Analysis
-
max time kernel
147s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
26/03/2025, 12:52
General
-
Target
rex.apk
-
Size
7.8MB
-
MD5
d8f788db9c5391cadc2f854a7d4a3231
-
SHA1
7ae6068449c1a79c4dbc15cc2f3d920ded64e2d6
-
SHA256
bb605ea69d8283489be0733098b22bfaf8ab45d4ea64eca0ef9b3b2299876531
-
SHA512
d967266c577823d64709178c2b0d384c7a24740d23b619ea644af83bd8a1fe5e0ce0706138facefc39d16dd3d5cd54cc91fc2da4cd908c4f9f2f6574a47f59c7
-
SSDEEP
196608:8cNnc/cvcDPpG1cscgA0TIrsE+5zFKKpEC6iOchpWy0O:1Nc0EDhGKFgA0krs7T9CLO
Malware Config
Signatures
-
Copybara
Copybara is an Android banking trojan first seen in November 2021.
-
Copybara family
-
Copybara payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.crazy-v1.AndroidManifest.xml --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.crazy-v1.AndroidManifest.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.0MB
MD5e749ea3b2deac728d2b2781ee0ae2a53
SHA1d053c42e6be484c7ca1ef5bc18bcf3ea2492a305
SHA2569d5d7fbeb153f61245f72a755083e7bd75ce6bd024b418946dbcd54cb99bb612
SHA512747b7fcdd64140ce902b74771bde156edec71a787007f9cf53323bb6b63ec7f8471272ca433ae4c5305e1e6268419c7203de8c6bfaaf258d756af9d20bb91631
-
Filesize
12KB
MD5256df4f1f534234b1d510cd7ccd71dab
SHA1b7d93f7875c80eb6d55ca84ed3def780b6a84759
SHA2568aad7daf3faa9bce66f44dabe11613afeb8731704e93112d890573b9d909d5e3
SHA5123768be2a2f53ce428473f1d92c55342240994ad92fe6af315ba9322239a267fc059c7f0dd8f156c395dcfa5841c257c5158c7fabd28b6ef342fcc2e01b709ffc
-
Filesize
4KB
MD524815b80325d6a52a5a4663ba1f85d21
SHA1300b7ac83e8bda4225d5e4daa6bd0e7b640136ba
SHA256e536c2307655f1145a41e3bdf9baa12c28d1aa4b189e4ab4d79a9d662fc9dee7
SHA512ebed5cf3e67f53b8112ef0541f3110db3462d4684cf92ff7bfe5b232d53a9cab5b4a42d5d1591d66b9501d78f068c059ffadb42d9d0b58261fcb2bf585ade1e4
-
Filesize
4KB
MD56628e3089ed7121410a5ef8ac4717160
SHA14ee443a3887bb16ec726bd398165a2878bf6ddd8
SHA256ffde64c9d1240a0cc8f250e41a1f29de0399641760975c67e0348bb229130bff
SHA51227cf7545bc24687e6943a524da81169dd7f72cbf9ad9e14ada904619beaeb7553d3694c2bbeab5ba9f3144af7aee14175dbddacc927d55157008eeeaa63e80cc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
121KB
MD57b38720a0352dffa26411726c72dd2b0
SHA1b15e687f42abcdc12427f146a3115ef2259211f8
SHA2562013f490d45638cada331b3474ed65b9a43cec60da773accc98332e58c06336d
SHA5120df28f87da4f9beb3ca8c108f54021a2a1a1434771abbb5ba67a2736097f2287b05e5220a33e92c42ee13ecae1144714a422b986763712794f69e65bc44c83e3
-
Filesize
11B
MD51b65c10c6215685f9d621d797f911373
SHA1cc50aaed5cd521a62ec8cf9fe0413153ec90f265
SHA2562230c2b2787663a054c47450ecd1718f0296853ad768b8e5d306ecb912685e89
SHA5125a9139f295dbe384b1584eff5c11f3f86759232f7b661b75f27fe92b996b4cdc0552e315f79b26f5f2c1f91756d9ae04cf0c3675b6172e91a3d373b9b314496f
-
Filesize
9.0MB
MD5ff6167deaaa8c9d7a11c7a232dbf1bb0
SHA1ade0dc2e4e2bf04bf4fe1d5ceb0d30db44cec439
SHA256f605fd25c942bb887ca66d8645a5d03602c1ff53da92ec8c3c58cd8d6a1da898
SHA5125ad69661d6354b00f0b5f39fd3ec27c6f9f6a3baf946b97688c850f7c7e44213d2a4e5b13119a8058d0b132a4c26d27ce276e387ba71ed8685696d2a281a3c57
