Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14/04/2025, 16:05
General
-
Target
0720AEDEF3D2C2B02548F7922A0A3663B31D85E470C0EE09476BC3789DDF5BA9.apk
-
Size
52.6MB
-
MD5
cf84555bba5c12fac6c937b3efe11d3b
-
SHA1
8524f0e7ce2be16f28d2831dd5bb8536ac6bada2
-
SHA256
0720aedef3d2c2b02548f7922a0a3663b31d85e470c0ee09476bc3789ddf5ba9
-
SHA512
1983a75750ff895488810c509d908d94a1af95569eac1ab97dc455d289bb80346aaadf05887d8670698ae8fa6f722fe3767d425e1fa920a01e6e159abf456d1a
-
SSDEEP
1572864:3AMvqmeOIJ5ojP+H4U9X4U9r8bwiGCUoSE7BKrwO:3r6dLojU4U9X4U9r8LR7BKH
Malware Config
Signatures
-
AxBanker
AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.
-
Axbanker family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 13 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ultrapower.roamwifi.changitravel1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh -c getprop2⤵
-
-
getprop2⤵
-
-
sh -c ps -ef2⤵
-
-
ps -ef2⤵
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD548671913778fe43f298c1fec714d3aa5
SHA11645a9703ff591d0badf89bb38dd71fc3b519cff
SHA256e15f64caecf47568132c43ef290dd4d4ba63672a4d7411803be63609c98cbce8
SHA51272680910359ede2b36c1210510c45a07964d3ecebf3b34a1203bc52f4fe57839e4cca930bcdb566315698685abfcf05efed7a5e6b7f0dd0fccbe13c39661b0d9
-
Filesize
4.5MB
MD5600e78ea1470c36e0cceb28bbf7763fe
SHA19bb3ca6fe39605430fbf059b3979da9fc3d61d07
SHA2560e9b93bc813182075beb7af8d3eb099a0fc710482f51113558e1bfac5b3d594b
SHA512fe7ce67b5066c0b90a3c9c342dc026666522e03cc570ab191c83fa84a22344b9c60917ceaf0016f91ce817d0a303f89b96b069cde23620b3ffff8c434a3ebf87
-
Filesize
6.2MB
MD5dd113dea392aa2ee48eb4524516cbfdf
SHA1baa13e5d92c55f75f3454180ecde3b1b1342a9a5
SHA256216014266e09a72c5b56a0fdf1cbaa922e30ab18c1f23d023d5e7299cc30f1cc
SHA5128bd1a701e999cc5506dfc5ad288aa74f02198deb3ce23e8c1c55a3563b1aff8a988c3645ec98bf91bcd44bd62a96209d14f03ce2f72295f98f7e7b7945fc3a6f
-
Filesize
1.7MB
MD5b577e904d9bed1adc1773ee450586d7f
SHA1c413475208ccfb94155312ad3fec7ecd9297229f
SHA256f68e01b0a5d67aacb223ba54d1656c1e2aaac978af534e5e72794cae06b58437
SHA5127c42d14e19091a7dd271b47130743065759053313e2a23b2e707cde9fadbaec1aaf03b79ffd80d7b9194b9c0f6eafe1739cbada038fdb59f436ee1ae8d3ae07e
-
Filesize
1.4MB
MD58d803aaae8997aeb778f8ec11612548f
SHA1f1bb9a1c9d94b4cfb290bd0245860515eb087812
SHA2562a0b2f2e417285af7c8481381f4d9e69222c464b5105d3fadc2f7c85051475d7
SHA512e26986a76d8c1c693e6879f1fb3a2ce33605f3f6a695234fe079264a8f02ed8889ae7cddb4cbb0e8765be07179bf2c638cf085612337ccb0a54cc61f1152dd0c
-
Filesize
2.8MB
MD58f2faa7841e3b09a5194d4f74b0e9d51
SHA13a0dfa7498484de5701d3e2e982c73e3e408cc0e
SHA25676deffa5e46fca4b97e7834d22814583f4963a50c3f9c7985edd38f32e477fb9
SHA512f0429a1532de66a0027464f7f444ca70f716d0f88056d74411c0af02575b541397b4a4b31020744446d36e77f18280f09d10504134e515e482545895d6dbac42
-
Filesize
5.0MB
MD5afa290ac8e92579630ce40684b11a075
SHA14add620a982a21be3250d3df261a23d1c2adfede
SHA25627307ee348580969e3e0001af33577595206fc20f45f840615583ce2d48366ac
SHA512cd88463c8e0c6c7e9ed9da438bb336442452db06069b0de7ea3c9910d5d540f1b8f858c6ff695aee78cedd588eac97ee7919b31b1549fd3fa5ff48c30f8b6d09
-
Filesize
110KB
MD5f4c023f40fe7320409468e3571f85b02
SHA1025cc1b4b23764778fbd0809181345f091220653
SHA256213237755d41fdbfb9d3a4170c1238c353862aea0c31682fcc1e662731279a78
SHA5123204ee466d4126ac80cc94546f9b4ebdc0d3dc81095c12e1fdab1590a738cbd02421eb18d5a964e7b7ef2e8b295f64f28e80ee061f2b7c302aa51bac47065e71
-
Filesize
697KB
MD5efc5b6d16b00b36497edf1ed9f75ca1e
SHA15444de54cf0de825ac31e782e53089df8e43d175
SHA2566544941690fd703597c2a5fd38ad103843f576e49bb8305b980784a76bed8382
SHA5122166320d39d5437e20b77d9fd54726d08bbe2515ca1c052ec4698ba25eab14ec3905eab94ed5997593549b253d156109fcd9f0442ffe1eec583613b50a7d9796
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
248B
MD518095e200ff4fb09d3f1c722dfdd8520
SHA18394dd40faf33fca32a1f6e16b69465067d9954d
SHA2567349841e24d9b939acbf1516fef9dafe1e6a461c1ea57e41f25685d13dd42443
SHA5122548aa9d73aa2ad78399b3361fd7d6524c33699be25b84e58bc08077a600e788a7c2c7d9cef7ce7583d222ef7b8b8afac00fd5fad59995f7468f94f22d8948cf
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
512B
MD58e504001a8bcb4a4563af31bcffc3c40
SHA19df3f22181774ace6353742d9b4c8c1b5d145186
SHA256960e622b6eb25a23aeafa50f068494d72f80c8c3dbc713c23ee31b757654489e
SHA512a187fb947b88e39fc13ebaac646b8595f015a357c3d5f4091dbb3c8d579ab0dd3cf8f408e31ff13233f432f17047773dcd5910a0eba9f289401b93db022094b5
-
Filesize
84KB
MD59a07a1ccb20ebbc6797c93f09067384a
SHA1c5b81879c8cb7caf1b6f5391ff60d80c33ad1b71
SHA256e25ae577dcdd5d80a3a58abda32cda617873843991a53a6daf1e3a37fb0f0e36
SHA51279bbab330328e163a87f395a3539d5e77bbfbebc9d850426b3d274cbcfd51253af040f542da7204e3a3958749e3027961fab909b11b1f951462e8f478b3e7a12
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c04a2fd05c32f96e5b2902addd023f2c
SHA136f3c6574f53dbc8f88bb25285a2ca317652753a
SHA256c6dc33fb1cadb3c48d94d8cb95da30e311f8784dcd4cb1cda036e39746de904a
SHA5122db33e18fc76c8ab96ee42451e4e0c0eef8d0b9b9f80bdd9a861bc254f2846f651ce77038b47bed616ed96ca8f0b2ab1b24e3d4d316ab71152560b1d43e3c31b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD51921b210be1c25a2f4e0c38963ebecff
SHA11d63082348e1250587187db54e3fec51b34d4857
SHA256d31c0c1c1b81af1063db4b83a9c56768fbe004d6491880180ce465464efd706d
SHA51249ab3363fa4405573caa830666c03dd6b530fadaecf940ca0a11001c375e9162a0c762dc09d87e89d55ac76dc6861f15efbcbd6cad168e4561c158c4318f2fb1
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD50ef5a35addb40727fb18e7552f09ac66
SHA1aff567e8cb265d5ac689ede27364c0a69f68b749
SHA2566fd28526f8349c6bab10a24a6e5db01a0aab3e4cf8a9b7da77b2932048e3a2dd
SHA512f836a87be0cc7fa1ab8c727b0242d734e88e88c48a4e26d570f10207b9fc9607f94c62f5b0cf494a60843ced46d130207dd0cf7381a61ba5ab13d5b21a1d2eea
-
Filesize
16KB
MD50dcf4c145d580c34f5ff131a599b1d5d
SHA182f44b52c90cde32f71e653b0e91af57a593bd50
SHA2568c57708d887ceb595f492b3252049713894d1b706f238992ac9f3bc57b1983b5
SHA51270ce7e80bc50e2bf2dff9857cc5a30c4bbace2eb0bf07f653c1f8dffef15699eac47e62574fd698a5dd977449c2956af769a18c70bdf31f7b726315c87dcf441
-
Filesize
16KB
MD501afc889561c3cf749b9e2412c6ae308
SHA1cadf31a3f5aa023c418fcc4d3a1208ca7d851934
SHA2564c71a64f6e07180abec531ae42d3c2b52d017f3e2267399cf2a83b717cc60f5f
SHA51278bdc02ee9e6c307d6f5393b8de21ff13d7c92e5756867aca9ddbfb63368310291302af3a320c5c615d76fc0cc06f874b4c01b99c950c30bb27dcdb2cb2a68c9
-
Filesize
16KB
MD585fa6c6efcdd4e602aa8976aa3e390d5
SHA1665b1eaf09ca76001951e8beaad4bcc7ec8f7af7
SHA256d81ec72d75a220e9700341f4d24fc79fc9dd93e2fddedd7c5779a9a2c50f857c
SHA512f0ab4a68c8342c8c33ae4a341094767206bf7de3fb7c34ad43944df5a495f93ed0b0a4a6854cd0dafc090a87c00a609488d6660beaeef45f54f38d11c3add9a1
-
Filesize
16KB
MD5835cfc7decf507cdc5e54f602e3f9699
SHA14a55d424cb32e766554672cb2d0b3804fc47552f
SHA25629257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA5122ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
-
Filesize
512B
MD5df9bbec65af3dca63185ecd066ee1e03
SHA12ce4a4e7ec021a9ce4b6dfa56f0ebf1ee1de9ea5
SHA2569e87461d5fae7efca0bcbfe229adc5f17c23d3513322a95452c13e310d4c8c4c
SHA51291cef9ff54a58e842d3672ed4f2f22a7f87a8800cd35cdd7315dd04fd296115115c6d1148155e33083d00a419647db9cd69ac9205df06ac8640c0c744453a988
-
Filesize
36KB
MD5e67877f8b266dd8edb2e6651f204c6ab
SHA13f178c251531a8683f3fa7eca19ba8d49bfade7f
SHA2564f2e79425347feb429a5fcb3528a5fad3a69ecedb1b8c3c3282673e4fd3014cb
SHA51244aafe669e25821caa3e54307c5bf9d65774d2b287b7eda0e0323d3126695e9fed4caa6e54d6dcbaf0f66e47ac054092aee2f3a53b0219b548325fd267733268
-
Filesize
8KB
MD5bcf663dad64552a9f719f5809c223686
SHA1e68801e9bd3f71dcecd5bc24cb09e76f7cc18d74
SHA256e20f7b834dd26d3ef81f2995acba70326bfb2889988e3b338a212eb8fa4d040c
SHA512f4d24cff291b20650d0e8c27241a320af483c2a6e61aef03ab4f387861428379e6f19dd63fafc9936dbf6cedfd24310a87c77c687bb04891accecbd31ec9536f
-
Filesize
4KB
MD58834c4a52708056b299edd7c88ebc801
SHA1964a42fdbb3e50f9134f5d0d4d0267ff05b893ff
SHA2563afac2737dfd9af1a2e1b9bfee8cd9ae0c213c2530eebaadcde4bd82fcce3c04
SHA512c7a22290e5d04473d2e0298b5ece37edee07a8da7bd93facf60a3e06ac131ab80cefb5f0cb5a08e9887a478cfc771189c6baf076099d075b70302f9d68f23d50
-
Filesize
4KB
MD5226f647d12c61973a4932c5d13bb1b8c
SHA1838c3e20595eafc6725676d352d37060a2f28c11
SHA2563cfd04e65e2ce0b52141baee7d2081f6014509fc2189190d2593d247351b7e5d
SHA512599299b2d5eed40a334377d5d3a361daa2e2676badb267c63b54468d2f4abc2d66fc46c1fcef81164bff5994fb2cfdfe126dff79296a6bebd2b96b1ec63da908
-
Filesize
4KB
MD56ed6292fe9e8025332cd5c34d66b2323
SHA178be589b32dcb36eafbb45c330c706c0e28b49ad
SHA25643ff0c24bd59679b8339607699345d5ba3c323ff6d105565651fb616eb8a77e4
SHA51221873c26755bf778aa45dedc17812a6b9d0d5a6b34a3777d49b32692a1ed80836132ac6df58d9c12cff2033ca682e2f063710af3e05bfb19d4e196952c11ab11
-
Filesize
4KB
MD59318dc0d95c4cdf1a02fc918983b4528
SHA1a34a18ae75ebad4cd04838d57fbbd9fd7e10bccb
SHA2568f0a58b152192961c65a029e81bac314dce173563e9647ae045ea1a8a992e0a0
SHA512f70590f54ec9f5509d0fb5b04b42d22be99083a239b1d99cbdf8d58f714d9d48abb42e849cddbd26f4a767a753e87eaea40d2dae276da93ab6b3a91d4c83fa2a
-
Filesize
27B
MD5f8032819b1f2771e87c72c8b8f8c588d
SHA1ef3694214432d5c2a3522eb36eefe57b3637a9c9
SHA256d2646f8ae6eaff52f1c232a38db017fb23a86fdeb8e318ecc1b824ae49a3288e
SHA512f39b2003d3712c5c9ee5b6edcbdf3f77da8497084e973dd2490d826a2c2c7ea2e8d4de71c3e7fb5ec18d07a4d0dd6c58d635c8d57dec09886f5c23637371ea82
-
Filesize
569B
MD5b4525b2a9468e42dab806b18c9b2418a
SHA1c2d7e5d646c2e98211e906ce505f249e8b783771
SHA256add9e9909bb2609ea67a1863e9964699f1832fb3db47cbd95b6bb28d8cfc58e2
SHA51241028f854123c64107cd6dd701779850b04af58041979a631a2ea2306e5f38aa2d9c005f0373ab9bf37f23351dc427aec0ec1282e44e5b37cceb437ecde012e5
-
Filesize
90B
MD58fed44382a3a5ce1496cb394bea5ff7b
SHA1d3c3237044502255ae884828cd0d772ee04857cc
SHA256e694ccb640bc2c5a7cba5141a7e8fbcd107770f51f8b47ddb330c8b983ff4a9e
SHA512b10974ba7e8b6a03934451519350413e937c326ad22ea846c80be2c41dcbdbe7a2ab08a6768bed60a00c768a3eaf0463508065100e766114d14089e987d27408
-
Filesize
3KB
MD5b70e31bd4813c0d750ab0f2b12aa66f1
SHA1eb18cb51dc34ba1bbc180f20933b363f211f8b0f
SHA256e0b6316b4b907dad37cc9ad1caef262a0dd726fa8e894811984a518dd546306d
SHA512eeed2b06583bee4e216782057606d61135fea8f7f2df9d808203664a0af232c50ac0b7b8f63517c8e64d1f59715f97d40f0c085ce49857e6afbfb589484e955f
-
Filesize
13B
MD5aeac1e77054482daaa50a2ca65ab8d4a
SHA12bb8eedf95f98442d52476185f0d703b8fb10b66
SHA256bfb3aa2055ae41f717a4344f42de5eca30776beb4bc0adcccec328afe20bd4e2
SHA512db84d8cb1c6c67bf0565b8e17180288bd65963ad1682028e983c49e2d8747c8baa7ca5f500ba1cd5d66513a619bb4773514893654cf0221d0f574b3579d0157f
-
Filesize
159B
MD54acba6fe8bde777003d77f1d8008da3f
SHA162dced2ab21b1256da051f0b05fd9cd1345b973f
SHA256c3bcb708e69f618ef8d81c0b49ec1ccd67a55d53664dd3c3a1eae5e35209176a
SHA512641c6fc556f75acee06b7c8eaf267a683bfb1e8ad86eb212cba269443eaffd6ec1a6f4fc5daadfca8f2b6fa1f5b3f6b9f5d940dba16e24336928290f078128cb
-
Filesize
81B
MD5efed9ca193e1b24cbdef9222f71c6ec9
SHA155883880cafc74fd08159c89a40bb9165ab3ebf9
SHA256318a5ee79e8d8ef13d0b1856284fd9dc665bc050bbbfcbc6d22485435bcbc986
SHA5124da63e0e8556fe03e3595f88e46e57061dd4b116e89da1db07351b9280894428be623fd95600dd8360fd19259f55e9c9c4c3778a8e1a8dfeb7aa58d3871a93da
-
Filesize
81B
MD54464d421d361d4e0240f3c7ebbbaaa66
SHA1ab6dd6d7d29c094fc31153573543b45d55ff76fc
SHA2563b75312c4d4a9ca15a679be2709f51e9146eedd01e2e57773e8661271203afbd
SHA512ac77f1cdc82d539d39f5a1b9f34a71bd636a488a61fe48a09cd315213185bc9c7205c79a4a7a8a81aa0aadebadec75030897b49196fa5352be686e11ea110a55
-
Filesize
119B
MD59f92ddf9ede2bc3a9e0787ce0a4d3767
SHA15e897dd2cf80520a891a6a6ca46a5753a851be95
SHA25613e6064cfa630ff22c93844852b772bdee6b5236e06974d9f037a1537e4a9c0a
SHA512e0853de0c8b6b2ddfd5630cc626f12a2a882409f5ca5ffc281549a2c57522ebda1b848f3cdebc377a3b8b6a96179d01d7b964e7d936bc7abb44e26dff0f1cfcc
-
Filesize
20KB
MD5860abd6167f275caa55eb9a4d5c08112
SHA1ea0c77d7800cd21c2dd3a4cdfe3ddd7bfe1072d9
SHA256e8a9a7f2297c03eb25db01ddafa475d33a02c21a6278fb87e2d79d9221a8115f
SHA512a798804a6e786a6bf00c3c0c7c26fc66625ae34425ca2f6fd2a3d10a36ec27c0f0b472bb43bb5f4ae5dcbb1ce825d5b1b61e679452e6fe45ef15840f06798ada
-
Filesize
10KB
MD54faa5f792089a531d37e0b96e6f22b4c
SHA103008bd2f253410eaf7e6524981f914a01f8ff9a
SHA256f02ca8515f22fbe6706d6c4bf78055ff41394ac6af190ce0a51b7842d6f2334e
SHA51231cc3fb178dfd93251045a0e1b12cca9b852f49c72f3d1370a124bb9941341e0110ca29c2f42fb9d6bc2640bf5e52e0435ee808b48857f8aa057a03b47465143