Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14/04/2025, 17:23
General
-
Target
11D14D96556D7A4D018D168AAA134B133762493ED2A6393F732C7BBDDD5C28B4.apk
-
Size
52.7MB
-
MD5
4ad74913ada99165e6b01107a167c2fa
-
SHA1
2af77b626b5ff4cc40f6b67d79627d6af90fbe0f
-
SHA256
11d14d96556d7a4d018d168aaa134b133762493ed2a6393f732c7bbddd5c28b4
-
SHA512
bcdee7f42a903abc0a90e845942a99e624d84693aa5bd70f81d07daa0ca7b4bbdb7017dd608b46e5905f22fa9a50711da5b711ac245b48e25e494b29b795c5c8
-
SSDEEP
1572864:zdVmeObSNSm+PxvjP+H4U9X4U9r8bwidCUiSE7BKrwOq:hRRYbPFjU4U9X4U9rLRR7BKJq
Malware Config
Signatures
-
AxBanker
AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.
-
Axbanker family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 13 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ultrapower.roamwifi.changitravel1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.ultrapower.roamwifi.changitravel/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
sh -c getprop2⤵
-
-
getprop2⤵
-
-
sh -c ps -ef2⤵
-
-
ps -ef2⤵
-
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5e204325f0bc03d5bf3bc7861b1f69b07
SHA1fa813a504e933db4d94c61715083450786f18fcd
SHA25668fcd8a7f2ca5d983eb6a6c3dcb40ae898b5bcf1da0d792b0365f46b2b0b3237
SHA512a8175ca9f3f993c537de973e1d5b0f7516e7e6e594167edf2e92f4636ce6801eebda06caeb4b44b82795dc42a8a39fb0091da1589212a220e15b8bbb0996dbe1
-
Filesize
4.6MB
MD5fdf13f34fb3eca2d0873a0161730b649
SHA105db5ae15f4af91c5fd1d75909b404998cc06400
SHA2566c052aca6fad2a8e51a5ad9c5e70bfb33f849212b5921b92a98b1d73a976be40
SHA512c699be551558dde58d51ab31238117ae91a00a8dee085f819f2fc9005a8dbac7a20870b840749ecb4eb0213d004ee465dad390e3ce20fe2cceb6573f0341cba9
-
Filesize
6.2MB
MD559dde213b09484854c85555f256eb6f3
SHA1ccdd91c00b34cecb71d0fdb06d0174e20aff3598
SHA2569ebb92e12ca7f5a99d807241b942f395d98b7cd5a067b00da4bb4198da0fd110
SHA512a15d8d38aa43744e52b152eb2341bdf1cbf90a35a121d656d28246431c5f5b554a21c3ca6ceef1b2415238769da0a24ba177c5e134f88c4cea37a4d30a631242
-
Filesize
1.7MB
MD5b437f2aec5c37f8713b300f07f9cf1e2
SHA1456ff98489038bfcf64b90f6be97d8d4b4743a81
SHA2567c52d880b2e3dfa3046e061f546a23fc659ce0ed562233cf72ad40e8cab6a576
SHA512e79f841f8a06fd679ba09325b9acf07c388f5fb3cfaab272fb1eb60a287c0d1845fa62f4ec2089418dd01d70e425ea5dd15b76a7a2367225a1a3fd3775423d42
-
Filesize
1.4MB
MD57560efbdaaf6ffab96d2c9c7a287e97d
SHA112f6aa0f0367444390b1f6a04ca2b421462eccd8
SHA2561c2be1249248677294e6e9582de78b2c61f8cbb1811c62dc89d72551e21cc73c
SHA512080fbd43a1332eed92d7568565f49df6e1da39b3f87bef27f1a3f252383bd56ad091106768014074144409736eefc00c4593ad23feeed34e0f596f1f216f7c0a
-
Filesize
2.8MB
MD55dcb501ea00768f3c1e7dea12cc194da
SHA15a89cf1ccd28d8109c0c2607c0745764470a7552
SHA2561ececdcc2076aacb572af3945e20d68151c9d4f374d2451d9e14ef5e48248467
SHA5124c2f3761648a38d5d7b423c32c1f92eaeda45b9e7f6b7a407e6b04bd0cd1a970ed50e1f83669a944b2deeb4f332fed4dedf84676aff3b1625e8dfae2b86e0c6e
-
Filesize
5.0MB
MD55e39b2e571f42f9bac88444f87ae1975
SHA16db6d38799ecdba49069e16d783111a04df12206
SHA2562eb48e52a36db02810d2ba8e7ff659bca29ccadde46f196bb3aa7d7fc9c98b4d
SHA512fdfd35d37fd261bdbe2371ac77c0ae5f9be49c068292449ca1f9466768648b02959dadb726363be26b169b7b2ef1d19592a12e037fb3aff189faed541178e2bc
-
Filesize
91KB
MD5a6b9076c91c90142d2008ed0f06acd2e
SHA15bb5e94d051c5b771a764b9c297ce1f827b1e8bf
SHA256740e9d776b1cfdadc18b6bb4bc1628a79a6d8fd50ba88187f88be0c94a8b3d2b
SHA512d70db32df0aa3f6b9af1889e2d496ebc13380717097399b764534b21f57b13b81517ad61b7afe5fc37ca5aa458ef51bbb3d913aea08d5cccbaa8a983af17cc2c
-
Filesize
718KB
MD5af7c66c5bab115f3acb1b2e921971fde
SHA1668302f34141e16847eab4b53c0b03a1a18ed8e5
SHA256677f40b6368e1eff80d56cf199d30197a15b116963894625233ca00aca848006
SHA5125f9e849fe02d3cd9716cc10ece64cf973c213835351f9e7571fccc58abd9b5fae0326577efa93fe6cb5e48293fce5ac1c9177db5c68a72fe672d93950f8b2f1f
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
248B
MD543b78c04b854238b625b50db2d23f8ff
SHA1160a43509684845ec80dcb4cb6c06ce8bd2a11da
SHA2560ff6c6641a45b0d671a124e5ca8892e66db69bbe86d8c7be35ab96f8f7bbe714
SHA51229a58967a19c4d78ebd589ce3b21c5ef579d598648851f1df8315e87eec2df34cfd8e81fe508592092b84daef674508a710082a39d1ee477287bdee5ab534599
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
512B
MD594283c1836a68042f89584aa0f4582c2
SHA1a7b88cad93a0e03ac21f8ebcf244deb2ce76a168
SHA25629ae822e521c6f57d034511f64e11db9179d6b089593061208b36beca7fd7edf
SHA51215fbb4784154a99ca4c9409b9f586a6cb80e33abc50c911a9c7d0b476dc389f647370c223890217537936b69ef4fe216003297b88ce17ef630815e671211cd90
-
Filesize
84KB
MD53e50135f4983cc1b6b272dfebb7ccef1
SHA1aa9cfd833ad8376c04e1072aaaa40e4c5e8d605d
SHA256d649471d2c9abfbe020e9aeb51151333b2f5d420f5534518c3f42ce465ba34c0
SHA512ce931d1751ca12ab0793439c0ba71666b34e2cd23313a25dc22507576dcf1cd1ac9db63861d3748675792df8ba6a31d0049577077a352bf9166f122dd6a18407
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e83679141f3ea2187603bf6f8bf65fb4
SHA180e5959edbc782818f18811e07dbe115a32e971b
SHA256900a36b63b0b40dab1759cfa3bcb91c160c1c4d0dc3ac222cd811ae340ee7b4f
SHA51260d6e3b40b5a5005e961857ef2195aad5137750822340bf510ba605ee0e685dfe385454eb295670a574ab6b5804a05fb702c9c88c673402bdd40682e060edc52
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD5cd2766c3dd99b0550ea428e08dcc562f
SHA137e8db992ce7128087a8d8dad8e2427804bd7d4a
SHA256f5a1f3ff521cef55c6ea0836aae550360aa99698a15872289ba0be4e04f652b4
SHA5124afef94f390db7aa5e41d4cffae6d80e48198c399ee978128070ec423d77dbc5af0255571210307cffa0fcfb9bd0720c61f059a9dfdd231ffbd3192ca6f714ac
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD5e3de5923702d6a6c908b7b389f5bf86e
SHA1048478919571982347fc2eaed72dc076b8228edc
SHA25604da7cf79c9e56cd34ae2884dc389d645db471b8b5f44ec1dd02265fac480099
SHA5129e7d46b7a2eebc0a60829f5ecc5878fc6d6eb315775a224db53f3093c7d5dc7c4d59f8db3e3c594bc42acafeb6824b03215b24e6835579bc9f433844a2b37550
-
Filesize
16KB
MD567a1188c7c7c03c4fdd21b820d098012
SHA1cb61d4c66a0e57576b2b8fb6c283e8b5c2788e87
SHA256ef4ae4dd89209a9fd1b96179faa85933507bba8de0b47c82a0988e2a9f4a7160
SHA51285487094027f59cd2a562c846f92a5d6f733b2b974d4995e4d168f05fb523909378da9c5b371d78fffa412a94b04ad5f25001f5981affa71e137ef38cec96d74
-
Filesize
16KB
MD5644f7fea6f986ffae01b1341fa47fdac
SHA14aeab603abb7302b619abc1f8928b41b34da3bb0
SHA256bd5a0aa781a068dad055c77c56e79e135d6cd5d4b5f4a10740098b3de5088dd2
SHA51293fb15a587d154476b91ee6c4e427d8b53b9d47d0ca39d2bf58b7867a14dc5b017973f14c8f2974bdd59d8975cd7142f3893c4075357a66d89e0eb8d51f52077
-
Filesize
16KB
MD5fc07064dd991e3b4d785b5527d798c07
SHA162f2435f4e9469c2e7126d7f8a41d645e521af48
SHA256cd471357e0677d5c7bdc7b36940bc90d771751ad8d0841c82d810c493b8fd55e
SHA51231c9fc456bb4ffcbe3883211c434601e4a447e9899a8d678b2107ec6b3506c90c48d0783e6488e86a4046a6ef81c193be31a50e00c39f625074825f1ee9cd99d
-
Filesize
16KB
MD5835cfc7decf507cdc5e54f602e3f9699
SHA14a55d424cb32e766554672cb2d0b3804fc47552f
SHA25629257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA5122ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
-
Filesize
512B
MD562b9498c05a74b6ef1d159e8bc7e11d0
SHA16c433be455e7f20e64af75880b0d41a1ffc47091
SHA25654fe0c4eff90e1a6a16498ae75e900699fa0b5cfc69f470d7027f0265b6f5cd5
SHA512b74b27cb4f6cc19d9d2407dca0099721a3b749df96dc977e7663186a9815485014244b61b592d0bd1f1b6f75d7f1778bd3482b059089fbfec86c164a6dbe152d
-
Filesize
36KB
MD55ec51b4ef17132d444f183769f00b1a8
SHA1f625ec711d208d7a42a2cce6489d80d095ee1f5c
SHA2567131dea862a8f5241d660fa0993463a598325e0033b1d67b1510ae940a2b5a4a
SHA5127b044ef9d41ee929d78b645b203758f9bd7ba2d5401d9f313c89f6f1c180a9b31322a28f29d02ecff5825f29b5f0c063f81957ef9d129db8719da925d2612348
-
Filesize
8KB
MD5584f48054b841eab2b2942edbc573359
SHA18a6c6e0036ca7c7ec5612987bf8034a46a5f42ad
SHA25649d6e1ae378a0e33860f1d203bb9cb5e1290376f635e46fff890197b7881d2d8
SHA5126f62da50cd9bd34d4401e52796533eeb015c03ff08b2713a09a4d2c3973809140098737c9b08b458dd67a3e12380516a595e2e870a0543a809e3987bb83ea718
-
Filesize
4KB
MD5bf0b956805db9c63fa99c40a2c38219e
SHA134f0f3b33eb301c9cc8fddeb1a04ae486af7e701
SHA2562212ae57d14dc443fee8bacd7d5842466bcfd38df43244593086149ead1fa66d
SHA5124485f7010e86a0517f1cce7b80f5e0832a32e27580bfb8b1bb056e70af1b871cdeed107673da26b25706516107182c13977787ec05500c38558e36ed35ef7ed3
-
Filesize
4KB
MD5ba1a32c43fc966d57260eb0fe9afc9b7
SHA1c8f46b67db8ead2d17d4c5ff957878890f2d2ef5
SHA256b697a45a56bb552cee3109c003d52560aa046cb7f568211adc56f9bb4633663b
SHA5128cb86cd0819a5bc48913f95fc681f5902f5d6ea148116faaa350a9da5dbf09dd3ff3b3b90c12bd6c01a02a209306a8aa6dc553c479f2a253cc971e0425f19e70
-
Filesize
4KB
MD5785e2aae5947f6102600d9703293003e
SHA1b38bba974ae29ae0cb637504940160c22073277e
SHA2569300724c63ee747fff0bd2ffead3e9871ef5c9a72db666b0fc044412ce976e92
SHA512e2a8ac8590cbbd9fdc3a39a7a6cfd3b4331f549849daf0cf281fe36c92f7ff07dfd2036384d85f72146c73faad07fed7acf5bbd8e0035470bdfe2bab1a37fde5
-
Filesize
4KB
MD506ed1a52a2848dfe217236ba98c561ee
SHA1898a6e0f095458f9bca34c3a3ab5138e00629c52
SHA25672510a030c160d727d788a131275e76dd167ab5dae57c503f0229e9b2183f3d3
SHA51286588751684a26c8d15983a84a0d84bc877e30248518bd229a17852c957b18fb55d6ca5baad4f961a737d612e335096abadc565086481a7cf7c9ef3cc796c924
-
Filesize
27B
MD5c4eb0f22a085f82b3956337b274294d6
SHA1719ab15b1265804a5c64d379fee843475459a323
SHA256c5f1615a947b7f4d022e4eceff884df9f78633703b2dc2895a59f4785c1b8d95
SHA512e5f71ab769f87c4cd9bd401156782bd6fe5bf0aee753256e0d03f353a2b8b271212965fb7b63cba8c705e6431346f63245836a32f7b9486087b6eb00a38578ac
-
Filesize
90B
MD557b1e8fd61e61b40061d388f5df822d0
SHA1da96271176d0258cd23315e8bde4c2b47d89c13d
SHA256d64df9e8dcfec8594403ed4f1eebef60507a68079680a5218f679e41e016f6c5
SHA512d29db7086d30bc27409426333b397db5475cacbc761e630f847e4060a1e3a9563267b77a14eed68c2ebbca2f7d8caf6a6a1ebe7215546a1ce4b4946e8c18a29b
-
Filesize
567B
MD54cd8a795faf1cc1d3764cbd8dbbe4103
SHA10b737a5d39693510bd4708d869be99aa32179720
SHA256d7f8b0dfeac8346c47d7f4a321defbec9d3528403f7f757d306c8d3c145f401a
SHA512ee990eaacec8db57c7f3713d2a1d8c350475f472d16e051d69a4762324e264acf1fbac48fa140905cedb8f9d8ca11c15798fdc5e8b412d4b9f379f8f1d79caa3
-
Filesize
3KB
MD5b70e31bd4813c0d750ab0f2b12aa66f1
SHA1eb18cb51dc34ba1bbc180f20933b363f211f8b0f
SHA256e0b6316b4b907dad37cc9ad1caef262a0dd726fa8e894811984a518dd546306d
SHA512eeed2b06583bee4e216782057606d61135fea8f7f2df9d808203664a0af232c50ac0b7b8f63517c8e64d1f59715f97d40f0c085ce49857e6afbfb589484e955f
-
Filesize
13B
MD5b7510d285c76471aff8b14c83db72e1e
SHA173e521bec4de0019b9e577641b3ad2ca075df4b6
SHA256ab4fe7d02fa6bb84b05a61f49b7d83309135821c7d10c4a5fa6d053d4a4ae365
SHA512ca8af6c6543b80c2a94ea697e834e4ccc922dbf9f70e9893f1717604a95876a862520e97047b8f64aed135df17121e83e17f150f7364d3bbcb6f986bbb17aa40
-
Filesize
159B
MD5c26563439e397704b5000b116ad61b3e
SHA19cdb876919f0573a2e05bb4c0fff7001ad4173c4
SHA256fd730f58fbe5508f8566b0ee057842ef18fe2f765ab6315e45a1eb316413c4ef
SHA512c1df88663f420db2478e7c6d4a786ef0a3f000c4508aab330bcc3d7d381c4791c7491a30f294ba6e463a915f2d04cdde5c118795efb0686d92db14ccc29024d1
-
Filesize
81B
MD56871e0a48653e6e9052c2de4104a7b01
SHA1bc9afa22d5945cdaefce3d198b65574db78bc41b
SHA25646c1b85cadc676b64a5d93abedae3a9d9bcfef56958551bf765d0216275d6596
SHA5120c3bc940819a9c44ceb570c793fa141560c2c6322e93b17c96cede06e1e6542f08d696196aadb0425d7557d05228e6b4536c526373672de26df2a5903f746556
-
Filesize
81B
MD5d151bbe8df698c26803315cdbf906c27
SHA1e8e885cb36b7b8a9db9a8dbd6e718f3f5abf0466
SHA25691d75cfa02fe189f035cbf722ef6296d078a7e597a60c47a7e8406d38d76c77e
SHA5122bc679fd0fba84ee152f7ab9317737becf39bbf8e9af30de7fc4769119761225ffa12225886a95790a8db79a81e70a0c7f2ebc7ec6d4555eedaad8a969a1cb38
-
Filesize
119B
MD5a4024c25d03117e30b533dcb8b8483d7
SHA18967b1b1d5505f862e26dcef413e38108886ec00
SHA2563d59a32f088eb3f924b90e76ad29d17e9be0e28de970f341011cfaef9da9f1a6
SHA5127e5c831b2a1d9a33270268f0169e7c03bbecf2aabf8420aa02bd62efb3bb23d6875ed58b308bf47628e770ccc885d88294faab0ee4f04422bfc77cfe5531ce4a
-
Filesize
20KB
MD5860abd6167f275caa55eb9a4d5c08112
SHA1ea0c77d7800cd21c2dd3a4cdfe3ddd7bfe1072d9
SHA256e8a9a7f2297c03eb25db01ddafa475d33a02c21a6278fb87e2d79d9221a8115f
SHA512a798804a6e786a6bf00c3c0c7c26fc66625ae34425ca2f6fd2a3d10a36ec27c0f0b472bb43bb5f4ae5dcbb1ce825d5b1b61e679452e6fe45ef15840f06798ada
-
Filesize
10KB
MD54faa5f792089a531d37e0b96e6f22b4c
SHA103008bd2f253410eaf7e6524981f914a01f8ff9a
SHA256f02ca8515f22fbe6706d6c4bf78055ff41394ac6af190ce0a51b7842d6f2334e
SHA51231cc3fb178dfd93251045a0e1b12cca9b852f49c72f3d1370a124bb9941341e0110ca29c2f42fb9d6bc2640bf5e52e0435ee808b48857f8aa057a03b47465143