basbanke | 3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

General

Target
3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277
Size 313KB
Sample260604-stecfshw6w
SHA256 3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277
MD5 7e10aa70baee671e6c96595afb8c57c9
SHA1 2d69d999a994a621adb391a1e6b98deceea8bdb5
SHA512 f4333de26be08ddfd9a8bcdfb65cfa5b628579b50b3a86e90acea56577b7d2eea5e050030c2e1df3f8d201451233bd26812b951999de4b6772d24f50fc1df630
SSDEEP 6144:u+8NJdqKtIOedThOBa9NhhPtUWCYxYk045p0Qy0Ap1j31Qws4:8NbIOeFbNhhSW77045peV1V
TLSH
T1CB6423C2BDF49547C6FD90B0B0A226EEA9167EC01C3F47AD59C56C700753839E886EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer basbanke

Malware Config

Signatures

Family: Basbanke
Basbanke is an Android banking trojan first seen in 2019.
banker trojan infostealer basbanke

Android Basbanke payload 1 IoCs

resource	yara_rule
sample	family_basbanke

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

File Explorer

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

.apk 313KB

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

SHA256 3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277
MD5 7e10aa70baee671e6c96595afb8c57c9
SHA1 2d69d999a994a621adb391a1e6b98deceea8bdb5
SHA512 f4333de26be08ddfd9a8bcdfb65cfa5b628579b50b3a86e90acea56577b7d2eea5e050030c2e1df3f8d201451233bd26812b951999de4b6772d24f50fc1df630
SSDEEP 6144:u+8NJdqKtIOedThOBa9NhhPtUWCYxYk045p0Qy0Ap1j31Qws4:8NbIOeFbNhhSW77045peV1V
TLSH
T1CB6423C2BDF49547C6FD90B0B0A226EEA9167EC01C3F47AD59C56C700753839E886EE9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Basbanke payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a9b0be4a2ec7ed4d5df834d182b761fcb8ac1bd6

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Anywhere Software,O=Anywhere Software,C=US

Chains

Jan 1, 0001

jjjkkkkkkkk.hhhhhgggggg.wwwwwwww

Android Permissions

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

Permissions

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.REQUEST_DELETE_PACKAGES

android.permission.ACCESS_NOTIFICATION_POLICY

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

File Signature issue

.main

.starter

.conexao

.controladores

.trava

.starter$starter_BR

.conexao$conexao_BR

.controladores$controladores_BR

.trava$trava_BR

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277

File Signature issue

.main

.starter

.conexao

.controladores

.trava

.starter$starter_BR

.conexao$conexao_BR

.controladores$controladores_BR

.trava$trava_BR

Android Permissions

3ea883f7186c419ac4efe64af4f0f47603fa3791c657c4e131f9bad4e25bc277