Resubmissions

13-01-2025 11:09

250113-m86glazla1 10

13-01-2025 10:25

250113-mfylaaykft 10

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    13-01-2025 10:25

General

  • Target

    3AC342E7438D6773C4F68BA650CE365C28FC21CBA65D74D203CAB96073BD1FAD.apk

  • Size

    9.7MB

  • MD5

    6f6d8a63306e20ea2ae0dcd77928597c

  • SHA1

    0232745e94a9a0ff4db24ad7ae72a2f78daf65c6

  • SHA256

    3ac342e7438d6773c4f68ba650ce365c28fc21cba65d74d203cab96073bd1fad

  • SHA512

    9b0540a6b7617ae9bdef3c48fb7e60d4b5a60c987b83de71036455eeef79469162164a8eb97928be0e697324fe5424a471c49fd5655461ef79a146968812f02c

  • SSDEEP

    98304:1xUbWjuFS065iSRGZlVKNBOGl5X5Iu3HakICp+3X3RsPmuRhci5sstHRH8a:hACraUecakIC03X3Rif5sq

Malware Config

Extracted

Family

octo

C2

https://cbb20d1b2e4f62c135dd5905a0080404.info

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.xims_navbar9
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4499

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xims_navbar9/.global.com.xims_navbar9

    Filesize

    194B

    MD5

    02bd9744c3fdefb07f727e43f6ed3ed1

    SHA1

    d04c7e34eb28a34b75917c7f74b591912b810583

    SHA256

    44191dfcc2d33febd0d4cde3b1813512d5271c4c32e08e2b57acc82fd7c3f74a

    SHA512

    b174aedaf1360ece27417f84b1ae39ca68d861af2a65719e083b81d1c36359e7260c5508fe2407682292e4c7fcdfb52369f236999df3f44b09e0ea1a93c42317

  • /data/data/com.xims_navbar9/.global.com.xims_navbar9

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.xims_navbar9/app_baby/xFflkO.json

    Filesize

    1016B

    MD5

    1110f2f6204b08294e5b28dbc53d8cbe

    SHA1

    c83539a778819cd38465948ecec65d43fd1a2510

    SHA256

    e065df3cca5cf9461c94e882253804d1dec26ccf6090eee6aefc7954347a770a

    SHA512

    44df88b4c487be9a8c736bf363c4642102d31d3db1b6264887136ed8a0861c96c5a1ea94dd198d79c2c5c35d397bd353f6b4c693bf125362e66f8940a36fe72c

  • /data/data/com.xims_navbar9/app_baby/xFflkO.json

    Filesize

    1016B

    MD5

    f8ece4397587e88b5fa2046db01cfefc

    SHA1

    dcabe5297d0a3128b00e0b311d424607f7553d7d

    SHA256

    9b20e5e66d63812d7a4cbe6b579a89ecf4adf8f83998b81cdf85243ff4456d46

    SHA512

    22ddca672167394aa4dd72731a684b93ef568680b54a7c4ff677def46a8730b67d05cba97580339042cdf457969100f0140216801259f82e717930b98294f398

  • /data/data/com.xims_navbar9/files/.s

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.xims_navbar9/oat/x86_64/[email protected]

    Filesize

    407B

    MD5

    bec4cf43b52d27da4e7994debac9fc5e

    SHA1

    7a03aa57d8042ee8bbfdb165205bb27779a05ed5

    SHA256

    10f603739034d2e86d61a5e3871e901ef303c4fca3d896eb681ca3d88e4ae96f

    SHA512

    0e98a500d6236a8c4438fa24216809ad52f65bde2911de9baef37db182b83c7fa1c2dfd32a75fa134664903beb75dbf9d4440072a5193fe7a661e62d6102b853

  • /data/user/0/com.xims_navbar9/[email protected]

    Filesize

    528KB

    MD5

    00cde1bef497111932c43025a15711cd

    SHA1

    aee2240ae3dda3a883233b880df5af3d033633d3

    SHA256

    ec54f882a399861934f662b1c871dac4b85b17edfbb2ef42a398ed1379f961a4

    SHA512

    9012e85bda8f0e59010618d5ff9294a1e2ed13a27efefaa1b393710c0569c8ba9f326867b9133244982830f106599088c4a0f49f6b2c45cfe351d19849af9f4a

  • /data/user/0/com.xims_navbar9/app_baby/xFflkO.json

    Filesize

    1KB

    MD5

    32ef4167cdb7f36dc75a31e63f614766

    SHA1

    b898d191a1a574b1d6fead031be849e8d1a044f3

    SHA256

    53fe586224ab636310ae31153a8897df707aedfafc86fe165d0545982a2cb4c4

    SHA512

    bb576d760815dc37fcef24118c19125a97078ad370c1f36d7ea98091c2d1c22250928d25ca51e3ed68c7b64a334b38295b99c51d3618e9837876a5a4ebac3c2b