2ebded3a5850b44e46754afd4c06b9a990f1c7fb25f26dce877135b3d6ded0d0

General

Target
IndusInd Mobile Bank.apk
Size 7.1MB
Sample260805-llvadathnb
SHA256 2ebded3a5850b44e46754afd4c06b9a990f1c7fb25f26dce877135b3d6ded0d0
MD5 9a0180c9d871d1b36f960dbe7dc51c16
SHA1 fd2b44492ff8ef55592e240b7bd3edef52fd426f
SHA512 635f999ee29ed879e544d93aa0721f9eb357f4fbeffb3badf31cab8f5289883c8f5168162c441e959f491b787e9c18b5554a533802909323e35ef380a668a269
SSDEEP 196608:6kbAk5Jp7lrnueqlzZ+g3R7o+jwuIJ+Qur:HbPHHd8zZ+yXjwuuBs
TLSH
T16676128BA385472BC52EC17E54E333B663135D0546E2833BD66CBA1C78771F4AE98B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.avdkfhdb.android

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.avdkfhdb.android

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.avdkfhdb.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.avdkfhdb.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.avdkfhdb.android

com.avdkfhdb.android
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4352

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

3

T1633

System Checks

3

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

base.4352.tmp

Path /data/data/com.avdkfhdb.android/cache/oat_primary/x86_64/base.4352.tmp
Size 88KB
SHA256 4858feee76e98d9e40834136ada59f746770b8f0ada1f078ac879dbf09d7c521
MD5 46f38421478b76412e01f9190e12f565
SHA1 5a1100b95a537071c6668ab8e21a8dbf5d7ff234
SHA512 701f83ecfb47525780b2b1ff74e47002fa14b85bd5745d95b76b2c210f9f99f0b4dfb9b5c4ec9aa46f3560b24bc5eceb2dec3c58e3964f3c6f9f981f7a789f12
SSDEEP 1536:m6g0fDbZEHsGGAz3O2ABgJhtS/bXYID8kJPyta0KxwXCQR30dRLUvP:LH7tE3P+2A8sjZrJKY0KxwXhEIP
TLSH
T1AF931B7FA91140E0C2D77EF98B8906E4EFB681601A563E0440B6E73F7926B14DFB1B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.avdkfhdb.android/files/profileInstalled
Size 24B
SHA256 d6b029d8bd9298098917c718cac8ae81e60e407772e724c313a992f33c823a1a
MD5 921d6f2e36998f1c43b490eb5592087b
SHA1 6b9b33d595eb7a9fc95b8dfbc0eaf59b305793cf
SHA512 5811b09ed6c0abcfbec08ff1e1022bb1e8977de3a584a82ec8e4ae6770daed2bf2f2c17a32a0abbc6ab47a3c76199e31f0fa6958be274e0fa6c49755ed788a8a
MD5 SHA1 SHA512

Submit Download

temp_info.apk

Path /data/data/com.avdkfhdb.android/files/temp_info.apk
Size 5.1MB
SHA256 2c5ebedcd6dd69dcfdf287979cf8d7682545b5a5a0d912d1234a594148a35d9e
MD5 43cf1bc1c61407a8a4a4704d3d6bbeba
SHA1 de9e6228cfd79e27078b4fdd0fc01359fa7e5982
SHA512 2e4e8283dc64ce8acf1b3054bea008e63a10a5208ebd96a7bdb952301a82960b61f45e8a199dcbf582d96baca2ac568754de985a35aa63cb35bacc0d0a49fa6c
SSDEEP 98304:03LJpTxhIDRiQr87qGg4nNd6dIAdPugoU:0NpTw1igZNO2GgoU
TLSH
T17646D04BB7899B1BC83EC07B58A7323612175D424A92975BE91C771C38B74F48ED8BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫

Path /data/data/com.avdkfhdb.android/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
Size 5.1MB
SHA256 33a268ccb84e918719832d9b76ec461757fceffaa823e26fffee4e5a2c0a79c2
MD5 f05c4fc84f66633f55a6fbe60f7c14c0
SHA1 ca58b21b6fa73b5b8839d2747632cbe33f65f015
SHA512 7e84d7405a9748ce6c28e098b6f99cd28cbba7d63da2fbc3710b09e57b0a1a7cb73731a5e531108b5da81d00b7ed2080ecbfa83d29c21445a7fa92734e2b204a
SSDEEP 98304:BVn6a9M8UWOLWDxv3MMH1xVWtfT67yomh/e7IKldIK3dCJ:BV6afOLWDxUMUueorcGdIK3EJ
TLSH
T1BB4612D3B774412AF63E853646E297B527028C0D4AD3C663D630359EA8721AE2F7CF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫.

Path /data/data/com.avdkfhdb.android/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
Size 8B
SHA256 7ddea26e2be1f28697cbafa3768867d608cc925da5630b8613b519459c95532a
MD5 b1554ad7989b9afe44dfaf85b4ec4c2c
SHA1 397a728d4ffacaeb8e3740b63000b1e77797ac84
SHA512 bd2d1489d2263fa0dcb42fe4ba2e598524f94127cea8b5085685b140b14871cab9b5fe7a4e0e189c6a704cb2a9a294c1814cd5a736f91c9af55174da8799f498
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads