Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    25-12-2024 14:12

General

  • Target

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176.apk

  • Size

    188KB

  • MD5

    b696c4783a18fb9927328ea52fd90ebb

  • SHA1

    b52559586147f8497ce18ef08ea842e23382c63d

  • SHA256

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176

  • SHA512

    62ea74e26e6989acb10d88a714831ec4f9691fb56d6b3ba03ad6de05073af6ae34fe08f1b4188655590219c7c8be270c8e829ac6c636f8cf588044f18cc5a500

  • SSDEEP

    3072:aRZ8bmdcEreU1STVizAbqMjFywt6xg2icXcplvKEslH2k9tdh+xKU:4FdteZSAbq8FyS6xr3XarslH2ytdh8

Malware Config

Extracted

Family

octo

C2

https://154.216.18.131:7117/gate/

https://builder; 154.216.18.131:7117/gate/

https://panel; 154.216.18.131:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://builder; 154.216.18.131:80/5db7e5d4bd11fc539337/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.adaxffsfzfada.zbsvxgsvbxhdgs
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4257

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/.qcom.adaxffsfzfada.zbsvxgsvbxhdgs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    e0e7486ca75f222a05b8e78a38bc5bf6

    SHA1

    ed366e23ea0d84f3aea2906b8d1d3ab17628609f

    SHA256

    b4850699fc394537f15f1efe782e35f93387c03eed94b34cfa4ab9c46fd4c732

    SHA512

    03ffafb9e166eb3e7a0d115221c4f2683dbfd293dd8944dda405eb05c3133855cb1e4bc6bfcffab4e1b3b192e787c7c20735d7b40224f85cc0ce52b75ca06c0a

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    9da620a34530a622b73ed017b7c8bfce

    SHA1

    cdd02db6f0c4b0d23d80feaced279768e9683378

    SHA256

    9d1e7302e35e5618d8f1271a83bce29ac16002914bce54cb556a535f3201f4e2

    SHA512

    724ef01fa69949ffe94a0a82b8ae858ef1df9dc2fe354a852e187fd23a76cde89981a1a1b5f11511900e70980c33feb1894bf13e1e788c7255179a332b11e53b

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    54B

    MD5

    5a9f9f6179d539ffb42f866480565403

    SHA1

    1ea2937547119a8c4efbc5956bb4908f52df1207

    SHA256

    0bda51b308a1cdfebead086421b77be91f70e1e317fac30974be000d0b553c38

    SHA512

    43d6c63b2a83305076460dc7517a0a5414c87bed379ee40a12caf07accfd9b59b0eab090834ebe417d9eeaf805ca76d85bbc49b711d20f2ce2a9c64de7a4c0a0

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    423B

    MD5

    8df8e8ae505184a61258c64e85eb46c0

    SHA1

    4006593dc27a1cea99786c9f67c4a52db721bce3

    SHA256

    f190313fe77b531089c070363c040ae0cbb26a99b66244fdafc13abb43b85b6a

    SHA512

    da28d7fb5f09829d30295362ae6efcc2a128e991f3e843522fb3c87bfff0dc97b8447471922ced5e2a8fd9d7875c7dffb54ea1a0e4c1b4aa578d2468530c6920