Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    24/03/2025, 20:22

General

  • Target

    base.apk

  • Size

    7.1MB

  • MD5

    ef9ca4ebd1e4f8c345a8ef2c9cbcb756

  • SHA1

    cc378fa2d6b2af6dcf65f8c8608fa5e0306f0f45

  • SHA256

    0ed5e46d9da10084baa9cad664f2f54b15ace995208e171d5c49c56466a64146

  • SHA512

    f9a0abd1d8be2ab13d6cc2c70ef946075bc18f0b0400b0814e0855c617c6506701c8b4f7341d643b52f75049d11ff8ec3bf6b65a3bfaa329b3591700d161980e

  • SSDEEP

    98304:R5iSRG9jujVKjJsDSj76Rs4J3z8pPcoAABKPbfUfmNB6Ae0OR5Y:RrBU1s2j76RH8yoAC+NV

Malware Config

Extracted

Family

octo

C2

https://b2e74282a56746d1ed6178108178417f.today

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

Processes

  • com.handed_wlantestc74
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests enabling of the accessibility settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4507

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.handed_wlantestc74/.global.com.handed_wlantestc74

    Filesize

    194B

    MD5

    02bd9744c3fdefb07f727e43f6ed3ed1

    SHA1

    d04c7e34eb28a34b75917c7f74b591912b810583

    SHA256

    44191dfcc2d33febd0d4cde3b1813512d5271c4c32e08e2b57acc82fd7c3f74a

    SHA512

    b174aedaf1360ece27417f84b1ae39ca68d861af2a65719e083b81d1c36359e7260c5508fe2407682292e4c7fcdfb52369f236999df3f44b09e0ea1a93c42317

  • /data/data/com.handed_wlantestc74/.global.com.handed_wlantestc74

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.handed_wlantestc74/app_buyer/bFUoSrN.json

    Filesize

    1005B

    MD5

    9b419dacb611e17f57642e96bc85d879

    SHA1

    a707e337dfa8c69dfad994557e2f266a1f68edfa

    SHA256

    4e8aa5cc88340ece3bcbe3b947a8de8717c12778511500db3529f4bb5ceaae56

    SHA512

    68a35399dfeab4ed7f17ed46ac422d790533c1d5fb359a992b365e15bfc17eebe005b828f0a3de043d615f51dce16bf3395aa6201c7001b2247442ca94661be9

  • /data/data/com.handed_wlantestc74/app_buyer/bFUoSrN.json

    Filesize

    1005B

    MD5

    bf5fd9cbc0ee1f213b37e25eb899776e

    SHA1

    0a8700c6b743a04709b857e91a73b94e17563fe8

    SHA256

    3ea0dec6b7ec4309e93430e9c9cc4cd54243d7112b84be7ad4be9dc8dcb36a1c

    SHA512

    4dd166536690e5637e888265f935d33ed556a9023614e5acdcc7a8a71a03b8fba95785736c02eae6305edfcef16f5c6a332018139101de827470eb6dd78c8158

  • /data/data/com.handed_wlantestc74/files/.v

    Filesize

    322KB

    MD5

    77dc50489b9323274732d27dc8a4e803

    SHA1

    0e02a3595b62489d0739d771881da8604d117c65

    SHA256

    c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820

    SHA512

    0684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58

  • /data/data/com.handed_wlantestc74/oat/x86_64/[email protected]

    Filesize

    13KB

    MD5

    21ddc80b6c04ebe1af72c672b687e804

    SHA1

    0fb119e8cfdf968f1a7819e54e939c4613410cb6

    SHA256

    1c1d38e40382f25058589ff6f4de344f0440e8bd50bfc870bc73b9d01f5b8e3f

    SHA512

    10863deb71e0efc3927ae0b4623da42bb669611ee2fdfab9c3f2e7cc67a52ac70f71071a0a6c75cbb4a7b0d3f85d369a1721a8018a48834e94749cbb09248271

  • /data/user/0/com.handed_wlantestc74/[email protected]

    Filesize

    528KB

    MD5

    60ef4ab7b1d3a3617e723e4a8bc260b7

    SHA1

    8e46dff699126d1c34cc3dd695e72d5ede849c34

    SHA256

    60059ed5fe314648e53ee945ce653f1ec720b7077717476e89ad2b9e2380e89f

    SHA512

    72fdb7e913f32a4734fcee4ec9ec2dc53fdeb8260ffce2efc606e4473316810945cfde17d5d77446550ccb2bf8687075cc9ec0b23ea975cd929630be57a388c0

  • /data/user/0/com.handed_wlantestc74/app_buyer/bFUoSrN.json

    Filesize

    1KB

    MD5

    fd7cf01706c59263c15f2ce3ad438453

    SHA1

    5b0ac9b2c9fbbaf64bab92df3c1e192169d3da5a

    SHA256

    6f8088e81d70caf4f4e3a0fcbf7bfa96e9be9f6eee327e3ecef212c7eacaf684

    SHA512

    88562848d97db96a0cc2fd350ce5ea4fa57b221271d7d249c730084d2fd173c99511206e3625c8d328100ffa9c6bc1785430c8c422251fc8c14b00599a762b87