Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14/04/2025, 16:18
General
-
Target
C557A7988C9CE4664DE864A529AD53D4B871A4CEBB271529924E29A32E4832DB.apk
-
Size
52.9MB
-
MD5
eee54e651fce242cb0f61d548c3616d6
-
SHA1
22994e0452e6d124d93b7dbc4bf9cecacc9cd1ef
-
SHA256
c557a7988c9ce4664de864a529ad53d4b871a4cebb271529924e29a32e4832db
-
SHA512
ad3ddb1cfde5d120ee5652a6ea6f7863fecf8038983670e68ff65e42bd5966ab022b54787a554aa9a5300f1a76d0951b2ade93908e65dec2ceeb6a45d022089a
-
SSDEEP
1572864:hyCemeOKBGm2njP+m4U9c4U9O8E+wQ6CUoSE7PKrw2:hyCuJ8m2njz4U9c4U9OBgLR7PKf
Malware Config
Signatures
-
AxBanker
AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.
-
Axbanker family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 13 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ultrapower.roamwifi.changitravel1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5e869fb66e98020350a8a87807c657266
SHA1ff12dc8dc42de33bc7d25f51e50859dab71cb1e4
SHA256d07e75bb80bfced02d204b0f51666e9f84cb188a76170dff9a80f5cef4198184
SHA5127d7ae1ca2e567196e8dd7094b5f9a7789f67893fb8f0e9ba816a23347174fb8c111ba9dd3b48b4568b1b90aebd1f6b978ac84e06041b0fa476d4e69b1a787a60
-
Filesize
4.5MB
MD5ca583f09b6fd7ea085f2273a776ef888
SHA186bf9b28e878b3aa5ec2f1a64533b446b4373859
SHA2568d5a8753cd9612da55570f19049e02353f07c39bd5bcfc6fe806b7d55886d33d
SHA51274cb4acad138f3a5bacd2d292e3e9875f7cab86070b7bf545e7874b08437878d4c31b4c38f122de632fa157ed9eda0381267ca91a7e17e4e92a97a3d88daaba1
-
Filesize
6.2MB
MD57459e1c37a4676102f8910621cdc0547
SHA14bc031c88dcb77a89e0334061d67b25deeeaf60b
SHA256c6a42a16cd1373630a44b622faf4e326e0a8b030eb622e480cab49aa228ef394
SHA51207471ff739721e7e76187374605902f76009a7ea8aad1a0b408db8ea0e70b5607b7d2a5a8f805e5a894ba82f37c087d3500a55cf3eafd383248628bea35376bb
-
Filesize
1.7MB
MD5ff8746835719d4493e33b4c3831454ee
SHA1098b975eb4f5577bd04e296b7f6618f8aa3ad0c4
SHA256536407835801d46840510619d96d26432293fcf5263c1df28c363eea0b51c253
SHA5123785b2c597c72b13c107cbd4d8ea3b7fcb1a0da42fec9205a9fa8180122570e7d00378c1c8725b194aca8078f3fe7c49304abb9846b241c2a821f52233c60edf
-
Filesize
1.4MB
MD535f174707ad232de55b9c2050a1744c4
SHA1b9f889a0b0e626cd40d7cd57a6b5714a8e9b0529
SHA256777ecee36563b5945843ffc7defc79e7225b963539b0e0a416b74d1969d6a916
SHA512c38e1a74e6adfa18d4f37371ba2545257bc0a83360ce87291889e0dbc65e40247a248f20387cb044cc77a7c270997055b56377812072c9f1edbc27da51430752
-
Filesize
2.8MB
MD5834f789ae1699d6f2306cd74e3b90e62
SHA1a7692baac88c5cc6492397bc63425932b0f71b11
SHA256799169552962ff84d5f99021f794bd3299196c008bfe201985ffdf9417e14567
SHA512066a00a66b4bb6b61278b0da4ee1a76b34f77295aae1369c05178389e7b29ab91705d6bd5f600892b5b1a81caba50ca02fc25e9fddb43af5fcefd57773a996b4
-
Filesize
5.0MB
MD59996e5d25977a5aad128ec137f7b016d
SHA1f4959355f2569ea58722c4b50772d007c85fcdbe
SHA2560f5d297315ee7e08a90c82c965be8edf70e7649bbec8de393adcac99d960da27
SHA512cdda550d5f609bfb4cfce80e63f1a0e1608d9be2f2abba198221fdf045adbcdcd1f5e01cbfe6c043769504da36ccb471ea2d63818ffea3fbfbc5d53ed2516bb5
-
Filesize
91KB
MD5a3a09d546e396305f6f1de28c31b8054
SHA13916c52a2d137e58e4a92bc70624b8d91bf620fe
SHA256036606a812bbf697e855a6114d880171541952f394e6847edbd7008790054260
SHA512a5307a23743fd7cdf01e2a5108262efa71d435ce6705eee582dad6319f338f398828ebd5f5dddb45c1d100e3274cb4ab3ec59ea89f305b844adf73a401489386
-
Filesize
733KB
MD5cb8063ed3b5d94b6b3053fb491f1079c
SHA13894869ef4f144dfcffc8758e3c767c1b772a0df
SHA256689c8d299e2af7278d7fcc8b4954457ae1c1a64740710c5d47d37077cb9ca82f
SHA5124b3c280ab90ae4eead120bcfc57fd6bcdc754ca939b87ecc36835e034b1e21824594b94ee2314d6a02990f864cc8520883f374a5d136c8c87072307f68313ad1
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
248B
MD52947ee5c717682acc98a9a755031f013
SHA1c0c8248d78551d8567b0c758f3f5bfcf4dcff81f
SHA25646eead323d59afa5cc65d140a4fbe4064a252c18b77143565a9a7a4eac00df29
SHA5121f1f06d62342d0d2881584dd4144aec9b4c743a60d815739f50ea2cf46ab7b43724c785d70684f7229103f6dc14bdd722c673ae086792e14f1ffcf7dc726a89d
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
512B
MD50135c020ddd1f5d510c1950ebf7b9d94
SHA12aeb7ec8e490ed5548fb8106c4b7f0a5d37dbf8f
SHA256a9c9bf11c7032a0fd1fc1b8286accbbddec86ddfac6da122ff2ee5f580695ffe
SHA512b5b27808262e0921ffca5a6a97e59ce1374bbdb98cd1e4a24824c54fd58b0cd9545918011daace7bf1681b1e22877f136ced0dac97008c49ecd0691b4f148606
-
Filesize
84KB
MD524d0d1d2e098792e3adb54cceab1db6a
SHA1bc45658524747030029c00269f691920aff4701e
SHA256c8f447eb53ae1a8e4c5a0ece2e63509bdb228b552ecb0a2bebbe8c29e7202fd7
SHA5123ff38903d2a3c33cfe430ed1b965dbe0481b49099dd50da93c6226f60c9815305be76c035da3a07ccf1359ad41c2ee103f122fff81373ee92639d9bef82cd39e
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD522d27220bc21b749496d1840f256310d
SHA17746ac1ef1c376893d694f0d9ddaede32f631522
SHA2562d4a603d3d2f28f7ecbc2d0ccd9e8ace86b2be1ca56e23158a49f562f513fac0
SHA5129448130acfaa0db416c010935c264501b99413cf638f9e0149fdc927e8c9f570cd975a9da25c0f727db8dd117c4db1665fe04fc376bcaeeae33c38a681ce0385
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD56a6b268beec267342a0b2dac30887190
SHA1054c00542e24debbb482a9236f0cb78b1e787ce8
SHA2562e600b338b8158bce08b6f568457413e2559c2f8918d10e7ed6eb137683da3fc
SHA5125289742c725fba0f14ea0fb683d3859499a1623f0490021f06476d48a9638f0ef9d6882f3e7bc349a068c0eb0d6546ebcae70693254d0ea7365e0bef5f30d166
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD5f4205547e162fcaf80021c9c7d71e78b
SHA1d29082b3a93ba40f2a2d37bd325e8aabcbbfb0c9
SHA2567d848abd253d61dac7fa53007a62d08783d69f1026518360458e9427c2cee194
SHA512a4aa6931b36ab5fed60b941ae11a62d59e3edc316ca7e09ce85d9831725bea04f764f1d260bb03230e912b03c5438656a57ebc2e109b26cd2cf0845f1d06aed3
-
Filesize
16KB
MD5e7ce76ab2828bd14e9b2fd2c847dc081
SHA1c555c6ef3dfc3e5c80adae77f06ccd180fb45d62
SHA256b3c68a18708b2f42e73488bf636d8c30b9f55d800ca9c15c812c351dfb349ed1
SHA5122ca19adcd035b62c77157550807fba31c28f5ba91aa928524e3e0f2fa6b45c2b62a18f2165fc987391365636ac30898f05ab1679478878ebabefffe2b6cf75b8
-
Filesize
16KB
MD54d4c490e265597710e9904febe792560
SHA177665e75b9f56f875bdc0688422124bbc3c6a551
SHA256034e9f8762a314cb1a195ff7bb7cbb300963b8fb7a983d1a386fd38b3b4ab4a1
SHA5123a0f9522ed6faa8cbe9a2cf9485bb025725fc5ac6126bbe1f0a608ae0fa30a41d59e5cf3096ac9faff2d4c6fac05cc44a3ff2fcb1185ba957f73f58a12ea383f
-
Filesize
16KB
MD5dcccf7095fd0c7c0fa054c52903ed1eb
SHA172db5930f80aed1f3a73192fb4168aa3bcfc7309
SHA2565329daedec9d7d15a3d071c6b7851c2280bbf8702ce10d49107dc123affd8e93
SHA512cef7d1d785c49dfeac144662c49ef8c130f47c2e3a509ee2d1714bf2754ec3406d98341d35f89119898dd5ee74a932536ec25a15fc1f0cfd2bcd8bad7e7975d9
-
Filesize
16KB
MD512713cc432d13249a44d412f9fd7f1bd
SHA1f9676fd0156eb1d9e7f19b2c553b73720f930c4b
SHA2565397b4e50e224dfe7cd6e6e2c2f9587ea91f62fb7d1cc73667c7f03b57492c85
SHA512bc1f44e322089d61293ba8f8fabe7c0e656f87b97f923cf32667150fd56850ccb92be974d46f6d449c928be6772cd422de117efe14a92bca14d9ee3528e12db3
-
Filesize
512B
MD56f65ff34732de88d80324366f61fca9c
SHA15d8c1bc29d6a97c99dc4fe0588fe56ae99df64b2
SHA2563fee4677909086ddbcd518e1d131ce8b96a92b6dcedeb5472a46e1013f3ffdf1
SHA512762fcffc3e478c90194ec8703b911bd278147bfcda24a6e2b5e2c93f9cacb3ebd625e48366867698ee35fed009dcf29424d4836f999bf9484e8142c1c9bcc00b
-
Filesize
36KB
MD57c7085e70ef1b9cf0882670aef4fc3ff
SHA1ba80922250be5381308c7402e1b996170af53ac5
SHA25637e5289a767ec4e8f755306e25d302821a1186f274f74cb41fa6b4eeb235c91c
SHA5125149131355ea89ab647b180d0650d7a3e83e580824c84a99c994cd4c710974dba741aec87465376f868febca9dbbdced38f1d8686e9978304eea13bea6884369
-
Filesize
8KB
MD598f9f693c3c2d752b4ea3ef9f634285f
SHA195c1f89add51e03c301e2f3ff5dec5c74fc3ce3f
SHA256da78cd23b2ef1f139078e90fa475684d710cbed72d49e7ac52258a9b95eac190
SHA512c766b44fade61e03d61ecd7659a1c26b49ad2d6f25f7bd5df757c8edcdeb7a41ddba64b4f496db8add6e15ebd65ccf8518a60e57710662deb96ac2a00636e027
-
Filesize
4KB
MD5b48824ddb3af9172ddcf75f625d2aec1
SHA1579f21c86d6b8f1176843fcf33bac44352313ad1
SHA2566f7ee75973ad18fd2ab651aeb4a948a24a4d92b41f338ef5dbc7effd81310592
SHA512673813b14521c28f7a00fd54a09cf4b1ccd43d9d4a9061cf624737940f63f6e1a1e9fd8cef7d4089fcb390f611e4b158b0075a6a5773c46ab499d9d585ce1447
-
Filesize
4KB
MD52c39f268bfbb386e3009a8c543d0b39b
SHA18f4855bdc2f250234f0545802f87b387f7f73cce
SHA2569bf4662a91e0bd6d4423fe96c57fcef008f870e173748c7011e7da2f0ca58a6b
SHA5126c985f1c2ce6f866c6ecbfe3068c71640907b3667f11b8ae6ea309acd7aa1c535fc22507fdbc204888561f6759c07e5d64f4cb0b99ab94e0fdc42d5616cf30ef
-
Filesize
4KB
MD5f569ab03ce6519a9a32e94fcb19b19e3
SHA1f9cb657369ac25585300cd93951d8eb396b65664
SHA256794f2da94824b24c88cae61774218898e5aa505da247bc60581ddf23ab34644b
SHA5129895e4ca99863732b18397a154495ca6ab5fb0cda311205325c95d2db00e65c8d0c5daeac515da62c8f3d41f3685152e4cc085dd3d0d2928d95b26de5df26caf
-
Filesize
4KB
MD5f54a65929b57dfbaf351af0f1112745b
SHA1cdd2f32eb245ae82e9a91a216a710d7ba304a247
SHA2569ef62946b9524d44dbe74bc4c61f77790756bcf0baf6e237ab00d138c3b75dd2
SHA512455b830285292a49f074154a0edfba0d3ba57ef30679b3b860c4ffc33c3044ac93bc58c444116e6404d376df124c0983c491715c6635946df736f9c33d678ee6
-
Filesize
90B
MD53dfaab4355fc556020fdd132b7e78049
SHA1c00fb85c70c32dfd671deeb42c0caaa01856448b
SHA256113f31043785369d7745b84ec9b2decb805669b5cd7a44c36f019ba453277bb6
SHA5126f8429bfe8031ba35be3c493be5a2b177d4ac485970c65b8f22b3b096eeb35494924d20d587cc44d0eda88e1f032fcd9a1409ff737826e2551c13c00f8430c9e
-
Filesize
569B
MD5344f25c0eab211d08e3b2a1a1fe2d585
SHA189d02dfe5fa1eed9c1d678910650b9baf8d22076
SHA25694d32fe708d6563c23d40b7ec4b25b4ee783fe3b4231ba06bfafc453603960c8
SHA512bdc35f126abbc584f1d8cf6d750a35bc1fd89bfc2ec2ab933b735ac13bae98d8299bd07b728cab4d356a79ba63722179b713f65243af8495fcac2cdd6de74538
-
Filesize
3KB
MD5b70e31bd4813c0d750ab0f2b12aa66f1
SHA1eb18cb51dc34ba1bbc180f20933b363f211f8b0f
SHA256e0b6316b4b907dad37cc9ad1caef262a0dd726fa8e894811984a518dd546306d
SHA512eeed2b06583bee4e216782057606d61135fea8f7f2df9d808203664a0af232c50ac0b7b8f63517c8e64d1f59715f97d40f0c085ce49857e6afbfb589484e955f
-
Filesize
13B
MD57af903599dce62f94b26a72e17f169e0
SHA1712566a6761120f5e9c57adc12a60ade0f894e47
SHA2565e9e5e54db4fdbcd30cdbf058fa9bc6ac28f4c6d0b1651b3088ecd8cbd5b28f9
SHA5125809f44cdb88b056b6be7f3f863ac4748810abfe13326fd031d07614f4f74ac7cd022f74be99c231bb280eba12b7cfc7d1cb28a35874f8f0b9d927300dc987e0
-
Filesize
159B
MD51e8aeac408618a344c95b15e429b2f2d
SHA1e9e5c601b371db70825613d72c416f2fa4bc213f
SHA2569b1eb19f1052ca4599073bb536828f319e78ddf3459a939844ce8865487647fa
SHA512421d1f51fd8878727a3daff2acb82915cd53ccd359ccdcbb465bbc8a29d52ddcc5e82623a72e321f06d53fbfbced7b12f39b5b3be3fb8d9b7bf63d2cb89bfb69
-
Filesize
81B
MD54d7bb04b8fb188833f1a536d43a85095
SHA15de54a43a87d5a745e2e49b19ce700de1b18fb78
SHA25670b5fc1dc4a0061cd7a5a9d00b65f194e0c046604896f7dd88e0c06f5ff90bd6
SHA512b28929d85dc41ec138801ef0e380a5a108cfdf277ba7162743c2d83c72abe7f8507b620e998e8251467f7bad848e7fa2edcb8a8c9887631d845fc83860d4e245
-
Filesize
81B
MD5f5ada62a908b454eea0da613442c6144
SHA11a21bd4015bbb3b1b7d2b887e469abb8a5d1bf88
SHA2563d6aba8d6f856d0cee73a4aada4c414434060e44b30b197ff743d3e232a309f2
SHA51242c60e0a198af5203bcc0ea67dceba9387e20729e63c28e9b01c151673cd196eb699af8eb016eea18131c100559b250e68685940dc24d0f86ca70f674eac4146
-
Filesize
119B
MD54150712b6cc74fc1d54732f7cfe14606
SHA121dc6eee71a3abd0f4f680ac9ee8ad627cb3389b
SHA2567f8122421818618bc23b7de69db4e74f229c021fe1c421cee2b4799476bed7df
SHA512820cbb4e819d13cd54801867fa20f3b1654bdea7e91119545839c37efa0aed6370e3074e655d62027709352c6a74b83275c5c151b019cde0a96b6387a0abaaef
-
Filesize
20KB
MD5860abd6167f275caa55eb9a4d5c08112
SHA1ea0c77d7800cd21c2dd3a4cdfe3ddd7bfe1072d9
SHA256e8a9a7f2297c03eb25db01ddafa475d33a02c21a6278fb87e2d79d9221a8115f
SHA512a798804a6e786a6bf00c3c0c7c26fc66625ae34425ca2f6fd2a3d10a36ec27c0f0b472bb43bb5f4ae5dcbb1ce825d5b1b61e679452e6fe45ef15840f06798ada
-
Filesize
10KB
MD54faa5f792089a531d37e0b96e6f22b4c
SHA103008bd2f253410eaf7e6524981f914a01f8ff9a
SHA256f02ca8515f22fbe6706d6c4bf78055ff41394ac6af190ce0a51b7842d6f2334e
SHA51231cc3fb178dfd93251045a0e1b12cca9b852f49c72f3d1370a124bb9941341e0110ca29c2f42fb9d6bc2640bf5e52e0435ee808b48857f8aa057a03b47465143