General
- Target d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
- Size 1.5MB
- Sample261114-ysdmesvv4q
- SHA256 cf7969d55cf00542d8b81f531dc7494185da925550cdaca3e19877f2d1295983
- MD5 3f3664555f195daf4d2f54f33e91e2fe
- SHA1 a8ac2836abf6b4a5bc813d39123fc9ef9870f14a
- SHA512 e3eaa9743d623a9ca754acee52891f362a47b7a25b8e49265db79264208a3fda46a9ad1d3b08a825f140974f0e2843f75879d00cd6a4ffd062c5ef6bc1536464
- SSDEEP 24576:P7Qrkr8pik3CvXgfP8Kv0PHPYTwoB3tLU7LvnD8+8c3skEvQeHbMpWRbmE:Psk4avXMU56FjLm7/cLQlpWRbmE
- TLSH T120653340362969C3E5BCF3B96F73CB2E6966B123D8EA2D2DDB70A37109055384C4CA75
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
Resource
android-x86-arm-20260721-en
Behavioral task
behavioral2
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
Resource
android-x64-20260721-en
Behavioral task
behavioral3
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
Resource
android-x64-arm64-20260721-en
Behavioral task
behavioral4
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.apk
Resource
android-x86-arm-20260721-en
Behavioral task
behavioral5
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.apk
Resource
android-x64-20260721-en
Behavioral task
behavioral6
Sample
d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.apk
Resource
android-x64-arm64-20260721-en
Malware Config
Extracted
-
anubis
-
http://cdnjs.su
-
http://ktosdelaetskrintotpidor.com
-
http://sositehuypidarasi.com
-
target_apps
MyING.be
aib.ibank.android
alior.bankingapp.android
at.easybank.securityapp
at.psa.app.bawag
at.spardat.bcrmobile
at.spardat.netbanking
au.com.bankwest.mobile
au.com.cua.mb
au.com.mebank.banking
au.com.nab.mobile
au.com.newcastlepermanent
au.com.suncorp.SuncorpBank
ccom.tmob.denizbank
com.DijitalSahne.EnYakinHalkbank
com.FubonMobileClient
com.MobileTreeApp
com.Plus500
com.abnamro.nl.mobile.payments
com.advantage.RaiffeisenBank
com.aff.otpdirekt
com.amazon.windowshop
com.att.myWireless
com.axis.mobile
com.bankaustria.android.olb
com.bankia.wallet
com.bankinter.launcher
com.bankofamerica.cashpromobile
com.bankofqueensland.boq
com.barclays.android.barclaysmobilebanking
com.barclays.ke.mobile.android.ui
com.bbnt
com.bbva.bbvawallet
com.bbva.netcash
com.binance.dev
com.binance.odapplications
com.bitcoin.ss.zebpayindia
com.bitfinex.bfxapp
com.bitmarket.trader
com.bitmarket.trader
com.blockfolio.blockfolio
com.bmo.mobile
com.boursorama.android.clients
com.bssys.vtb.mobileclient
com.btcturk
com.btcturk
com.caisseepargne.android.mobilebanking
com.cba.android.netbank
com.chase.sig.android
com.cibc.android.mobi
com.citi.citimobile
com.clairmail.fth
com.cleverlance.csas.servis24
com.cm_prod.nosactus
com.coin.profit
com.coinbase.android
com.coins.bit.local
com.coins.ful.bit
com.comarch.mobile.banking.bgzbnpparibas.biznes
com.comarch.security.mobilebanking
com.crypter.cryptocyrrency
com.csam.icici.bank.imobile
com.csg.cs.dnmbs
com.db.mm.deutschebank
com.db.mm.norisbank
com.db.pwcc.dbmobile
com.dbs.hk.dbsmbanking
com.de.dkb.portalapp
com.discoverfinancial.mobile
com.eastwest.mobile
com.ebay.mobile
com.edsoftapps.mycoinsvalue
com.empik.empikapp
com.empik.empikfoto
com.fi6122.godough
com.fi6256.godough
com.fi6543.godough
com.fi6665.godough
com.fi9228.godough
com.fi9908.godough
com.finansbank.mobile.cepsube
com.finanteq.finance.ca
com.fragment.akbank
com.fuib.android.spot.online
com.fusion.ATMLocator
com.garantiyatirim.fx
com.getingroup.mobilebanking
com.grppl.android.shell.BOS
com.grppl.android.shell.CMBlloydsTSB73
com.grppl.android.shell.halifax
com.hangseng.rbmobile
com.htsu.hsbcpersonalbanking
com.idbi.mpassbook
com.ideomobile.hapoalim
com.ifs.banking.fiid1369
com.ifs.mobilebanking.fiid3919
com.imb.banking2
com.infrasofttech.indianBank
com.ing.diba.mbbr2
com.ing.mobile
com.ingbanktr.ingmobil
com.isis_papyrus.raiffeisen_pay_eyewdg
com.jackhenry.rockvillebankct
com.jackhenry.washingtontrustbankwa
com.jackpf.blockchainsearch
com.jamalabbasii1998.localbitcoin
com.jiffyondemand.user
com.jpm.sig.android
com.kryptokit.jaxx
com.kutxabank.android
com.kuveytturk.mobil
com.kuveytturk.mobil
com.latuabanca_tabperandroid
com.latuabancaperandroid
com.localbitcoins.exchange
com.localbitcoinsmbapp
com.lynxspa.bancopopolare
com.magiclick.odeabank
com.magiclick.odeabank
com.mal.saul.coinmarketcap
com.matriksdata.ziraatyatirim.pad
com.mobikwik_new
com.mobillium.papara
com.mobillium.papara
com.moneybookers.skrillpayments
com.moneybookers.skrillpayments.neteller
com.monitise.isbankmoscow
com.mtel.androidbea
com.mycelium.wallet
com.orangefinansek
com.oxigen.oxigenwallet
com.palatine.android.mobilebanking.prod
com.paypal.android.p2pmobile
com.plunien.poloniex
com.portfolio.coinbase_tracker
com.pozitron.albarakaturk
com.pozitron.albarakaturk
com.pozitron.iscep
com.pozitron.vakifbank
com.quickmobile.anzirevents15
com.rbc.mobile.android
com.rbs.mobile.android.natwestbandc
com.rbs.mobile.android.rbsbandc
com.rbs.mobile.android.ubr
com.redrockdigimark
com.rsi
com.santander.app
com.sbi.SBIFreedomPlus
com.scb.breezebanking.hk
com.scotiabank.mobile
com.snapwork.hdfc
com.sovereign.santander
com.starfinanz.smob.android.sbanking
com.starfinanz.smob.android.sfinanzstatus.tablet
com.sterling.onepay
com.suntrust.mobilebanking
com.svb.mobilebanking
com.targo_prod.bad
com.td
com.teb
com.teb
com.tecnocom.cajalaboral
com.thunkable.android.manirana54.LocalBitCoins
com.thunkable.android.manirana54.LocalBitCoins_unblock
com.thunkable.android.santoshmehta364.UNOCOIN_LIVE
com.tmob.denizbank
com.tmob.tabletdeniz
com.tnx.apps.coinportfolio
com.triodos.bankingnl
com.ukrsibbank.client.android
com.unicredit
com.unionbank.ecommerce.mobile.commercial.legacy
com.unionbank.ecommerce.mobile.commercial.legacy
com.unocoin.unocoinmerchantPoS
com.unocoin.unocoinwallet
com.usaa.mobile.android.usaa
com.usbank.mobilebanking
com.vakifbank.mobilel
com.veripark.ykbaz
com.vzw.hss.myverizon
com.wellsFargo.ceomobile
com.yinzcam.facilities.verizon
com.ykb.android
cz.airbank.android
cz.csob.smartbanking
cz.sberbankcz
de.comdirect.android
de.commerzbanking.mobil
de.consorsbank
de.fiducia.smartphone.android.banking.vr
de.postbank.finanzassistent
de.schildbach.wallet
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
eu.eleader.mobilebanking.invest
eu.eleader.mobilebanking.pekao
eu.eleader.mobilebanking.pekao.firm
eu.eleader.mobilebanking.raiffeisen
eu.inmite.prj.kb.mobilbank
eu.unicreditgroup.hvbapptan
finansbank.enpara
fr.axa.monaxa
fr.banquepopulaire.cyberplus
fr.creditagricole.androidapp
fr.laposte.lapostetablet
fr.lcl.android.customerarea
hdfcbank.hdfcquickbank
hk.com.hsbc.hsbchkmobilebanking
hr.asseco.android.jimba.mUCI.ro
in.co.bankofbaroda.mpassbook
info.blockchain.merchant
io.getdelta.android
it.bnl.apps.banking
it.bnl.apps.enterprise.bnlpay
it.bpc.proconl.mbplus
it.copergmps.rt.pf.android.sp.bmps
it.gruppocariparma.nowbanking
it.ingdirect.app
it.nogood.container
it.popso.SCRIGNOapp
jp.co.aeonbank.android.passbook
jp.co.netbk
jp.co.rakuten_bank.rakutenbank
jp.co.sevenbank.AppPassbook
jp.co.smbc.direct
jp.mufg.bk.applisp.app
may.maybank.android
me.doubledutch.hvdnz.cbnationalconference2016
mobi.societegenerale.mobile.lappli
mobile.santander.de
net.bnpparibas.mescomptes
nl.asnbank.asnbankieren
nl.snsbank.mobielbetalen
nz.co.anz.android.mobilebanking
nz.co.asb.asbmobile
nz.co.bnz.droidbanking
nz.co.kiwibank.mobile
nz.co.westpac
org.banksa.bank
org.bom.bank
org.stgeorge.bank
org.usemployees.mobile
pinacleMobileiPhoneApp.android
piuk.blockchain.android
pl.aliorbank.aib
pl.allegro
pl.bosbank.mobile
pl.bph
pl.bps.bankowoscmobilna
pl.bzwbk.bzwbk24
pl.bzwbk.ibiznes24
pl.bzwbk.mobile.tab.bzwbk24
pl.ceneo
pl.com.rossmann.centauros
pl.fmbank.smart
pl.ideabank.mobilebanking
pl.ing.mojeing
pl.ipko.mobile
pl.mbank
pl.millennium.corpApp
pl.orange.mojeorange
pl.pkobp.iko
pl.pkobp.ipkobiznes
posteitaliane.posteapp.apppostepay
ro.btrl.mobile
ru.alfabank.mobile.ua.android
ru.alfadirect.app
ru.mw
ru.sberbank.sberbankir
ru.tinkoff.goabroad
sk.sporoapps.skener
tr.com.hsbc.hsbcturkey
tr.com.sekerbilisim.mbank
tr.com.sekerbilisim.mbank
ua.aval.dbo.client.android
ua.com.cs.ifobs.mobile.android.otp
ua.com.cs.ifobs.mobile.android.pivd
ua.oschadbank.online
ua.privatbank.ap24
wit.android.bcpBankingApp.millenniumPL
wos.com.zebpay
zebpay.Application
Targets
-
- Target d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
- Size 1.5MB
- SHA256 cf7969d55cf00542d8b81f531dc7494185da925550cdaca3e19877f2d1295983
- MD5 3f3664555f195daf4d2f54f33e91e2fe
- SHA1 a8ac2836abf6b4a5bc813d39123fc9ef9870f14a
- SHA512 e3eaa9743d623a9ca754acee52891f362a47b7a25b8e49265db79264208a3fda46a9ad1d3b08a825f140974f0e2843f75879d00cd6a4ffd062c5ef6bc1536464
- SSDEEP 24576:P7Qrkr8pik3CvXgfP8Kv0PHPYTwoB3tLU7LvnD8+8c3skEvQeHbMpWRbmE:Psk4avXMU56FjLm7/cLQlpWRbmE
- TLSH T120653340362969C3E5BCF3B96F73CB2E6966B123D8EA2D2DDB70A37109055384C4CA75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4.zip
- Size 1.8MB
- SHA256 d4212439e709b6d3f363fecea26e71a6496011a776986698fe34e05bd3766ac4
- MD5 8a4949f3337a806c6d2a3beba9bca511
- SHA1 4573e7cfa528c64de796210e1b69fca8b8cf87ea
- SHA512 0ef304ee269af8ce2ef385dad9898eb59b5ee72421137205629e6f93e0cf7c2a46d86e586cb8d08d2ca0afe8eb11ed2219a9f514a6e438087d183ab005dd156f
- SSDEEP 49152:nAqcnH9bZjBkmOgN++OfDOAW2uibbPfgwgGKz+nvd:n8dbHkbt7OAW2bTgfCn1
- TLSH T13895F182FBC5A86EECF7C7354B76066A55064C668B43D3874A51B63C0DBB9C04E89FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Family: CometBot
CometBot is an Android banking trojan first seen in 2019.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
Reads the contacts stored on the device.
Reads the content of the calendar entry data.
Reads the content of the call log.
Requests cell location
Uses Android APIs to to get current cell location.
Acquires the wake lock
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Queries information about active data network
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Reads information about phone network operator.
MITRE ATT&CK Mobile v16
Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
2