General

  • Target

    d12e66f58e8cc353fd3d750962d2047a7dab2b226ef24a896e99e43ac3679cfd.bin

  • Size

    1.8MB

  • Sample

    250325-11vxsatsfx

  • MD5

    2361661fea6b374a2e67bfec6b1f5e9f

  • SHA1

    cd48eef7cb04b67f311f209c8a518b21da6b45f3

  • SHA256

    d12e66f58e8cc353fd3d750962d2047a7dab2b226ef24a896e99e43ac3679cfd

  • SHA512

    cc6027d5ee106adf6856ad993d127108fe45ab3f59b79ed462176e5dadf9628367ae96e868411ec606e520060486e078f53282b6c70c9bcb8bbcbc62d27c89d5

  • SSDEEP

    49152:bY1P/Aji4o/ZcZmVu345MEtKFd/UFuoxO4j:g4jiFmMs3OZtKFWFZxO4j

Malware Config

Extracted

Family

ajina

C2

77.221.136.21:8080

Attributes
  • target_apps

    air.com.ssdsoftwaresolutions.clickuz

    am.easypay.easywallet

    am.imwallet.android

    am.mts.mobidram

    am.upay.android

    app.ab.banking

    arca.am.arca

    az.anipay.usermbanking

    az.cib.app

    az.epul.technopay.android

    az.portmanat.app

    az.portmanat.newapp

    az.pulpal

    az.tezpay.app

    com.binance.dev

    com.eg.android.AlipayGphone

    com.fastshift.wallet

    com.haypost.haypost_mobile

    com.intervale.baitushum

    com.ipc_app

    com.kp.kompanion

    com.kp.megapay.kg

    com.m10

    com.maanavan.mb_kyrgyzstan

    com.mbf.fsclient_android

    com.moneybookers.skrillpayments

    com.ofss.digx.mobile.android.allied

    com.olsoft.mats.prod

    com.pyypl

    com.safaroff.million_android

Targets

    • Target

      d12e66f58e8cc353fd3d750962d2047a7dab2b226ef24a896e99e43ac3679cfd.bin

    • Size

      1.8MB

    • MD5

      2361661fea6b374a2e67bfec6b1f5e9f

    • SHA1

      cd48eef7cb04b67f311f209c8a518b21da6b45f3

    • SHA256

      d12e66f58e8cc353fd3d750962d2047a7dab2b226ef24a896e99e43ac3679cfd

    • SHA512

      cc6027d5ee106adf6856ad993d127108fe45ab3f59b79ed462176e5dadf9628367ae96e868411ec606e520060486e078f53282b6c70c9bcb8bbcbc62d27c89d5

    • SSDEEP

      49152:bY1P/Aji4o/ZcZmVu345MEtKFd/UFuoxO4j:g4jiFmMs3OZtKFWFZxO4j

MITRE ATT&CK Mobile v15

Tasks