a358808d6301fb94ee473db9a565bdb3f4c7b11b3d0df1527133e201ba6980da

Analysis

max time kernel
10s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
31/03/2025, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

9.7MB
MD5

1897e95e7c55f3a3677228ad14420940
SHA1

f6032a14df0b3aedbd68807a344219b13955b775
SHA256

f2ed4cb875591cbaf9d0bd41c0b5c0c3ab958939dca07d4f9ec709b0f5d040dd
SHA512

e64a0736210bc2fb5224f5c34fc51b074038d6b3dda8377bf8229d58f12dbb95aa2c7b832fc0da68a94ec0620e1b70eaec93f0301c4a09319211411abb2ee250
SSDEEP

196608:5aXKxoChLzu1HQSBqLqUyb+G+TEbxYuyof0fCYuBGIQcdlcn:ieowYHr/bWEdYXe0uBGIQ6cn

Score

7^/10

banker defense_evasion discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.abc.a1march2025bankofmaharashtra

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.abc.a1march2025bankofmaharashtra

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.abc.a1march2025bankofmaharashtra

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.abc.a1march2025bankofmaharashtra

com.abc.a1march2025bankofmaharashtra
1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4786

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.abc.a1march2025bankofmaharashtra/files/PersistedInstallation3898500108070448833tmp

Filesize
90B

MD5
fcceb98b8402aeab9b22fde09d802c6e

SHA1
7c934b6134755773faecb0c1da90ef4b6a308d9f

SHA256
baa1415c1e85f8bff4406033dd295c06114fb26bcb7348393cf5b9247180dcb6

SHA512
5bb6bf41589c026ee650b8eb51ce11ca20c0ad9510ba8fe0b4eb10db2fbb4e363c23a78642db1dd1707cc36770646c085162854453112cbabc87906c0f4d6709

Download Submit
/data/data/com.abc.a1march2025bankofmaharashtra/files/PersistedInstallation6865235689449752090tmp

Filesize
569B

MD5
61ed484388cf240e2e47d33e6e415fdf

SHA1
b0e5f06301667459b53b8ff378f749f3aa725808

SHA256
553ba8dca2e48d9991c858cb0e3c1c298b49b7d9f1348840d3b2a7571031d31a

SHA512
ae5327ece648369068f6d9d27831792687a997888fcd87d237eb53aed219adda457c3f81bf4dcd10af3c564969c5ccacc0cb273b00a79dbba48475890a986de4

Download Submit
/data/data/com.abc.a1march2025bankofmaharashtra/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫

Filesize
2.6MB

MD5
56af653a1167dee85cccb63e50196653

SHA1
844c41a452d07cd06b4f6e08e29525984052e48b

SHA256
7db334d7f96965e34833db559a295d1f03cc66d7c65712564ac260ff349156ff

SHA512
cd83f581f95a2f4f7cd43d1c55f712e1bcd68755e82cd6f79683084ddee8fbbcee266494a2639e494b82d0f3e6aab4d0d79fbeefb5dc43187f64a978d9b7c3ca

Download Submit
/data/data/com.abc.a1march2025bankofmaharashtra/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.

Filesize
8B

MD5
4fd360accc599e62d0a022e1d879419d

SHA1
f1c590d31d146162dd657e3bcb6797e63cc21c68

SHA256
d75d49c645c11dcf8a8e562ab992ba6dfe15a2564ab4a11c6bcd4aa8b1702c52

SHA512
daad74474e76c10e103cdadf0e85c60195c617d04fadee5ec06592f24644b843cedcd209d42377ca66a0dc726919058c3e9623f1b8de92c43a7db581a3be7ab3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads