Overview

overview

10

Static

static

6

1.Facebook...ok.apk

android-9-x86

10

1.Facebook...ok.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    07/02/2024, 09:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.Facebook_com.stilldont21_Facebook.apk

  • Size

    509KB

  • MD5

    2d91d38a64897809ffb4f398a3a1ee83

  • SHA1

    24df8fb72e738b4a94de4c07f6c721173802bbd0

  • SHA256

    bbc56a74d2442270b25f5a4d2838f6ba27b8414e4584cea59d55f3dc64fbd462

  • SHA512

    e47e5aca2765f7e65d509c33e3c1e282c3039c7a6306a8366a392927e69e72efac98f6d967c34bc98e83a1b3fff718039ba80a72baf4767fc8925ff51bcbd7b5

  • SSDEEP

    12288:ThAcsLuc/XnFm2AJOQTRaCEMGnvDQPo49x616EYUzxbNw:TrSXo2Avda2AcP59Y166tbNw

Score
10/10
octobankerevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://hk-49847.com/NzBkMWE2ZDM0MWE2/

https://hk-49847.net/NzBkMWE2ZDM0MWE2/

https://hk-49847.info/NzBkMWE2ZDM0MWE2/

https://hk-49847.org/NzBkMWE2ZDM0MWE2/

https://hk-49847.xyz/NzBkMWE2ZDM0MWE2/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
    banker
  • Removes its main activity from the application launcher 1 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.stilldont21
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4480

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
  • flag-us
    DNS
    hk-49847.com
    Remote address:
    1.1.1.1:53
    Request
    hk-49847.com
    IN A
    Response
    hk-49847.com
    IN A
    94.156.68.191
  • flag-us
    DNS
    hk-49847.org
    Remote address:
    1.1.1.1:53
    Request
    hk-49847.org
    IN A
    Response
    hk-49847.org
    IN A
    94.156.68.191
  • flag-nl
    POST
    https://hk-49847.com/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 3507
    Host: hk-49847.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:31 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 292
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:31 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 342
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:39 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.178.14
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 829
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:46 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 1828
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:51 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 1437
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:33:57 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 392
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:34:02 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 339
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:34:31 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-nl
    POST
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    Remote address:
    94.156.68.191:443
    Request
    POST /NzBkMWE2ZDM0MWE2/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 359
    Host: hk-49847.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Wed, 07 Feb 2024 09:35:32 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 320
    Connection: keep-alive
    Vary: Accept-Encoding
  • 216.58.204.74:443
    semanticlocation-pa.googleapis.com
    tls
    1.8kB
     6.3kB
     12
    13
  • 94.156.68.191:443
    https://hk-49847.com/NzBkMWE2ZDM0MWE2/
    tls, http
    5.0kB
     26.0kB
     20
    24

    HTTP Request

    POST https://hk-49847.com/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    3.0kB
     98.1kB
     44
    75

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    1.3kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 142.250.179.238:443
    tls, https
    858 B
     40 B
     1
    1
  • 142.250.178.14:443
    android.apis.google.com
    tls
    4.7kB
     9.1kB
     14
    23
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    1.8kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    2.8kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    2.4kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    1.4kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    1.3kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 94.156.68.191:443
    https://hk-49847.org/NzBkMWE2ZDM0MWE2/
    tls, http
    1.3kB
     2.3kB
     10
    7

    HTTP Request

    POST https://hk-49847.org/NzBkMWE2ZDM0MWE2/

    HTTP Response

    200
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
     304 B
     1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    216.58.204.74
    172.217.169.10
    172.217.169.74
    216.58.201.106
    216.58.212.234
    142.250.179.234
    172.217.16.234
    142.250.187.202
    142.250.178.10
    142.250.200.42
    172.217.169.42
    142.250.180.10
    142.250.200.10
    142.250.187.234

  • 1.1.1.1:53
    hk-49847.com
    dns
    58 B
     74 B
     1
    1

    DNS Request

    hk-49847.com

    DNS Response

    94.156.68.191

  • 1.1.1.1:53
    hk-49847.org
    dns
    58 B
     74 B
     1
    1

    DNS Request

    hk-49847.org

    DNS Response

    94.156.68.191

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.178.14

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.stilldont21/.qcom.stilldont21
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.stilldont21/cache/oat/vkmuxno.cur.prof
    Filesize

    463B

    MD5

    2472b94a896e6c776b428c040336ba4e

    SHA1

    0f83c48010b64f5b01bd12143a25edc5eb21b7ef

    SHA256

    68c032666ba3da322978704d194315379f3deb129666f7c8b5f629e0960d89e5

    SHA512

    57a30db96636f4d955c2a3f714a30d5220f5a5f5dd9e335f1cbc484e2599fbaa81ccb01f5719f429956e721431243f5a5180f7086a3446e0bc153919453f71e8

    Download Submit

  • /data/data/com.stilldont21/cache/vkmuxno
    Filesize

    448KB

    MD5

    ec0ae7bc99fb612782b069a084bd6ae3

    SHA1

    8ae78085dd8295eff1f1913f949aaf4aecc298be

    SHA256

    9d6f5ca7d24a3a0102fcf5b72aaf8565e1c0ecd787e6ca8377a23ccde6796ebf

    SHA512

    6a53e7ab824eec13dab997df88d241eda75b2296467e48854ce988839752a33388ab16f1218a2945e112bba59994c1553024e925475c199b124753b5b46882f0

    Download Submit

  • /data/data/com.stilldont21/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit

  • /data/data/com.stilldont21/kl.txt
    Filesize

    232B

    MD5

    3b633484b632ad04ecf224730728723b

    SHA1

    cc7c6c6d6b764378f9a7292868b607a93f4ff5fb

    SHA256

    8e0b03c5cca96f6709b52054ea9ac0f55421753303b8efcb13b11d2d589a8314

    SHA512

    9594ea003a189cfb22458133c1ed9d13a3ecff46787593da79b65bbbf147c5fab1e603b9195ebc0ab302f3841c5a8e2892156ba1b455316228fd9e9d95267ba7

    Download Submit

  • /data/data/com.stilldont21/kl.txt
    Filesize

    63B

    MD5

    478acb83c0307e182d2ac98e05a64af8

    SHA1

    50ff2ac620a6c9763c06a15f125105355d38476b

    SHA256

    8c6cbe9527d14dcb5ea6ffb896897f15807e0c1b5bf22851b510dc4aa13a1409

    SHA512

    63be97f2469a773b248f4aa54564d1d5592ccd2d430181c1ffe9f7d206b7e79df4d676450b5f4a9d2f3d3587b056c9790cef39a574550b8d65888ac6daa0582c

    Download Submit

  • /data/data/com.stilldont21/kl.txt
    Filesize

    54B

    MD5

    73d42398e78d41d187f6aa156c412784

    SHA1

    e7c50e9473eec0f771861edf713fd585f9b3057d

    SHA256

    b1d54b2e4bdbf46b3bc9c3d4508cc93f16aa72695270c33fe06f4022aa86b436

    SHA512

    3e48d312c925e91f169760072c43b51854079a3fc7a1956ec29378e21f7426710bf89b48baa2252ac861421f2e43bec58a4959866b843ba30b481024d2b13ab9

    Download Submit

  • /data/data/com.stilldont21/kl.txt
    Filesize

    63B

    MD5

    6dfd89725b25d3f43b12f0ad0213a069

    SHA1

    699617a40607c0606d208a6499c4d51d745cefc9

    SHA256

    5edf2412567b2d2a6917805f88ef174474dc8b9235f059001227e89452221fc4

    SHA512

    ad641caae748eba052e5def5d8af9bfa53ef70d86266ce165047c510109b78ece24447c594f3a9249187ed15d47f5bd24b075e80de9be59e636f9e9bbfe56592

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.