General

  • Target
    Android trojans.zip
  • Size 28.5MB
  • Sample251223-smt5bsvmht
  • SHA256 5c42d9fcd967c4021144f9cb88fe7e58847ab0488257d8b3f15f08110a5c9ff1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • sharkbot

C2
  • http://mefika.me/

Attributes
  • target_apps

    com.example.creatersa

    com.barclays.android.barclaysmobilebanking

    com.bankofireland.mobilebanking

    com.cooperativebank.bank

    ftb.ibank.android

    com.nearform.ptsb

    uk.co.mbna.cardservices.android

    com.danskebank.mobilebank3.uk

    com.barclays.bca

    com.tescobank.mobile

    com.virginmoney.uk.mobile.android

    com.monitise.client.android.yorkshire

    com.monitise.client.android.clydesdale

    com.cooperativebank.smile

    com.starlingbank.android

    uk.co.metrobankonline.mobile.android.production

    uk.co.santander.santanderUK

    uk.co.hsbc.hsbcukmobilebanking

    uk.co.tsb.newmobilebank

    com.grppl.android.shell.BOS

    com.grppl.android.shell.halifax

    com.grppl.android.shell.CMBlloydsTSB73

    it.copergmps.rt.pf.android.sp.bmps

    it.extrabanca.mobile

    it.relaxbanking

    it.bnl.apps.banking

    it.bnl.apps.enterprise.hellobank

    it.ingdirect.app

    it.popso.SCRIGNOapp

    it.nogood.container

rc4.plain

Signatures

  • AbstractEmu payload 2 IoCs
  • Abstractemu family
  • Sharkbot family
  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 3 IoCs

File Explorer

  • Android trojans.zip
    .zip 28.5MB
  • 2FA Authenticator.apk
    .apk 2.8MB
  • All Passwords.apk
    .apk 12.7MB
  • ICICI Rewards.apk
    .apk 3.0MB
  • Kylhavy Mobile Security.apk
    .apk 3.4MB
  • Phone Plus.apk
    .apk 6.3MB
  • _Antivirus Android.apk
    .apk 4.1MB
  • test.apk
    .apk 45KB

Android trojans.zip

  • SHA256 5c42d9fcd967c4021144f9cb88fe7e58847ab0488257d8b3f15f08110a5c9ff1
  • MD5 SHA1 SHA512 SSDEEP
Password
infected