Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    14/04/2025, 22:02

General

  • Target

    b92a756cbe3b4c58523dfe3dc5d59c695f14695b9a987c50dc5d82d2ae295346.apk

  • Size

    176KB

  • MD5

    3e993bd9385b0e726ab7d9e768bb3fa5

  • SHA1

    eaa00ccc80d1cbe857a79f4f8f1e625c018a23ab

  • SHA256

    b92a756cbe3b4c58523dfe3dc5d59c695f14695b9a987c50dc5d82d2ae295346

  • SHA512

    26b37217dbafd165e6bccf77077c96558b59e31d467ce4b2f6b9355b924223efcb09b4b0fa21e5be53d41061b5a914d62da8286cb5b69c8f8763fdafae9d4857

  • SSDEEP

    3072:Hw2GN0szGy6KIEVs0xFsiowtRYdQkP9SqHxf1z9q+MbXitan1nz/:Q2+Vs0TsiowtmQk4qHxfGstwnz/

Malware Config

Extracted

Family

octo

C2

https://196.251.72.246:7117/gate/

https://196.251.72.246:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://196.251.72.246:80/builderxxxzzz/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

Processes

  • com.governsaidp
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5144

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.governsaidp/.qcom.governsaidp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.governsaidp/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.governsaidp/kl.txt

    Filesize

    237B

    MD5

    a53b351f378dffe4f10c536bbef2940c

    SHA1

    33df7848e3e26893a17c573d9e80879ad45198f4

    SHA256

    52e1a4bc9b2cf0cd29e092fdfe1d3fdb3b3323755adea494ef03f3f642220606

    SHA512

    f699a4b0a0c4b2702783eac64197d9857986b9034cb55f9c94eb77f6edb1621b4a350f3d7d87bb4a090d340818ba4433a087342df4ad5559bbcfe5c086916301

  • /data/data/com.governsaidp/kl.txt

    Filesize

    63B

    MD5

    640bdbe02aca933b60fc5c992813704a

    SHA1

    6859bc67154029f611fac3f10ff447888a04824a

    SHA256

    d8031a114e27018bdff8602930b9cd26498e21bfef6bcb68533788d9f5e74d06

    SHA512

    dd35770d5a10f90e1a12e7731fbb99bcbd4ce60a7400b04817563cd8d95cc4ee8950782f3fe424e93915a913979ee7a54c035b97e95002ae4f531d3caba6d39a

  • /data/data/com.governsaidp/kl.txt

    Filesize

    45B

    MD5

    d0b34c1f02e4b2e4a5c5982d034a19aa

    SHA1

    76b6b7181b3961477469a30e0b2b6bcc9b038535

    SHA256

    43fd4dfbc7340635bb7e6871d0d64c25e2430472f86394b4f874b75864afa06c

    SHA512

    d4aa6625cc076536e1b913d37639dc41b84e87a35e3b465f601006a7a266e45b7a2a3fc641ab3c6c8edb6e07d6c5e9930ca5c3d885479e665785411003d5495b

  • /data/data/com.governsaidp/kl.txt

    Filesize

    437B

    MD5

    a23e1afd4f1f84350ea1cf0ba70eca3f

    SHA1

    970bac9468060a36cb4ac2b0283113e1657d4fb3

    SHA256

    3bc5fe92c33c539675f8e38eaf61394a01eba536dec6bce072c3721c07df5797

    SHA512

    9f8e1527d9086afa8846e1124a6e8c858a7aea465132a0996153c488d1fb2079e44d27b725ce06d6f0408e5536ffd44a5c35b00468979a346558a296f9ad4666