General

  • Target

    fa8000754f1dda0b24a73e684769f917.apk

  • Size

    10.9MB

  • MD5

    fa8000754f1dda0b24a73e684769f917

  • SHA1

    9153f787e6677b8f23cf74d4597dfe026e6849a9

  • SHA256

    361996eb9a3b27b85e3de9c5b29abc888ed07fe24ecae5b1308c1bc086064609

  • SHA512

    a7925093b4999a351d423d7357f28c2eb436c68f5d4adfe388229719c879f6e8bbd2185abc357d847d9e9c7e695b78665f222766cb3d83276127e9a36859479b

  • SSDEEP

    196608:ITR2F27PMY+dTiDDOnFKwsF8jeOL5vN4z1sBcDPvI0Is6r60yWY4KHqLXn9mkoJb:6RMMDOnFVb5vyJsWDPvqs6r60CJQNYPp

Score
10/10

Malware Config

Extracted

Family

axbanker

C2

https://icstoreapp.co.in/index.php/api/user/step3

https://newax-d7dc6-default-rtdb.firebaseio.com

Signatures

  • Axbanker family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 4 IoCs

Files

  • fa8000754f1dda0b24a73e684769f917.apk
    .apk android

    com.nekki.vectors

    com.nekki.vectors.MainActivity


  • app.apk
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.nekki.vectorer

    com.nekki.vectorer.SplashActivity


Android Permissions

fa8000754f1dda0b24a73e684769f917.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.INTERNET

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.QUERY_ALL_PACKAGES

com.nekki.vectors.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION