a175ac3209fb433df25e7609a2612bdc5a9fdcb196a92713f49425d4498af35f

General

Target
iAsiaToken.apk
Size 25.7MB
Sample260905-alc6batajb
SHA256 a175ac3209fb433df25e7609a2612bdc5a9fdcb196a92713f49425d4498af35f
MD5 779fee806a8c1123d12d621f9f8862b8
SHA1 a4260473d0fb673cc300bd8fa5a785be3c1f463e
SHA512 93865b043b7bcf929275750ca70b57d16aecd3e9620b94358ab76d8e48a7abf9b7e641b31a8a641c07a14f34470c0796cf3cacc255e2fbd4e18f194a6ed11eeb
SSDEEP 393216:XvPH2eHcLGWAHCOo2mw4BPXisjoNz2m9SJC:/ueHciVHCT5XobuC
TLSH
T11F478C1077E84622E6BF1B39B47914018BB1ED0767A2E78F199175ED2CB3B508D81FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

persistence

Malware Config

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wellin.itoken

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wellin.itoken

com.wellin.itoken
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4302
- su
  2⤵
  PID:4373

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 53B
SHA256 07b0d6ccae69110495e57468533ea32a4115e878f7f540aa614f4817a5c10784
MD5 f8b67fa83b338f314def2412de445308
SHA1 cbfa1ea3223136e5f84a814e2c3e194677e5897d
SHA512 096b61f258dd5bd0a8da705e11b39220169a81020322ab7946d7cd99fda9a43bafe86ca488155f4e13f83b1fb25fad25ab0e27a6a625029c066e952fd69def72
TLSH
T11B9002B01125015C9214E4AA40DC2154517209611B0620D4055C7154EA5D11404584D4
MD5 SHA1 SHA512 TLSH

Submit Download

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 53B
SHA256 ad6f3133ed2145155db962423899b3d6ac426fe71708da387970c79599ea3178
MD5 e8e25bba5e791fa3e041b233e5053498
SHA1 244a1dab5771c1bce0b59c179dd9f356b9f66a92
SHA512 114e3feda6a8f464bbe4e76928fbf4ad9791a1e4f44748de03161250ffbc9ddde6a7e106c52186b234260adfa412a1a9bfd5f165fb939edca88ab18dd89c6a6d
TLSH
T1909002AD00301E4C941E48156196A87624F286414301527D82154B1444C11448540617
MD5 SHA1 SHA512 TLSH

Submit Download

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 53B
SHA256 0add9caaf6fb00955107a89a665d7c505abcc3003ff2dabef0a30a239d21d6ad
MD5 b1a6e4c91f43c5b93e9c23ceea6cb31c
SHA1 1432f6ca64d52e09e4243ca53a5ce84688efb865
SHA512 62bcb702627c982aaed5548663e444581c1a0a09786996fe57c5fb1a944377ca9ebace36fa47ae9f8b1302c661ddf312f86002927a2c69f2332b31ffd5d5254a
TLSH
T13B90024945F1D8B2F5584354E4E526C02EB057492B0654B254110559045221544116B5
MD5 SHA1 SHA512 TLSH

Submit Download

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 53B
SHA256 3e72452bc5311abfa4872cc71975261c4078447a4fa39aa056b6f47878cb7261
MD5 7c615ccf9821fdd9da1e9dc969aec6bf
SHA1 aaf22a99864dd77e7b2ad53a56bdf030a194c6bd
SHA512 ed4f4214e589098a3a272903deb9c26cc38540d74c9429f1d7bcb4a8cc918ac53c997902d04698e5877685a9df772c06a84c9e8b2ae2a55e2786a702537a219d
TLSH
T19790027F00E0442794445214DDDC1502357143154F9606D57570424143661519980D86
MD5 SHA1 SHA512 TLSH

Submit Download

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 53B
SHA256 cc3ded03fad5f20fb605b2205cbf6839d12c3e3e99408937f10ff7cd5279de19
MD5 9750d22dbaf2c41a435149dc46b7c10e
SHA1 41dd60960387a7cbf17a3b1350603d8c55e8d92c
SHA512 77df6e9bbc6d78e952af563f665acf952a7e18b8c3986257d091a43d2fe80f20fd3e55960fc0d5f9bdff00c5609f65e7dd8960e50bb823cd9f61aed2c03c1e97
TLSH
T1799002460D4529A9680167338DD15152162511347389430856A16BAA557531669D4441
MD5 SHA1 SHA512 TLSH

Submit Download

KeyChain.Net.XamarinAndroid

Path /data/data/com.wellin.itoken/files/KeyChain.Net.XamarinAndroid
Size 247B
SHA256 6047942f88c19aae125a22976db409bf8b2b98725bb527635ad1145171534ae4
MD5 3d75b137cda775055bd5ff1060155e6f
SHA1 64c0c538e99788edb3d8e09c53a7567684023d75
SHA512 33497a51a7ae9cb751efed2062753029ec9de7a5dc302de021cc3f17651e8fa8047fdf40c717031612587fcef6baee9f1cb49628676b4a06440f193866249c71
TLSH
T1EBD0976491A0DCB2C05812AE62FB3003F3FC9258E2A73909B69E0D8260AA498F400AB0
MD5 SHA1 SHA512 TLSH

Submit Download

token_v2.realm

Path /data/data/com.wellin.itoken/files/token_v2.realm
Size 8KB
SHA256 0cc4200d731d5911e82180d7fc875f911dd383c7c5580c4c7054caf8f30b0243
MD5 ec52cd69a395a82e09a841b841b28547
SHA1 58c20ff5d56727549e7f6e77df792bd0d3d7ce57
SHA512 33996f0b71d039ce44c89e17e6e935b7c654f74b29982f2a59209df49dea662705b32569f0f802b2efcc3e7cd791298fad9fcf5394a971d62c85efaf1c9ee650
SSDEEP 96:HEZgaFRY/iDp5LVv35wFX2/mFWgojCDm3MPyR49KztyR:HzGRtDp5LZp7crFDm3MPu7ztW
TLSH
T158F16B30B037AD92D256B93F38150F970325E91F9316DB40EC1089CDB2AB0F8EA22586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

token_v2.realm

Path /data/data/com.wellin.itoken/files/token_v2.realm
Size 8KB
SHA256 c528fa7213c437ed08dd52568548381596e406d1339db2a1c44e760fcb45cfb8
MD5 4b89e1ddf14e8fae4a5a6c6ab388e135
SHA1 0b602f8cf0c0023a1cf88f9b4238011d8688eb20
SHA512 b464624273bfca324da5bb21b233b30102ac54c57d8d56243ac2322e4e46e8887aa02ef92007b2b121d78f6ae6f991b34aaf53aa69577ff102b54fabe233704b
SSDEEP 96:bYgHAxTTFkREQTkP9FNkPKloIIQ7TCLg9akpQs:jgx/2E9Fz6NOTIlkpQs
TLSH
T1D8F17E6CE40318B1C2EFB3F5777A1580C4F7D350C5284AC65712C8C55EA95ACD28649D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads