Analysis
-
max time kernel
143s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14/04/2025, 15:59
General
-
Target
248233C4E61912FDF59AA96976A09267888CC0855AFE781967F6BBB125E67B9E.apk
-
Size
52.7MB
-
MD5
d09c1f30378a95f68276c4038c9fa193
-
SHA1
4fd67e9b01517bfd63c538135d4b492b14d89240
-
SHA256
248233c4e61912fdf59aa96976a09267888cc0855afe781967f6bbb125e67b9e
-
SHA512
9030b9038e874cc46ef033e9f69f0d34d61d67a720efcfbef611ce916d3f6f81861417dbef0512b488515f687092052df82bc27e944acbad6a9181039b432a22
-
SSDEEP
1572864:3smbmeO6FFjP+H4U9X4U9r8bwi6CUoSE7PKrwc:c07jjU4U9X4U9rILR7PKF
Malware Config
Signatures
-
AxBanker
AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.
-
Axbanker family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 12 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ultrapower.roamwifi.changitravel1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
sh -c getprop2⤵
-
-
getprop2⤵
-
-
sh -c ps -ef2⤵
-
-
ps -ef2⤵
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5bf9c11330ca265377662b818a0aec672
SHA16869be8345d97c2249ff7cbdb303c4d4f8c6e4a7
SHA256d5790af74e5e4cea1dfe9a658da5fa7e9c50c44e658dc7cd66eeae095a64ba9e
SHA512b7da6daffa62c1b8ce374a6b43662ad7b4ae50ba6710e2142e9f9ea5f4960060c95735671f98b75c9aa57b9fd8f0e1be0317f62ebc2abb8a624292788a66729f
-
Filesize
4.5MB
MD5f39cb989faa928622baa610a5404d488
SHA1b6442d4ae48e82f0100be24a99074ecd913d5af1
SHA2568c7668b69a156ea57e7a938b71cb8310559012f6b802ec2d0360aa23e8f1a36b
SHA51240233d18a748eb6a06e1cc5ea09e03b57e1d98d81a782f3c63198b6e7358443225f664f520a7a0fbe1c7fedecacdf70140dadf8f67a40fcfdf67cb8670a1d4b7
-
Filesize
6.2MB
MD576e86e16989cd167716b580ed66f8d55
SHA1ec62ee6b07a57f2d55d7ab2c433da74e7ca849ce
SHA256d2d2fc20b578e31da513909e94d9e64fff2789371b086e96f9889ebd9038b00d
SHA512a038ab9914cca548c3cbd583a5f99c2354088c1ccca714db4454a872848614394ca063d5968e0081efb6f999c05bb54df3f4bf88de76a7bd8e2abe477527d547
-
Filesize
1.7MB
MD5c76a1bf4866daf5b264549a6a6d6cfe9
SHA1f11553f9c6444f784e30b9ae67acaf05c42d601d
SHA2567a6e8b18f01dadaf66765ebd2fc067619776007a7cbeb70bf7f9aa343f7fd168
SHA51250d2971cf19be2767db51bb784c4ba30f5d55251755d6248b07370f466a8a56f60a9e92a1c4a71a2a08ff349f5ca149b2baaeeded5fe8b218b9cdc207fc7cf94
-
Filesize
1.4MB
MD599f623309e140737dc1cfa51fb04b811
SHA18907760bccde258af467fc61508ccda04381354b
SHA2568977808810990824a2da1b72a2b67c0e907b2913a9d93f9f7bcecb19c0365c58
SHA512b5c6410e6298c29b972a6ef6590db6b799b6cc959fd63de338db2429c9e69e20664de4ba3104f43816a9d86e1a1a185be58b84e285d9ccadfb2ec769ec436dfd
-
Filesize
2.8MB
MD5e0b5db08fa44ad0e4b32b8fb993c9418
SHA1248f4859de4e072ad7337ea2ff6f44d343ae26d2
SHA2565880c3debbe08e42460bdb0a4b08bf33d270941cda3d4c2089b13cbae0b06044
SHA512b24be0f84563e31084efcc05dfc7e9566466da29fa2e75f2d9ded052b32a0c69cfcbf7e2ed5b1d9ae34c020aca54ed8935fd6fb2cbae1323896a78b9b072a5d3
-
Filesize
5.0MB
MD5652236b62bebd05847becb3d83cac7b2
SHA166ca67ba243b36e1c504c5614f9606cca0ce43fd
SHA25685a211fb8c0256a4a2a022d8659aed73449d556c4abeb8b81c35d76e9e471614
SHA5129f855c21a2b6cfabe866c5ea1057e4fbd54f6cf0a04f1d39e86b91b8648917a8afd6b9a923a572ed5c012f4a74478bf3bbc4f2dd1667d9b512f232b2be6a6571
-
Filesize
91KB
MD56e03811dbfafab357a5899a91f940cf8
SHA13420a1ab3c6cf2acf681c77a9af518733afd663e
SHA2567ebe97f303984a43e3951c297880cd0a49960769390cb122862653d80101c0f1
SHA512c51ebc9ce2053d55d1cd4eb0ba1857e05ca6f66a5203a08401f56e816dea02af11e32bc157183c75342a682852cc2107b492bd4701635afeec5f33d9e4bdf5f1
-
Filesize
700KB
MD5d492c4cc2bc650cdc98a5fc60b2a9b47
SHA15cf65a213804875cd292fb9870d6066d1c0a011d
SHA256f891e3207429a8d14ae9c11370364d60628d3cf762482a834673262c35244def
SHA51236c0207feb1faf588d66e5e50ba60691248008ba71a0321f280daa035e50d58b0cdb185c335198a17ef0ccb8496c5ee0b1d508cb49fcff9aa22924ae7f24a024
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
248B
MD54b4452e885140cab4ccfc09abab64e46
SHA10279cf6647d39e46a3194cf09f86c3c2140d16ca
SHA256dd9690d935cc467bc28c08840b262b00fc022652fd8806ba258fd4861f65e49a
SHA5129ac4844b546804d7e77b0cd3c312cc4baedd5349e86a2067d69075faeda614f1bf801a9ba8b4e3a5f170504028e6d6485e28078e807fd9a17527f601a23d396c
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
512B
MD5b6e2fe3ce284e88f51b3c21ead8fa36d
SHA1020b4fdc2feadbba57437c96edc7211f7e0b091b
SHA25652f8a4ffc0392a73b1424b443671a6aa1dde8ff6644b90497139c309aa9c9132
SHA512f8896c64a99c1ded823c10b6e70bfb235ac83f96e0b02f84e67602cce785fd8c62b34ff9214d040d66c1abcb7532cd88e31f70d95af25ddb34bad21ab5c6f771
-
Filesize
84KB
MD5c7247b6aac60ccebac3000a28d193c09
SHA15f655e034eb27bd018749264754490b31f57ad9a
SHA2564867cc940f4d9c722272d9ad7ca6a3395e1f69f67ca3682ca1112a43c1912d72
SHA512b172b4db7b500244ec65daa51958e7f11023b751e5c5c2413f42848501e6aed613c0f64a898a8d00e1d2e7e033b0ffe5f518bce85f1f26df0908e87a8efb70fa
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD593d6baf796a1c4de895c00f40c9f58dd
SHA1465e96022ad454d1fd010366b523baf9b712fc70
SHA25633ff8bfbbee9c40238eedf06fab8efbf294aac98a36279436cf7bd4c24f895b6
SHA5124b6a9d893738f8b6e1048fab7cddb4e669223df6f30aaeafc76170ee7552a2c4e9c10b76050547a4554f3090bdb8b2c00b579e0f210b95132574cbe6a78f7f93
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD5045a2fff20d1472a0e905c231fc2a23d
SHA1e4e11d7bca0adf3a047aec8349f22d900dce8637
SHA2568b2debb4408ec28855676b258a2db5ec355836737ea0b4300cf3fa78694634ef
SHA512beec45aa50140ed21a56c4af7f62700e7aa6efb6f38ad6b8037e42692c186e12568dcd531c5f2355c18af1fcf698caf6b90c80a6b6e3633eb88c1445ea18646b
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD534c3052b51473ed276fb76b28b7005bc
SHA1eadd62ee798a72f46ef64bdf995e22429fa7995e
SHA256661c77bbe63eb70e11ea95215fe599c14004d2566c8e7d3a64f8ca57c08b520c
SHA512141eef8e52a5b0ba3ff3b84312e782c9ead825b8c4b789db7b4cbf8c65e6e2b6e5979504cbeb36017029fdfc46e01c06bf74a1662117b959ee1d97a9f5126fc8
-
Filesize
16KB
MD57452dfb6d6a5c49292eedd277f781008
SHA18b3aac55dfaa43d10cc0834f9377d35ab6e9671e
SHA256b5c82fb8dba4ed2dbd90f809c3ab651c03aae6a0d718aa705622863686f980a8
SHA512a1bb03826df1c96591fab1c5037e09c69714a6fa01639aa2a029d1e0b544672108be48d660dfa64187889240cbc8280454f944fbc5095a7a6bad2ff7606c6886
-
Filesize
16KB
MD5456a52ada5444882978ed08764494bb9
SHA177ec0df8e8f148a27bf69c0fe4740185b6bed488
SHA256909451700cc4b6f055b8bc387213ee374d475b4cbeaceffac2f870f4d53e9c98
SHA512a4084dc5c72a7bdb03ed5e6cf559daab2988f3ae444b882530f57b076928b9648d03fdbc5261208f950fc4ebbb353b5e412faba5bc55e56e81eb0c67f45412a1
-
Filesize
16KB
MD558230898870272aa5e9c329c0df6bbe8
SHA1bbdaf34dc17292c91868aa9037634899985a1f9b
SHA25639823a5ebd558ff3742dd3e4cfb791ade7859c474b83fca470ba60faac5367d6
SHA512b4b8cdfd21b7b7e361c1fcd5308d352b2d2f9b821d58be859d729fb9abb996b27953b84b269ffb59668e2c12dda102a5c785789d91d1e17f3712baeb8f4bb32c
-
Filesize
16KB
MD5835cfc7decf507cdc5e54f602e3f9699
SHA14a55d424cb32e766554672cb2d0b3804fc47552f
SHA25629257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA5122ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
-
Filesize
512B
MD5003146a6c6066b18bb458f25a3df600a
SHA1d551569ac930b4448abe205435d9ba57328241fd
SHA256c328e4e5731121873f1a4df2767fb890f3414053fdf68aea82786f506211c105
SHA51237944437b31ce8109ba9515c6f9b14799541d23ee2af27711c95b2aa073f2b8b8367d61f31d76119b7de8a2debfcc567a9883166b56fe83ba83dd855b8bc23c5
-
Filesize
36KB
MD58ba048d25ae99ff85da5886a24e324be
SHA1e6bbba327ff85ef79fb78973ca69cec6a2ad60b4
SHA256579519057bf221d433076ea7296919715f4eab8196a9d11d69f4f1ea168a5a0b
SHA5123b1277debdf01de1e7b832b74a80b4b981c7b4b1ba8cda0f44b027ce2407833c82b5a40142813d9a5f7c06bad886768fefc5885c03dffa22f38674fdc886feba
-
Filesize
4KB
MD5d67267328dfe6153e7f6a40439c2a11b
SHA1c971347db752ebe3e53952eeaf64475a88e749db
SHA256150d1a71acb87d2173f7a3d0f275d1dce4ebb48c883d05c24d6b6169a50ee939
SHA51223ca68bcff6f35c251bca9e72460dcd45cdb6455e76742965a78df66107ef274d115b4b239d1700278c5900dd855e4e19f91d422521b0034ebe03fb94413d588
-
Filesize
8KB
MD55b3dc456a26a948a556530a8c4194cfc
SHA1a7a00676746aa7037577cba23b3f81e0d83f1fee
SHA256e95e90e3cb3a050eb7a8e9866a22fa4f38f2cf58ff7d60f7c2fb79f2e04ad2f8
SHA512e4ce67e3618b08cef8ce2680c39de64d8ce686f2b4df002919de26dca416c07acd4e960d61b86b96544def99ddbce65124a42688ce1807dede9a1a65b70b0e53
-
Filesize
4KB
MD592d2b9dbf386d3c4b1d0a58e1ddc0300
SHA1e0b287d7186475f2c4e3303a4d7f5fc63d421bf4
SHA256f6d914a3aab2bcc04dc0ac9d2ca5ad534932701f015792915409215e84c0fb02
SHA51258e96595e53c0665669a9a0373f54fa9221d44bc3810a9ea23386df1ac2bf2e54b238a52d5e0947ae105a0188f4bb929a245cb49e3bdaba919e77e0f2b00620c
-
Filesize
4KB
MD5f4c389cee7e78ecc304dd879929822ff
SHA16475612b4265690d24f91e686e0dd246be6511d3
SHA256fa922a5ba701c848bf212800113824a400e58662f0c875321ee3118783246d12
SHA512ffb128d1ed0b1764f5d13dfd672ac1136fbf2bb7b2ec5fb6a17212fa5b70e29bb0c55ece6643b53bd744f8e7997b70069035bfac18b5659886d26ed367604a10
-
Filesize
4KB
MD5f6c45acdc4ef35213beac7fdd999f28a
SHA1ed19dc2db9db659ceb622f1f8fb11989f7105cc4
SHA256bdfc62191e668dd39b544c53bf4ec5ce0d11634538cb91312462379c0b794734
SHA512cefeadd3845624e888cfc492f25eea4aa132137de436525dacf45b5d1869f029ec1d16fe697ee9b7e4a8a95033a154c910097441734afa169413cb9518ba36e0
-
Filesize
27B
MD5f5a1362d93def45909aa785f5b536623
SHA1f47e0a49c97cee73e6c42300bb306c905a4a4929
SHA256d6804284ab0cd6aacf014e5b3f2b56f362c7ef7bf12890400f764eb2bd48dc98
SHA5128f978e246ddb796c4827cff271ce6191e3df7db94d69b4b9c5e932491bfb0d4789c53e1818a3bb7f2a9839538eb1a508a4b9b0ebdf8d7fdaa5e4ac6c0bef0b6b
-
Filesize
570B
MD5437354e797839429c4bce425bbb24dd4
SHA1ab4c23cb3ac7347ad997a4efa40294bcb0fdcc88
SHA2563ca4726483c9815bed31a6de1303604da0714a8ed772aadcde80ba011b6d34e7
SHA512d0d445ed3e34b0f108cf82786c60b5bfca0b4aa4c1f73a41bfbce66302432623b6e2d6bf69f9d1ad05e94ff7923b37c976723511f8bf1c0a8036f92555daa116
-
Filesize
90B
MD515ce0e3d0aa2b63e9a11047a3368ea42
SHA19cb11ce8344cb46271a3779002217cc63767f4c6
SHA256493f294c8b0499222558079bb42a1170ce9570c46b5c62ccc0870679f082e124
SHA512613dda00deb844e646f04d4d4f27a5aa4f8b57eb479d4da3b27f63de3fdf0a4126b53cb0ec54abe84d01e68564805f6dea5dff88397f2b5b8aa0019ffeda3aaa
-
Filesize
3KB
MD5b70e31bd4813c0d750ab0f2b12aa66f1
SHA1eb18cb51dc34ba1bbc180f20933b363f211f8b0f
SHA256e0b6316b4b907dad37cc9ad1caef262a0dd726fa8e894811984a518dd546306d
SHA512eeed2b06583bee4e216782057606d61135fea8f7f2df9d808203664a0af232c50ac0b7b8f63517c8e64d1f59715f97d40f0c085ce49857e6afbfb589484e955f
-
Filesize
13B
MD5d52225e03a82a92ecf78e714118520b0
SHA1bb15a0413a2c90d2dd38021cb29b2b11ff6e1dba
SHA25697fa7033d620558e3d0fe33b9532cb20a381d0af52eb9843f2cdbe88e8669cb6
SHA5123720ef9a775f3d5b675f55d1cce844cf19236978e1d34a996358186c9adea57e42b8ab7fb769f5894bc4b43f69a2e19da2bb0cfe0ee156c2ecbc25125381a1ff
-
Filesize
159B
MD522050a5145e61452bf697edb038f5812
SHA11cd7fd19fba2fff9927f8db3408ec8a5cbba389b
SHA256130f08de101e77d2b97519831aae0e2eb35cecc7b2e1dc8350e7c80a3b771f62
SHA51246f081780677359f163c9727d40dba314bad9e1e3a5abc62d9fd0f58dd4b19f7a4bcb43368c1b96f6dd6879fa5021111c9147c93d6e6a9e15d50d932cfcf66dc
-
Filesize
81B
MD5e5e492639f0bc3324e8632e022063b17
SHA1de8f92151990c514408220edc4db566cfadb374f
SHA2561b7a1548d3ddb498a10b81128f591047aebcfb8ee2b458abb70296581859dec0
SHA5120b77542906cf6710a8ff79c89e66da881312bec83ab54c6bce4a436acef5641cc861e0f8e71d4dd81eda513f4c6266f7110e66df41eec8cb9b8bc53fbf27c91c
-
Filesize
81B
MD5bd313b2a74e5f03e3065dc5f17b6143b
SHA128cdd278d446007702735d8a2efc221f6e8eabb3
SHA256e8a03b6499ecca4373178dc3feb37fe571dc96ae26448bfa66dcd0f90052176a
SHA51234736ee0b818810f230c7c4102edca9b6e9d133d0299e3ce83d18fcb2747977eb6cd04a4e6d80926dd6a27b13434c8e23a3db7a24a71a68cd4dd9248166b45b5
-
Filesize
119B
MD536131acb2f8a132775c75b7dda271fac
SHA17895ba6231df0385781643f61dd8e1d3df99e929
SHA2562ca2a1ccf34529eef3fc3d0e485318af0b40a3b110da36a918a66f516f606d36
SHA5128f14e5a63be86cae14d4d38b453bf96e932c37ea10663b472ed81d356fd0eff0871287fae5c46a2282c537df77b9b0f508accf861050ccdb85185c6216513a3a
-
Filesize
20KB
MD5860abd6167f275caa55eb9a4d5c08112
SHA1ea0c77d7800cd21c2dd3a4cdfe3ddd7bfe1072d9
SHA256e8a9a7f2297c03eb25db01ddafa475d33a02c21a6278fb87e2d79d9221a8115f
SHA512a798804a6e786a6bf00c3c0c7c26fc66625ae34425ca2f6fd2a3d10a36ec27c0f0b472bb43bb5f4ae5dcbb1ce825d5b1b61e679452e6fe45ef15840f06798ada
-
Filesize
10KB
MD54faa5f792089a531d37e0b96e6f22b4c
SHA103008bd2f253410eaf7e6524981f914a01f8ff9a
SHA256f02ca8515f22fbe6706d6c4bf78055ff41394ac6af190ce0a51b7842d6f2334e
SHA51231cc3fb178dfd93251045a0e1b12cca9b852f49c72f3d1370a124bb9941341e0110ca29c2f42fb9d6bc2640bf5e52e0435ee808b48857f8aa057a03b47465143