Overview

overview

10

Static

static

10

20E8688726...FC.apk

android-9-x86

7

20E8688726...FC.apk

android-10-x64

7

20E8688726...FC.apk

android-11-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    20E8688726E843E9119B33BE88EF642CB646F1163DCE4109B8B8A2C792B5F9FC.apk
  • Size 13.5MB
  • Sample241217-wtwhhsvmdq
  • SHA256 20e8688726e843e9119b33be88ef642cb646f1163dce4109b8b8a2c792b5f9fc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sharkbotandroidbankerdiscoveryevasionexecutionimpactpersistence

Malware Config

Extracted

Family

  • sharkbot

C2

  • http://statscodicefiscale.xyz/stats/

Targets

    • Target
      20E8688726E843E9119B33BE88EF642CB646F1163DCE4109B8B8A2C792B5F9FC.apk
    • Size 13.5MB
    • SHA256 20e8688726e843e9119b33be88ef642cb646f1163dce4109b8b8a2c792b5f9fc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bankerdiscoveryevasionexecutionimpactpersistence

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Acquires the wake lock

    • Checks the application is allowed to request package installs through the package installer

      Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

      evasion

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks