab

  • SHA256

    4a3419d3489e95fe32a925a71a8484867932f289f63099d00c53f25627e7e411

  • SHA512

    a65612f865d6706bc611b54e0c521522b98c6fec4c0cf88cd69876cfbbbde87e9929ca795c60bc34c7d81e9a2f4a02d7def99262892deb449c4f1bdb87a0eb05

  • SSDEEP

    49152:Yflb6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQP:Y5FjEI4iZaUzYH99yIK

Malware Config

Extracted

Family

octo

C2

https://80.76.51.206:7117/gate/

https://80.76.51.206:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://80.76.51.206:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4246

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 3479
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:05:55 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    www.ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    www.ip-api.com
    IN A
    Response
    www.ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://www.ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Host: www.ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:05:54 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 291
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 292
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:05:55 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.204.78
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 2198
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:06:20 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 854
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:06:33 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 476
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:06:45 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 428
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:06:59 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://80.76.51.206:7117/gate/
    Remote address:
    80.76.51.206:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 425
    Host: 80.76.51.206:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Dec 2024 22:08:01 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 142.250.200.42:443
    tls, https
    202 B
    40 B
    1
    1
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    4.9kB
    25.9kB
    19
    22

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 208.95.112.1:80
    http://www.ip-api.com/json
    http
    328 B
    600 B
    6
    3

    HTTP Request

    GET http://www.ip-api.com/json

    HTTP Response

    200
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    3.0kB
    97.5kB
    43
    74

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 216.58.204.78:443
    tls, https
    858 B
    40 B
    1
    1
  • 216.58.204.78:443
    android.apis.google.com
    tls
    4.7kB
    8.3kB
    14
    23
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    3.1kB
    2.4kB
    9
    8

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    1.8kB
    2.3kB
    9
    7

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    1.4kB
    2.4kB
    9
    8

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    1.4kB
    2.4kB
    9
    8

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 80.76.51.206:7117
    https://80.76.51.206:7117/gate/
    tls, http
    1.4kB
    2.4kB
    10
    8

    HTTP Request

    POST https://80.76.51.206:7117/gate/

    HTTP Response

    200
  • 224.0.0.251:5353
    3.7kB
    11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
    320 B
    1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    216.58.204.74
    142.250.178.10
    142.250.187.202
    142.250.180.10
    216.58.212.234
    142.250.187.234
    216.58.212.202
    172.217.169.42
    142.250.179.234
    172.217.16.234
    172.217.169.74
    172.217.169.10
    216.58.201.106
    142.250.200.10
    142.250.200.42

  • 1.1.1.1:53
    www.ip-api.com
    dns
    60 B
    76 B
    1
    1

    DNS Request

    www.ip-api.com

    DNS Response

    208.95.112.1

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.204.78

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    404fa5eb2e69f5ed1f379db95f04c103

    SHA1

    23ee605a0f85e97f0d94bc29e985b34839cd0625

    SHA256

    bc9665235d318c788efcb38523cad8062294e5fb442cb8ca565130294dded247

    SHA512

    74608b9a784dd200592af4f63a3630b4d332ce32515729cc91f2577a7826b6d31b5f14f5a0f2e6cd979749eadf5a468aee0453cb5c2ad69dea7261e5fc361249

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    1edb281b9ba9ce011cee6322a2a0ba25

    SHA1

    99196d6c2f44a911b9ea410a163612d3ac72ad6e

    SHA256

    5234e5e624d0327cbb7c83b03e7ca34baa7557dd1b66b44e9c92b8ecf0ffcc70

    SHA512

    4d66a72f1aa820856ebb84567cbdf67924d55727e7384e1c605d6d986e216a1ad837ffba17959cc94eb6b701105d8204fc88f630a86336e1528dfb57c45f82e4

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    9ba27f9ad22111dccf7905cf666c9d41

    SHA1

    365c89c35423692a160d29c26270ed0eb055d5fb

    SHA256

    5af18a7dd82b476aa3ab5556fab6f6e8bc17796baf44e2895829c57dff60a6a8

    SHA512

    f1e72dad54539ddb3ab2a97135493048be43999379d10c3f4cac6ebfe13c28e7984331020a5e48874f753ef06241867086c031b975c095501384466696cfd467

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    2dc8fc18a626fb9b6dd423bc3dcd0759

    SHA1

    44e08bbbd0178b2f8ed431ef72ce3edf74249a62

    SHA256

    0b746a6bb0ca70652cc36c950f918adab8bd032da7d6146a626f03d03d0316f6

    SHA512

    909568d46fa119c208262b5ff46013f3e671bbb834c335c85f65f0a01c5b79b73dda7ee660fbf5af08046eb0112ad068cbb2fb1379609a056ad5c20e93f8f6c0

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    b448bbb4a256fb181b7f5f96c9957026

    SHA1

    59a4be572dbbe229d03724ba2239e3d6056625ae

    SHA256

    1590a6341d0dc2d61061a33cd1819340a6740eacacbe96121035aa5ff10a28d0

    SHA512

    caee0a9b6fd9b80c0935fb2d78e8c5fdc9772eed733da54d404567241118982aaf1c32a62b57a7c58b07b563118eee76d3317caf63d23ae532c46f1773ab03df

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.