Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    07-02-2024 09:33

General

  • Target

    1.Facebook_com.stilldont21_Facebook.apk

  • Size

    509KB

  • MD5

    2d91d38a64897809ffb4f398a3a1ee83

  • SHA1

    24df8fb72e738b4a94de4c07f6c721173802bbd0

  • SHA256

    bbc56a74d2442270b25f5a4d2838f6ba27b8414e4584cea59d55f3dc64fbd462

  • SHA512

    e47e5aca2765f7e65d509c33e3c1e282c3039c7a6306a8366a392927e69e72efac98f6d967c34bc98e83a1b3fff718039ba80a72baf4767fc8925ff51bcbd7b5

  • SSDEEP

    12288:ThAcsLuc/XnFm2AJOQTRaCEMGnvDQPo49x616EYUzxbNw:TrSXo2Avda2AcP59Y166tbNw

Malware Config

Extracted

Family

octo

C2

https://hk-49847.com/NzBkMWE2ZDM0MWE2/

https://hk-49847.net/NzBkMWE2ZDM0MWE2/

https://hk-49847.info/NzBkMWE2ZDM0MWE2/

https://hk-49847.org/NzBkMWE2ZDM0MWE2/

https://hk-49847.xyz/NzBkMWE2ZDM0MWE2/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.stilldont21
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.stilldont21/.qcom.stilldont21

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.stilldont21/cache/oat/vkmuxno.cur.prof

    Filesize

    463B

    MD5

    2472b94a896e6c776b428c040336ba4e

    SHA1

    0f83c48010b64f5b01bd12143a25edc5eb21b7ef

    SHA256

    68c032666ba3da322978704d194315379f3deb129666f7c8b5f629e0960d89e5

    SHA512

    57a30db96636f4d955c2a3f714a30d5220f5a5f5dd9e335f1cbc484e2599fbaa81ccb01f5719f429956e721431243f5a5180f7086a3446e0bc153919453f71e8

  • /data/data/com.stilldont21/cache/vkmuxno

    Filesize

    448KB

    MD5

    ec0ae7bc99fb612782b069a084bd6ae3

    SHA1

    8ae78085dd8295eff1f1913f949aaf4aecc298be

    SHA256

    9d6f5ca7d24a3a0102fcf5b72aaf8565e1c0ecd787e6ca8377a23ccde6796ebf

    SHA512

    6a53e7ab824eec13dab997df88d241eda75b2296467e48854ce988839752a33388ab16f1218a2945e112bba59994c1553024e925475c199b124753b5b46882f0

  • /data/data/com.stilldont21/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.stilldont21/kl.txt

    Filesize

    232B

    MD5

    3b633484b632ad04ecf224730728723b

    SHA1

    cc7c6c6d6b764378f9a7292868b607a93f4ff5fb

    SHA256

    8e0b03c5cca96f6709b52054ea9ac0f55421753303b8efcb13b11d2d589a8314

    SHA512

    9594ea003a189cfb22458133c1ed9d13a3ecff46787593da79b65bbbf147c5fab1e603b9195ebc0ab302f3841c5a8e2892156ba1b455316228fd9e9d95267ba7

  • /data/data/com.stilldont21/kl.txt

    Filesize

    63B

    MD5

    478acb83c0307e182d2ac98e05a64af8

    SHA1

    50ff2ac620a6c9763c06a15f125105355d38476b

    SHA256

    8c6cbe9527d14dcb5ea6ffb896897f15807e0c1b5bf22851b510dc4aa13a1409

    SHA512

    63be97f2469a773b248f4aa54564d1d5592ccd2d430181c1ffe9f7d206b7e79df4d676450b5f4a9d2f3d3587b056c9790cef39a574550b8d65888ac6daa0582c

  • /data/data/com.stilldont21/kl.txt

    Filesize

    54B

    MD5

    73d42398e78d41d187f6aa156c412784

    SHA1

    e7c50e9473eec0f771861edf713fd585f9b3057d

    SHA256

    b1d54b2e4bdbf46b3bc9c3d4508cc93f16aa72695270c33fe06f4022aa86b436

    SHA512

    3e48d312c925e91f169760072c43b51854079a3fc7a1956ec29378e21f7426710bf89b48baa2252ac861421f2e43bec58a4959866b843ba30b481024d2b13ab9

  • /data/data/com.stilldont21/kl.txt

    Filesize

    63B

    MD5

    6dfd89725b25d3f43b12f0ad0213a069

    SHA1

    699617a40607c0606d208a6499c4d51d745cefc9

    SHA256

    5edf2412567b2d2a6917805f88ef174474dc8b9235f059001227e89452221fc4

    SHA512

    ad641caae748eba052e5def5d8af9bfa53ef70d86266ce165047c510109b78ece24447c594f3a9249187ed15d47f5bd24b075e80de9be59e636f9e9bbfe56592