Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    14/04/2025, 22:02

General

  • Target

    b92a756cbe3b4c58523dfe3dc5d59c695f14695b9a987c50dc5d82d2ae295346.apk

  • Size

    176KB

  • MD5

    3e993bd9385b0e726ab7d9e768bb3fa5

  • SHA1

    eaa00ccc80d1cbe857a79f4f8f1e625c018a23ab

  • SHA256

    b92a756cbe3b4c58523dfe3dc5d59c695f14695b9a987c50dc5d82d2ae295346

  • SHA512

    26b37217dbafd165e6bccf77077c96558b59e31d467ce4b2f6b9355b924223efcb09b4b0fa21e5be53d41061b5a914d62da8286cb5b69c8f8763fdafae9d4857

  • SSDEEP

    3072:Hw2GN0szGy6KIEVs0xFsiowtRYdQkP9SqHxf1z9q+MbXitan1nz/:Q2+Vs0TsiowtmQk4qHxfGstwnz/

Malware Config

Extracted

Family

octo

C2

https://196.251.72.246:7117/gate/

https://196.251.72.246:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://196.251.72.246:80/builderxxxzzz/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.governsaidp
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4365

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.governsaidp/.qcom.governsaidp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.governsaidp/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.governsaidp/kl.txt

    Filesize

    237B

    MD5

    67db94d97967b2cf99d8654fe2a37a37

    SHA1

    05557523bfe726f1259efeae9141cc87b259de19

    SHA256

    5882dd4582a28bb9f770749e62caab2133b7e2756ce3876271312fca0e86c4a5

    SHA512

    81d5ea36c9fb24d713562f906b5f7da1300a590a14269b10a1591c84df92c96b73c0348a1310b34a40a026da984db0151fea95553352afd57dddd184be1897b4

  • /data/data/com.governsaidp/kl.txt

    Filesize

    54B

    MD5

    70136725f5b86060dd39ccbe9c09c9ee

    SHA1

    8ab2c618b6e42f63e37205319832278e19da995b

    SHA256

    85768815b23c2c002118dbc78c52d07f04b78530560e9512cbd98500d6d6b8e3

    SHA512

    78eafab90307773db014d587d7c271b62a4c63e5ea966f8df0f79c572ea3d48c898bf9799e31e17e5c5c9c414bef5a04a62ec0becf9ae8c7458ed86abc30482b

  • /data/data/com.governsaidp/kl.txt

    Filesize

    63B

    MD5

    c45cefedd638247d8ebbeda3ff6f9ab5

    SHA1

    2e8fd10703dd180264c97bcda17f3a9b456c58ae

    SHA256

    105a51016fada66a22b72e8e5e5862f88240e320539293aabecae66eb8967361

    SHA512

    af263fdaa3a0a6528d89a4de17b5d6e9a5386fd522428fff3ba60859db52be0ae607b036fc8beaf2e3e891194d7ba3504b194737cc59852a51fafcc94bc7d4d1

  • /data/data/com.governsaidp/kl.txt

    Filesize

    437B

    MD5

    6250fcfd64ac0af02c60d561a22700b9

    SHA1

    3f205196fbf8b3ed068a99ee2635f51b383cb2aa

    SHA256

    ad4e90becdca7f9c4c2de59f63832738d477e2253dfbab78a25264ae43366001

    SHA512

    51bf4dc1188a45246ed67f6eb76acf06091ec6b2815968679cb3aee833ad7344c4ae3ce790490c7b93fc51481ca27ccae0570a37050ab539cd50a9e7021379e0