Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    21/03/2025, 19:00

General

  • Target

    base.apk

  • Size

    9.9MB

  • MD5

    c63a7341b83657975615109f144e926a

  • SHA1

    c486503ec21bf61620fd5749b9b9456e13e4b53d

  • SHA256

    d838927c91197c21b1ecd43ef97590d63ad2351e23f90fd96483aa10eba93f1c

  • SHA512

    9ee55b5c21e91f1e773c08b81e665691ced17c17bf879d53f6962cc9fce13fe7a3f8aa7c6b57aad39a9a3521b0d60596e8ea7c724431f765950d00698fbb4c50

  • SSDEEP

    98304:TwdpTASe2WrSj7kVKdn5iSRG5CPVql6jgYt6+U93sx1DUUXTEPQRXG7zRsUq:cdidOj7kUNrTPVAVeDUAAoRXG7zRY

Malware Config

Extracted

Family

octo

C2

https://c0abb3cf2e074274ffe6ecdc45373c8d.info

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.uunfw31secgestural
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4843

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.uunfw31secgestural/.global.com.uunfw31secgestural

    Filesize

    335B

    MD5

    e59a297274254bf3092869f868d4b0e9

    SHA1

    e323f7969f4e1a058381910e82cf11f4927cd967

    SHA256

    6e4ce36dd9e7a656bbc1aeeb913cff093877cf11e8172ae6ac81edfc3cec99ea

    SHA512

    a8b72bfbe6ff4de80e60aa2f7568531523fda47b69efdaec48d6da5e92a9d4903464b979f708970389f116f638e649022e7e62bc02aaa93c5b5debba5c8f05e5

  • /data/data/com.uunfw31secgestural/.global.com.uunfw31secgestural

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.uunfw31secgestural/app_rival/YSIecoy.json

    Filesize

    1019B

    MD5

    2de53243f527a9ab45530b5dc31e0264

    SHA1

    82c32c6abc3950c0af67cd695c14973c45b5e1f1

    SHA256

    0cdacbb4ecf4657acde53193871c69be8fcf70642ce4507e5605988d74646406

    SHA512

    085958566b86b700c95efc17bcf928103f53393711f940ba1261b25bf7c1d05e134de0073a0ea3970aaaff967111dc93d63022cddaac15382bb072ee2fcba3b4

  • /data/data/com.uunfw31secgestural/app_rival/YSIecoy.json

    Filesize

    1019B

    MD5

    448e8a9f3ea84e5f357e307affe868d2

    SHA1

    aeeea7258d1dd9fe346543a9858fb026a6168f00

    SHA256

    48308b01f7f400bbed758fc544921b0f21f1033d9434db73e8dd9b4fe2ab434b

    SHA512

    7dab66a6b306d3ce1d3969d43016995b540e4d307c879b027c30db480451ab6ac63390f684f7fdc158589b97118b564a5c280e4df0631f443dc8e1b4ec70b238

  • /data/data/com.uunfw31secgestural/files/.t

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.uunfw31secgestural/oat/x86_64/[email protected]

    Filesize

    421B

    MD5

    8e7dac05782ae4146b91b78f6564da89

    SHA1

    1146041fdeecca669ed77b070b91b88cc9402df3

    SHA256

    55c2d6cc2212638be169ae2cd156823a6281f8813b0307ac1a66893a84bc2848

    SHA512

    e81b0e6bb8586756f0a24f5075d48b1c4836da729f0ddbc046f8a343b55282c899de6facf3e17c488bdb3bd3d4e6853c7970b91d24184f07085e69ccf724a50f

  • /data/user/0/com.uunfw31secgestural/[email protected]

    Filesize

    528KB

    MD5

    dc054dcc95b3efb2d2d4f043167ba712

    SHA1

    fd0b011a4091a79a8d2f27fd46ee1d0f1ef0547f

    SHA256

    4199ceaefeb3865fcee456010f01afd1f3e253318b840a19ff2add09f5c8e0b0

    SHA512

    2dd7a629c5185a9325f075281bcc598e16e50137a3a1b847693cc60913b08abadce93f7faaf20e10dd10a7cd38f66fe7e02b518947886a058001da5a4e63dbc3

  • /data/user/0/com.uunfw31secgestural/app_rival/YSIecoy.json

    Filesize

    1KB

    MD5

    484ef4858067e65ddc78d790da8c0e38

    SHA1

    5ddc1e95483a76a1d9fc1eae0996a24749302d19

    SHA256

    3cef5587d1d1ec586f369abde3c5e00a3c07107095b50b98d2b2af8b08c4afed

    SHA512

    0038fcc42615cc2214bffba571a9f5026bdbf123f8bf5c568bd67fb6419455114a29cf881d0eefda4a4de5eabe27682d8a85d0a9cb556da511ac02158d8d159b