Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    25-12-2024 14:12

General

  • Target

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176.apk

  • Size

    188KB

  • MD5

    b696c4783a18fb9927328ea52fd90ebb

  • SHA1

    b52559586147f8497ce18ef08ea842e23382c63d

  • SHA256

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176

  • SHA512

    62ea74e26e6989acb10d88a714831ec4f9691fb56d6b3ba03ad6de05073af6ae34fe08f1b4188655590219c7c8be270c8e829ac6c636f8cf588044f18cc5a500

  • SSDEEP

    3072:aRZ8bmdcEreU1STVizAbqMjFywt6xg2icXcplvKEslH2k9tdh+xKU:4FdteZSAbq8FyS6xr3XarslH2ytdh8

Malware Config

Extracted

Family

octo

C2

https://154.216.18.131:7117/gate/

https://builder; 154.216.18.131:7117/gate/

https://panel; 154.216.18.131:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://builder; 154.216.18.131:80/5db7e5d4bd11fc539337/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.adaxffsfzfada.zbsvxgsvbxhdgs
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5239

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/.qcom.adaxffsfzfada.zbsvxgsvbxhdgs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    447acab7950771a7b884cfd0ecf90d36

    SHA1

    1303a566e7d81497952b453fcc5ddee38e96e414

    SHA256

    d6349777ff8f708e4c37e383ab9f5a664a003b31967f37ed8fda34c954179240

    SHA512

    87b918a36bc07213d38a40c933af6a48326449c3187d0c30abe378cd3ce6e9280af08b7c53a89dc6f4a22ae5bd0b38db1af4728773ab11e054b6da8e69a2b7de

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    2b42491787bf13eec10f34dfcb944e8b

    SHA1

    7158db86042907889cca0887b8e83dcc38a22f80

    SHA256

    6b061d8f9ec9b3044accbd36f767f9bf284a6381bea637ae8e456cb558d6c74f

    SHA512

    f5e8c5ad09c9949cb85e63994237658071c82cb9cda1fad1095c7e068b65ce551e6c5147c67e24cdea6dd2770efff09fe5b4a221e989ed0bfcf269409743914c

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    a9166fb50e88432233648a9dbdd6c6b5

    SHA1

    80d0cf06baf4f532d11eff9e9c8f7b6f873eb830

    SHA256

    0e8e942f177d271055c7b7e93f98045fb63a32c564f29441095f04728b715d69

    SHA512

    7e9e14961232d9057a9bd5ce3da9571f049fd3afe8f02b34eb414373e7a8c75971a068a9f96bfd52238b15ba79ee95de81d284e204fd7d05d5c556295323ab24

  • /data/data/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    423B

    MD5

    d7148c97f9c68e1ccd353e264acf7a8f

    SHA1

    a1fd07df4782c54cc4b02a145d46ae924fc95921

    SHA256

    3d237c0b2ee23f2ea057458fa96124c146e64f45733438f2f5d0b412deb7bab6

    SHA512

    fd341bbc7275e0c2380e157f64df1a83854691fea18a085673e5e20970e2982f94be9ca06112ab5f171689952726144907fe5b3a73e0b4db6b9229787e31002b