General

  • Target

    75f9e79ad9adcab54fde3db718099a03.apk

  • Size

    10.9MB

  • Sample

    250213-qarsbsxqhm

  • MD5

    75f9e79ad9adcab54fde3db718099a03

  • SHA1

    fd41c28817cb4ca396bb44b7011f2f608ce21674

  • SHA256

    3ca99c5ad6972692c48572125143958b57f164d9400b55901c335e4d5d49b416

  • SHA512

    af7b853804c86c5a3f6c2015e2a4b19ebfd2350c0b808c951bbc7eba75613bc37998865c22bee0235972acb791fe96b3bbd0a30567ad46765119feb95348ac43

  • SSDEEP

    196608:Oi2xv74XNwGA6vUSy5gd7hzSjGobetLIEerA5nEVlIveYS43yLoyIcNA:OiGGnHvd7NSjqt8EerABilIvemn3f

Malware Config

Extracted

Family

axbanker

C2

https://iciciapp.site/index.php/api/user/step3

https://newax-d7dc6-default-rtdb.firebaseio.com

Targets

    • Target

      75f9e79ad9adcab54fde3db718099a03.apk

    • Size

      10.9MB

    • MD5

      75f9e79ad9adcab54fde3db718099a03

    • SHA1

      fd41c28817cb4ca396bb44b7011f2f608ce21674

    • SHA256

      3ca99c5ad6972692c48572125143958b57f164d9400b55901c335e4d5d49b416

    • SHA512

      af7b853804c86c5a3f6c2015e2a4b19ebfd2350c0b808c951bbc7eba75613bc37998865c22bee0235972acb791fe96b3bbd0a30567ad46765119feb95348ac43

    • SSDEEP

      196608:Oi2xv74XNwGA6vUSy5gd7hzSjGobetLIEerA5nEVlIveYS43yLoyIcNA:OiGGnHvd7NSjqt8EerABilIvemn3f

    Score
    1/10
    • Target

      app.apk

    • Size

      7.0MB

    • MD5

      eaf4bf36073ced5c5b7a59c5bd14ea1a

    • SHA1

      6bd84f56189e80a6b89624d6205f93a0c47bfe01

    • SHA256

      792e80d10dbbb86057e03f6cfc4822aac4705a40e66e3ff6f619924e60eb7f79

    • SHA512

      c9bda56996babc0fbf198b11e2a148e9c14b8bb7119a78c44136b21bb3dd51c2965b10e9bad02daee34f8a351ac8a5f800a060ea6d8b00f7227a9a623bcf8f06

    • SSDEEP

      98304:6+EGlPenzB7TaFMjCj9Ooj2nAwUHfTEIi14i6UHRoEALQjaolMhM/KrNgIH:fE3zBqbOo5wSfIIieF6RoEALjolMqy

    • AxBanker

      AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.

    • Axbanker family

    • Queries information about active data network

MITRE ATT&CK Mobile v15

Tasks