abstractemu | 5c42d9fcd967c4021144f9cb88fe7e58847ab0488257d8b3f15f08110a5c9ff1

Sharing

Copy URL Twitter E-mail

General

Target
Android trojans.zip
Size 28.5MB
Sample251223-smt5bsvmht
SHA256 5c42d9fcd967c4021144f9cb88fe7e58847ab0488257d8b3f15f08110a5c9ff1
MD5 224ca206dc013c7743328a0b3726b289
SHA1 fa20749b527344f9958ada6eb5eeb75e1348ffff
SHA512 99fbe81d882a3bd12e25ff26bde7d3d80f2855b1e2e7fb27c5aa339b527e87b9ebd4a6133a8756b577104b50354b833872dc9056075b6f5ee60316985d92f6f1
SSDEEP 393216:NXtuhdCPEMBZL/9FqgZCA1IY2VjcWgmC2E0t203ixj/aQ1z8XKSd/00ufEBf:BtuhZgXFF/P29cWgf2EeEzxYnTf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

sharkbot

http://mefika.me/

Attributes

target_apps
com.example.creatersa

com.barclays.android.barclaysmobilebanking

com.bankofireland.mobilebanking

com.cooperativebank.bank

ftb.ibank.android

com.nearform.ptsb

uk.co.mbna.cardservices.android

com.danskebank.mobilebank3.uk

com.barclays.bca

com.tescobank.mobile

com.virginmoney.uk.mobile.android

com.monitise.client.android.yorkshire

com.monitise.client.android.clydesdale

com.cooperativebank.smile

com.starlingbank.android

uk.co.metrobankonline.mobile.android.production

uk.co.santander.santanderUK

uk.co.hsbc.hsbcukmobilebanking

uk.co.tsb.newmobilebank

com.grppl.android.shell.BOS

com.grppl.android.shell.halifax

com.grppl.android.shell.CMBlloydsTSB73

it.copergmps.rt.pf.android.sp.bmps

it.extrabanca.mobile

it.relaxbanking

it.bnl.apps.banking

it.bnl.apps.enterprise.hellobank

it.ingdirect.app

it.popso.SCRIGNOapp

it.nogood.container

posteitaliane.posteapp.appbpol

com.latuabancaperandroid

com.latuabancaperandroid.pg

com.latuabancaperandroid.ispb

com.fineco.it

com.CredemMobile

com.bmo.mobile

com.fideuram.alfabetobanking

com.lynxspa.bancopopolare

com.vipera.chebanca

rc4.plain

Targets

- Target
  2FA Authenticator.apk
- Size 2.8MB
- SHA256 00a733c78f1b4d4f54cf06a0ea8cc33604512d6032ef4ef9114c89c700bfafcf
- MD5 0d00206b8e9814ec56c8ed8cff4de107
- SHA1 180233cedd3b705d96acd7041e44dd66f239d718
- SHA512 6f49edad3b63d1c013f1b7fd3b0d7ccbf4f62ebfc65dc8e3424bcc13c4edcdc041e7203edd077a896502eec2028759654d91af9b0e726548bcd0c2463a80a66b
- SSDEEP 49152:zFKviwg6wkcqOSYn3ldUJL+qpQU1Y3Y/CzMdqN1HYseKNqqh7SsnfrkuVLl:5Af/wkcf34JL+n8r6NhY54RnfrkuVh
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

banker discovery persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
behavioral1 behavioral2 behavioral3
- Target
  All Passwords.apk
- Size 12.7MB
- SHA256 8bc90eeb3df06d50a460890b4a1d4c8d9a1b72d00e3ecdcc135bd3a8a6ae604a
- MD5 08a1ddc4f080a5be7a2438ed20ed4393
- SHA1 0dddea2fc5d4d9e819d3f45b2673347a927e7cef
- SHA512 b087d87a09a3acc447accbf06a68f2422fc460688de334afa92ce23a99bff5f6d45423b1d621156d27fc60825a66a01893f1fb4f55cdc11226e8ae9cbd2e310b
- SSDEEP 196608:mj9UM75LG+5YEQCL+9FJshIGVFkkWJERYbnyHXOfk8MahLSjgCiE85Ulha7MoZ:mj9XBz5A9rsyGnOTy3OfkDahWHimU7r
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

defense_evasion discovery
- Checks if the Android device is rooted.
  defense_evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral4
- Target
  ICICI Rewards.apk
- Size 3.0MB
- SHA256 da4e28acdadfa2924ae0001d9cfbec8c8cc8fd2480236b0da6e9bc7509c921bd
- MD5 b301c4b060dadf887e53d671aa6a7aff
- SHA1 d6d5274b17f911b7f1923e2f7540926697b6049e
- SHA512 7b822ea744545984d6284626308ec6ec76b5b5cd810255241e1de3f3c4362e27bbb06e8bdabf46d2c656d05650f9f17d8c42764eaf692d04a3106ad912c28047
- SSDEEP 49152:a1SeCzeDY2XYVPQKBgRJd2ofrjrOczvm0OyDhEH7+ENXjSz1HZeE0PZ:a1ix2IJQdd2ofrjrOcN7DhuKENW330PZ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

collection defense_evasion discovery persistence
- Reads the content of the SMS messages.
  collection
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral5 behavioral6 behavioral7
- Target
  Kylhavy Mobile Security.apk
- Size 3.4MB
- SHA256 26d2555a2c73fd7f49ae1d5d335f4cc983e3fab3f564989dfc3262ee2355a2b9
- MD5 9fa1e4b615d69f04da261267331a202b
- SHA1 e15fdcec9a76b4ca9db183a71963107fcd6520e0
- SHA512 b0b5bcd1dc732497b72b2690230d0c934b510af7868e0b520428cbf09eccef371c9e89d0efa07d78bafea05b1a29e84a16be1e92dbca7d94b467d0044cfe6696
- SSDEEP 98304:HtU+qyfprZ12LzRyDuzlD82Eigpv4v+Tp4YAfF:HtU+bZ12Yize3w+tm
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence
- Reads information about phone network operator.
  discovery
behavioral10 behavioral8 behavioral9
- Target
  _Antivirus Android.apk
- Size 4.1MB
- SHA256 7f2248f5de8a74b3d1c48be0db574b1c6558d6edae347592b29dc5234337a5ff
- MD5 302af56b5507e291e58c540df217a3b5
- SHA1 1aae0772605d46f6a047bb5b2ebea869d7ad4f58
- SHA512 9e1f63e5e1dc736e989e735a4330bdaaebceeb4a9bb9b4098ea3f031cba3d6f7e31f869e18a0f66e680aa3a134601904a5a3183a221003895380119b1c153a89
- SSDEEP 98304:MURJtzECvHAHwk+ej3XvgM/+snCo2aB8d2ZrW+L:PHpEoAHDHvgM/+st2aBFL
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Reads information about phone network operator.
  discovery
behavioral11 behavioral12 behavioral13
- Target
  test.apk
- Size 45KB
- SHA256 6b973256325b0f93c45a1ae8a964218b6c86aa3c509453f0325754eb2dcfef0e
- MD5 914082a04d6db5084a963e9f70fb4276
- SHA1 c18a08a0836d22141b9d6dce413de36dbcd58900
- SHA512 970641b215412f67d7f1baf03354339d728f2209057b0403779235bdf1080dd8e868583e9e87a64bf053bd5af60a384f89b66604911281229707ad0c19877089
- SSDEEP 768:fsXbFuW7/Xyz6PXQ0YINvrIt03WP8XKXdaPW78dDCyJzjHYbxsQcZULe+vop5tLL:CF6zoXXYINTNruEg8duyJzjkW3UXwpak
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence collection credential_access impact
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral14 behavioral15 behavioral16