axbanker | 0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7[.]bin

General

Target

0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7.bin
Size

3.5MB
MD5

2703cde5a617ff1a44bcdb3524b1348d
SHA1

3238409d54788a75e3bff18628c3eb9837f71734
SHA256

0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7
SHA512

3a6d405f279f104c15fdd84ca89ae9d21aec4d5f77029eb16a2626b39aab158b47833a749f55f31b03bad37c1fc07cde33eb734f1853022ced6dbd6bb7ee5b5b
SSDEEP

98304:lyhCX4uwJPIr10XFZw2uo7xZuGP+vGrkfvNocLDu3smdXxbIT:4uw628Eyue1nOu

Score

10^/10

axbanker

Malware Config

Signatures

Axbanker family
axbanker
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Files

0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7.bin
.apk android arch:x86 arch:x64 arch:arm arch:arm64

com.toy.salmon

com.salmon.p045l

Activities

com.salmon.p045l

android.intent.action.MAIN

com.salmon.p075f

android.intent.action.SEND
android.intent.action.SENDTO

Permissions

android.permission.VIBRATE
android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND
android.permission.CALL_PHONE
android.permission.READ_SMS
android.permission.USES_POLICY_FORCE_LOCK
android.permission.SEND_SMS
android.permission.WRITE_SETTINGS
android.permission.RECEIVE_SMS
android.permission.REORDER_TASKS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MODIFY_AUDIO_SETTINGS
com.xiaomi.permission.AUTH_SERVICE
android.permission.INSTALL_SHORTCUT
android.permission.ACCESS_NETWORK_STATE
android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND
android.permission.ACCESS_WIFI_STATE
android.permission.INTERNET
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.USE_FINGERPRINT
com.xiaomi.permission.ACCESS_SECURITY_CENTER
android.permission.BATTERY_STATS
android.permission.REQUEST_DELETE_PACKAGES
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUERY_ALL_PACKAGES
com.xiaomi.permission.ACCESS_SECURE_ELEMENT
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.READ_PHONE_STATE
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.GET_PACKAGE_SIZE
android.permission.CLEAR_APP_CACHE
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.ADD_VOICEMAIL
android.permission.WAKE_LOCK

Receivers

com.salmon.p078p

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLED

com.salmon.p082q

android.provider.Telephony.SMS_RECEIVED

com.salmon.p079x

android.provider.Telephony.SMS_DELIVER

com.salmon.p042g

android.provider.Telephony.WAP_PUSH_DELIVER

com.salmon.p060d

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.provider.Telephony.SMS_RECEIVED
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.DREAMING_STOPPED

Services

com.salmon.p083p

android.intent.action.RESPOND_VIA_MESSAGE

com.salmon.p092o

android.service.notification.NotificationListenerService

com.salmon.p024l

android.accessibilityservice.AccessibilityService

Android Permissions

0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7.bin

Permissions

android.permission.VIBRATE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.CALL_PHONE

android.permission.READ_SMS

android.permission.USES_POLICY_FORCE_LOCK

android.permission.SEND_SMS

android.permission.WRITE_SETTINGS

android.permission.RECEIVE_SMS

android.permission.REORDER_TASKS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MODIFY_AUDIO_SETTINGS

com.xiaomi.permission.AUTH_SERVICE

android.permission.INSTALL_SHORTCUT

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.USE_FINGERPRINT

com.xiaomi.permission.ACCESS_SECURITY_CENTER

android.permission.BATTERY_STATS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.QUERY_ALL_PACKAGES

com.xiaomi.permission.ACCESS_SECURE_ELEMENT

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.GET_PACKAGE_SIZE

android.permission.CLEAR_APP_CACHE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.ADD_VOICEMAIL

android.permission.WAKE_LOCK

Sharing

General

Malware Config

Signatures

Files

com.toy.salmon

com.salmon.p045l

Activities

com.salmon.p045l

com.salmon.p075f

Permissions

Receivers

com.salmon.p078p

com.salmon.p082q

com.salmon.p079x

com.salmon.p042g

com.salmon.p060d

Services

com.salmon.p083p

com.salmon.p092o

com.salmon.p024l

Android Permissions

0dcbbd4dd2d70774a00c569fa1a0760743a764caf24a8370e57595dc3447c8c7.bin