408cfa7080df7b1a81c6a219ef0c3a563af7a3d690cff96afa02333a58f40f05

General

Target
408cfa7080df7b1a81c6a219ef0c3a563af7a3d690cff96afa02333a58f40f05.apk
Size 7.4MB
Sample260813-ddaxrsyvbw
SHA256 408cfa7080df7b1a81c6a219ef0c3a563af7a3d690cff96afa02333a58f40f05
MD5 163078b1746de19eff8cd25ff25d16ad
SHA1 becdf239cb911ef758e711c2f3dc22517b9fb9be
SHA512 0056607d71e0e7edce40696b39314c6e4320292aa42be0a2630c2ee5ba0fa8d6ecdf127c5212fc54dd74f0192e26e16ea3c493ffdefefc3ed1093212f0bb2eee
SSDEEP 196608:A0GnCjoEJAc3ph1U3fnwlwWmQDKu18nlxfLB/qv:7GnsJAc3ph1U3fwYQD9Olxz0
TLSH
T18B76028BE745765BC4FE83BB45B6B23511475C214BA3829BD82C723C68776F48E84BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

android banker c2 defense_evasion discovery evasion exfiltration obfuscated otp persistence stealer

Malware Config

Targets

- Target
  408cfa7080df7b1a81c6a219ef0c3a563af7a3d690cff96afa02333a58f40f05.apk
- Size 7.4MB
- SHA256 408cfa7080df7b1a81c6a219ef0c3a563af7a3d690cff96afa02333a58f40f05
- MD5 163078b1746de19eff8cd25ff25d16ad
- SHA1 becdf239cb911ef758e711c2f3dc22517b9fb9be
- SHA512 0056607d71e0e7edce40696b39314c6e4320292aa42be0a2630c2ee5ba0fa8d6ecdf127c5212fc54dd74f0192e26e16ea3c493ffdefefc3ed1093212f0bb2eee
- SSDEEP 196608:A0GnCjoEJAc3ph1U3fnwlwWmQDKu18nlxfLB/qv:7GnsJAc3ph1U3fwYQD9Olxz0
- TLSH
  T18B76028BE745765BC4FE83BB45B6B23511475C214BA3829BD82C723C68776F48E84BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  base.apk
- Size 5.7MB
- SHA256 395aa77c292686e2a197c4518d758eaf4bf26c7fd400051e871dba8fb1ca8a20
- MD5 647ee941d7053a815f07f9f62fa486bf
- SHA1 144046c6ebe1c731b0d0b1461595b52363c98f5f
- SHA512 45ff278674cf16d6a420fdb5bcd27c9e329ebb1e5214bfe8f4458e3a6f54aa4d45dc3fe23aea9101e67321428b1af48a85d3eb59735b48dd3c2f58c0a8cfde32
- SSDEEP 98304:8yp8AtE8kzlktCzqBEVUFFWDgaifG5zTjOR7NCXclwuKcqMXEFBnO46dnNRqn:8ybtE8kmtCz+E2ad5zTjORZlw5cqMXED
- TLSH
  T19456F1CBA7C99B1BC43A91B9C56B72F151474C114AE29F0BE92C324C78B75E48EC5BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral4 behavioral5 behavioral6

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Obfuscated Files or Information

1

T1406

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's foreground persistence service

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6