Overview

overview

10

Static

static

10

Android NoDNS

android-13-x64

Android NoDNS

android-9-x86

8

Resubmissions

02/05/2026, 12:44

260502-pyjwysfz8y10

16/08/2025, 01:14

250816-blympatmx710

Sharing

Copy URL Twitter E-mail

General

  • Target
    e2d2e7683e07c5ffa7b5475433057cec5c2993167f47ea650941f9871923792d
  • Size 14.9MB
  • Sample250816-blympatmx7
  • SHA256 e2d2e7683e07c5ffa7b5475433057cec5c2993167f47ea650941f9871923792d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sharkbotandroidcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

Malware Config

Extracted

Family

  • sharkbot

C2

  • http://mefika.me/

Attributes
  • target_apps

    com.example.creatersa

    com.barclays.android.barclaysmobilebanking

    com.bankofireland.mobilebanking

    com.cooperativebank.bank

    ftb.ibank.android

    com.nearform.ptsb

    uk.co.mbna.cardservices.android

    com.danskebank.mobilebank3.uk

    com.barclays.bca

    com.tescobank.mobile

    com.virginmoney.uk.mobile.android

    com.monitise.client.android.yorkshire

    com.monitise.client.android.clydesdale

    com.cooperativebank.smile

    com.starlingbank.android

    uk.co.metrobankonline.mobile.android.production

    uk.co.santander.santanderUK

    uk.co.hsbc.hsbcukmobilebanking

    uk.co.tsb.newmobilebank

    com.grppl.android.shell.BOS

    com.grppl.android.shell.halifax

    com.grppl.android.shell.CMBlloydsTSB73

    it.copergmps.rt.pf.android.sp.bmps

    it.extrabanca.mobile

    it.relaxbanking

    it.bnl.apps.banking

    it.bnl.apps.enterprise.hellobank

    it.ingdirect.app

    it.popso.SCRIGNOapp

    it.nogood.container

rc4.plain

Targets

    • Target
      e2d2e7683e07c5ffa7b5475433057cec5c2993167f47ea650941f9871923792d
    • Size 14.9MB
    • SHA256 e2d2e7683e07c5ffa7b5475433057cec5c2993167f47ea650941f9871923792d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

    • Checks if the Android device is rooted.

      defense_evasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

      discovery

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      defense_evasionpersistence

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Mobile v16

Tasks