Analysis
-
max time kernel
150s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
07-02-2024 09:33
General
-
Target
1.Facebook_com.stilldont21_Facebook.apk
-
Size
509KB
-
MD5
2d91d38a64897809ffb4f398a3a1ee83
-
SHA1
24df8fb72e738b4a94de4c07f6c721173802bbd0
-
SHA256
bbc56a74d2442270b25f5a4d2838f6ba27b8414e4584cea59d55f3dc64fbd462
-
SHA512
e47e5aca2765f7e65d509c33e3c1e282c3039c7a6306a8366a392927e69e72efac98f6d967c34bc98e83a1b3fff718039ba80a72baf4767fc8925ff51bcbd7b5
-
SSDEEP
12288:ThAcsLuc/XnFm2AJOQTRaCEMGnvDQPo49x616EYUzxbNw:TrSXo2Avda2AcP59Y166tbNw
Malware Config
Extracted
octo
https://hk-49847.com/NzBkMWE2ZDM0MWE2/
https://hk-49847.net/NzBkMWE2ZDM0MWE2/
https://hk-49847.info/NzBkMWE2ZDM0MWE2/
https://hk-49847.org/NzBkMWE2ZDM0MWE2/
https://hk-49847.xyz/NzBkMWE2ZDM0MWE2/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
jp.co.netbk
jp.co.rakuten_bank.rakutenbank
jp.co.sevenbank.AppPassbook
jp.co.smbc.direct
jp.mufg.bk.applisp.app
com.barclays.ke.mobile.android.ui
nz.co.anz.android.mobilebanking
nz.co.asb.asbmobile
nz.co.bnz.droidbanking
nz.co.kiwibank.mobile
com.getingroup.mobilebanking
eu.eleader.mobilebanking.pekao.firm
eu.eleader.mobilebanking.pekao
eu.eleader.mobilebanking.raiffeisen
pl.bzwbk.bzwbk24
pl.ipko.mobile
pl.mbank
alior.bankingapp.android
com.comarch.mobile.banking.bgzbnpparibas.biznes
com.comarch.security.mobilebanking
com.empik.empikapp
com.empik.empikfoto
com.finanteq.finance.ca
com.orangefinansek
eu.eleader.mobilebanking.invest
pl.aliorbank.aib
pl.allegro
pl.bosbank.mobile
pl.bph
pl.bps.bankowoscmobilna
pl.bzwbk.ibiznes24
pl.bzwbk.mobile.tab.bzwbk24
pl.ceneo
pl.com.rossmann.centauros
pl.fmbank.smart
pl.ideabank.mobilebanking
pl.ing.mojeing
pl.millennium.corpApp
pl.orange.mojeorange
pl.pkobp.iko
pl.pkobp.ipkobiznes
com.kuveytturk.mobil
com.magiclick.odeabank
com.mobillium.papara
com.pozitron.albarakaturk
com.teb
ccom.tmob.denizbank
com.tmob.tabletdeniz
com.vakifbank.mobilel
tr.com.sekerbilisim.mbank
wit.android.bcpBankingApp.millenniumPL
com.idamobile.android.hcb
logo.com.mbanking
com.openbank
com.google.android.apps.walletnfcrel
com.samsung.android.spay
com.cardsapp.android
cz.bsc.rc
cb.ibank
com.bifit.mobile.ubrr
com.bssys.mbcphone.ubrir
net.bl
com.bifit.mobile.bin
com.webmoney.my
com.polehin.android
com.bitcoin.mwallet
io.totalcoin.wallet
com.quppy
com.sharpdev.fxcoin
com.advantage.RaiffeisenBank
hr.asseco.android.jimba.mUCI.ro
may.maybank.android
ro.btrl.mobile
com.amazon.mShop.android.shopping
com.amazon.windowshop
com.ebay.mobile
com.idamob.tinkoff.android
com.akbank.android.apps.akbank_direkt
com.akbank.android.apps.akbank_direkt_tablet
com.akbank.softotp
com.akbank.android.apps.akbank_direkt_tablet_20
com.fragment.akbank
com.ykb.android
com.ykb.android.mobilonay
com.ykb.avm
com.ykb.androidtablet
com.veripark.ykbaz
com.softtech.iscek
com.yurtdisi.iscep
com.softtech.isbankasi
com.monitise.isbankmoscow
com.finansbank.mobile.cepsube
finansbank.enpara
com.magiclick.FinansPOS
com.matriksdata.finansyatirim
finansbank.enpara.sirketim
com.vipera.ts.starter.QNB
com.redrockdigimark
com.garanti.cepsubesi
com.garanti.cepbank
com.garantibank.cepsubesiro
biz.mobinex.android.apps.cep_sifrematik
com.garantiyatirim.fx
com.tmobtech.halkbank
com.SifrebazCep
eu.newfrontier.iBanking.mobile.Halk.Retail
tr.com.tradesoft.tradingsystem.gtpmobile.halk
com.DijitalSahne.EnYakinHalkbank
com.ziraat.ziraatmobil
com.ziraat.ziraattablet
com.matriksmobile.android.ziraatTrader
com.matriksdata.ziraatyatirim.pad
de.ingdiba.bankingapp
de.comdirect.android
de.commerzbanking.mobil
de.consorsbank
com.db.mm.deutschebank
de.dkb.portalapp
com.de.dkb.portalapp
com.ing.diba.mbbr2
de.postbank.finanzassistent
mobile.santander.de
de.fiducia.smartphone.android.banking.vr
fr.creditagricole.androidapp
fr.axa.monaxa
fr.banquepopulaire.cyberplus
net.bnpparibas.mescomptes
com.boursorama.android.clients
com.caisseepargne.android.mobilebanking
fr.lcl.android.customerarea
com.paypal.android.p2pmobile
com.wf.wellsfargomobile
com.wf.wellsfargomobile.tablet
com.wellsFargo.ceomobile
com.usbank.mobilebanking
com.usaa.mobile.android.usaa
com.suntrust.mobilebanking
com.moneybookers.skrillpayments.neteller
com.moneybookers.skrillpayments
com.clairmail.fth
com.konylabs.capitalone
com.yinzcam.facilities.verizon
com.chase.sig.android
com.infonow.bofa
com.bankofamerica.cashpromobile
uk.co.bankofscotland.businessbank
com.grppl.android.shell.BOS
com.rbs.mobile.android.natwestoffshore
com.rbs.mobile.android.natwest
com.rbs.mobile.android.natwestbandc
com.rbs.mobile.investisir
com.phyder.engage
com.rbs.mobile.android.rbs
com.rbs.mobile.android.rbsbandc
uk.co.santander.santanderUK
uk.co.santander.businessUK.bb
com.sovereign.santander
com.ifs.banking.fiid4202
com.fi6122.godough
com.rbs.mobile.android.ubr
com.htsu.hsbcpersonalbanking
com.grppl.android.shell.halifax
com.grppl.android.shell.CMBlloydsTSB73
com.barclays.android.barclaysmobilebanking
com.unionbank.ecommerce.mobile.android
com.unionbank.ecommerce.mobile.commercial.legacy
com.snapwork.IDBI
com.idbibank.abhay_card
src.com.idbi
com.idbi.mpassbook
com.ing.mobile
com.snapwork.hdfc
com.sbi.SBIFreedomPlus
hdfcbank.hdfcquickbank
com.csam.icici.bank.imobile
in.co.bankofbaroda.mpassbook
com.axis.mobile
cz.csob.smartbanking
sk.sporoapps.accounts
sk.sporoapps.skener
com.cleverlance.csas.servis24
org.westpac.bank
nz.co.westpac
au.com.suncorp.SuncorpBank
org.stgeorge.bank
org.banksa.bank
au.com.newcastlepermanent
au.com.nab.mobile
au.com.mebank.banking
au.com.ingdirect.android
MyING.be
com.imb.banking2
com.fusion.ATMLocator
au.com.cua.mb
com.commbank.netbank
com.citibank.mobile.au
com.citibank.mobile.uk
com.citi.citimobile
org.bom.bank
com.bendigobank.mobile
me.doubledutch.hvdnz.cbnationalconference2016
au.com.bankwest.mobile
com.bankofqueensland.boq
com.anz.android.gomoney
com.anz.android
com.anz.SingaporeDigitalBanking
com.anzspot.mobile
com.crowdcompass.appSQ0QACAcYJ
com.arubanetworks.atmanz
com.quickmobile.anzirevents15
at.volksbank.volksbankmobile
it.volksbank.android
it.secservizi.mobile.atime.bpaa
de.fiducia.smartphone.android.securego.vr
com.isis_papyrus.raiffeisen_pay_eyewdg
at.easybank.mbanking
at.easybank.tablet
at.easybank.securityapp
at.bawag.mbanking
com.bawagpsk.securityapp
at.psa.app.bawag
com.pozitron.iscep
com.vakifbank.mobile
com.pozitron.vakifbank
com.starfinanz.smob.android.sfinanzstatus
com.starfinanz.mobile.android.pushtan
com.entersekt.authapp.sparkasse
com.starfinanz.smob.android.sfinanzstatus.tablet
com.starfinanz.smob.android.sbanking
com.palatine.android.mobilebanking.prod
fr.laposte.lapostemobile
com.cm_prod.bad
com.cm_prod.epasal
com.cm_prod_tablet.bad
com.cm_prod.nosactus
mobi.societegenerale.mobile.lappli
com.bbva.netcash
com.bbva.bbvacontigo
com.bbva.bbvawallet
es.bancosantander.apps
com.santander.app
es.cm.android
es.cm.android.tablet
com.bankia.wallet
com.bestbuy.android
com.jiffyondemand.user
com.latuabancaperandroid
com.latuabanca_tabperandroid
com.lynxspa.bancopopolare
com.unicredit
it.bnl.apps.banking
it.bnl.apps.enterprise.bnlpay
it.bpc.proconl.mbplus
it.copergmps.rt.pf.android.sp.bmps
it.gruppocariparma.nowbanking
it.ingdirect.app
it.nogood.container
it.popso.SCRIGNOapp
posteitaliane.posteapp.apppostepay
com.abnamro.nl.mobile.payments
com.triodos.bankingnl
nl.asnbank.asnbankieren
nl.snsbank.mobielbetalen
com.btcturk
com.ingbanktr.ingmobil
com.tmob.denizbank
tr.com.hsbc.hsbcturkey
com.att.myWireless
com.vzw.hss.myverizon
aib.ibank.android
com.bbnt
com.csg.cs.dnmbs
com.discoverfinancial.mobile
com.eastwest.mobile
com.fi6256.godough
com.fi6543.godough
com.fi6665.godough
com.fi9228.godough
com.fi9908.godough
com.ifs.banking.fiid1369
com.ifs.mobilebanking.fiid3919
com.jackhenry.rockvillebankct
com.jackhenry.washingtontrustbankwa
com.jpm.sig.android
com.sterling.onepay
com.svb.mobilebanking
org.usemployees.mobile
pinacleMobileiPhoneApp.android
com.fuib.android.spot.online
com.ukrsibbank.client.android
com.Plus500
eu.unicreditgroup.hvbapptan
com.targo_prod.bad
com.db.pwcc.dbmobile
com.db.mm.norisbank
com.bitmarket.trader
com.plunien.poloniex
com.mycelium.wallet
com.bitfinex.bfxapp
com.binance.dev
com.binance.odapplications
com.blockfolio.blockfolio
com.crypter.cryptocyrrency
io.getdelta.android
com.edsoftapps.mycoinsvalue
com.coin.profit
com.mal.saul.coinmarketcap
com.tnx.apps.coinportfolio
com.coinbase.android
com.portfolio.coinbase_tracker
com.bitpay.wallet
com.bitcoin.wallet.btc
com.blocktrail.mywallet
org.electrum.electrum
com.paxful.wallet
com.bitcoin.pocketbook.btc
net.bitstamp.app
de.schildbach.wallet
piuk.blockchain.android
info.blockchain.merchant
com.jackpf.blockchainsearch
com.unocoin.unocoinwallet
com.unocoin.unocoinmerchantPoS
com.thunkable.android.santoshmehta364.UNOCOIN_LIVE
wos.com.zebpay
com.localbitcoinsmbapp
com.thunkable.android.manirana54.LocalBitCoins
com.thunkable.android.manirana54.LocalBitCoins_unblock
com.localbitcoins.exchange
com.coins.bit.local
com.coins.ful.bit
com.jamalabbasii1998.localbitcoin
zebpay.Application
xmr.org.freewallet.app
com.bitcoin.ss.zebpayindia
com.kryptokit.jaxx
com.cajasur.android
app.wizink.es
com.grupocajamar.wefferent
caixagalicia.activamovil
com.abanca.bancaempresas
net.inverline.bancosabadell.officelocator.android
es.caixageral.caixageralapp
com.bankinter.bkwallet
com.db.pbc.mibanco
com.indra.itecban.mobile.novobanco
es.openbank.mobile
es.pibank.customers
es.bancosantander.empresas
com.indra.itecban.triodosbank.mobile.banking
es.univia.unicajamovil
com.westernunion.moneytransferr3app.es
www.ingdirect.nativeframe
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.stilldont211⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.stilldont21/.qcom.stilldont21Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
/data/user/0/com.stilldont21/cache/oat/vkmuxno.cur.profFilesize
332B
MD5b6ed8698bc3f2c3e4e655ef91a17b2f7
SHA1ff9817b2d82142043ba40a6d68d2575b7987f958
SHA2560c67bf6e0882d0c35c0d94c008fae701351bd74594fbae11c856b2dd533c7bd2
SHA512b0d94639e76cb9e3ba7ae5ad3d8a288b879d4cad9af349e586571c879a1d1b61109aa9037dd5fabf1ab6afaca23dfb90aa4b5eb54c541641ef06966d5841c042
-
/data/user/0/com.stilldont21/cache/vkmuxnoFilesize
448KB
MD5ec0ae7bc99fb612782b069a084bd6ae3
SHA18ae78085dd8295eff1f1913f949aaf4aecc298be
SHA2569d6f5ca7d24a3a0102fcf5b72aaf8565e1c0ecd787e6ca8377a23ccde6796ebf
SHA5126a53e7ab824eec13dab997df88d241eda75b2296467e48854ce988839752a33388ab16f1218a2945e112bba59994c1553024e925475c199b124753b5b46882f0
-
/data/user/0/com.stilldont21/kl.txtFilesize
45B
MD5934bb817b271f710f654c25008b1b271
SHA1972e896dc42050269b21508338854afb322a3d89
SHA256db787134bf25b60ea98610c5a1cbe72b51056f83b8799f016a6dfb1415960a86
SHA512ad16087db298cf5a1b8deac226f292ff83b099b52324e36fec63ff5c0138a2281bbc0d562c136a44cfead5319009e21259bd3178543cdd1db276a9b42203d5da
-
/data/user/0/com.stilldont21/kl.txtFilesize
79B
MD580a6d5a7361155c14ace517f1ac1bd38
SHA19cb1937092aa19d1d2ddd8736458275b214df97c
SHA2568a9f097dbe35faaf90f378a3bfd834f248958cb7bda593ba5d2096df416c15ce
SHA512b5acc2ceb10d489cedc633dd977f37c42b607b1421244c878b0a5c36aa39e6ac9b24392e0f39f92243d530396d453b4d242ab79d91159647efe710ad41cbc96c
-
/data/user/0/com.stilldont21/kl.txtFilesize
470B
MD5f3122d01b2317138bf8b30a5fa1d9ca1
SHA1bfa28c69da86bbbad28c5bef8f3822a5cfdfb4d8
SHA256416ce5fa4617ddcc4009425acbf1fa763f0dd8bde97d0aafd0d6eb682fb6048b
SHA512f459b123d86e22afc420b3e085b50ae11d309cee42b060c45e922dadb7a453ddb0eee08e3ed2f57c96d31ef55006b2fe1e74700213579a81c4d3327f7fb770d9
-
/data/user/0/com.stilldont21/kl.txtFilesize
54B
MD56c4a7f597e966cc8445fa7e390ca920c
SHA1eb0a1487a6d65bd0445aa9b11a07e356438af4fe
SHA2560b9c016425a668e595cba1fee27d61c6a9ef6ea20315b99e8a7b85401f108b94
SHA5120be0f7092c56c033accb393c13088cb35f23453d59469d182658c3a5934e0ad1f4ecfca89ddf83f34382de32f99730299bb85331bf86a066b625fdf83f4b4152
-
/data/user/0/com.stilldont21/kl.txtFilesize
45B
MD5f4f1357f0e98db7a23b3903b8814e982
SHA163e05f9facbb5d8be56d92deb26cf9896d577dfe
SHA25623ef912ab5027de0a27564f5b2f1a2e3df30586a37473456531652ed4f33f2b4
SHA51294a4554e93f41dda8e375e587ef5a245bc4fa8a07825dc5da868d0a1eeeeda63c9bd980996fcbde510dd2987d084d521eaab91e08a126abd433d6a8f92e5118a
-
/data/user/0/com.stilldont21/kl.txtFilesize
68B
MD584b7b4cc9ecb87b833235953726cbcb7
SHA1773a8687fde5ede1a47c17962fd7edd03d99a867
SHA256dbaeaa7f4aaf9de81fb332ca85d9d23c9fbc1285920b5102fdd030f5776b62ae
SHA5127957a9c81f2e882e28ce458c62b7f2f94d70a68aebb213de1274cb4e2e2855e024643be125855d202e30e50f107eb33966e884632559ee8be8782b19870464c2
-
/data/user/0/com.stilldont21/kl.txtFilesize
63B
MD54a299b90c3fe8caebc972b87e622e32e
SHA18bac384c2b5ce9add8a69d042cfb4d1b3c449eb1
SHA256921ba8b17ff749a28f93a17ed4b72b6a78de670733a7a6471ab2fb4d63a4e6f7
SHA512bd886f32c2995f91523466b741c52bb9a0ea7e8e96c1fa51eabb2811e06ac6db712276709cd53e4e6b24cfe41d16309ac44f2c12d4f5c70f0782f13b017b2438
-
/data/user/0/com.stilldont21/kl.txtFilesize
58B
MD5c512f978e93ead8c7b77b653547e8541
SHA18d39987404f02cabe47f0d0131d21f45f95fd98d
SHA256b559aba7ce7d6b1c7dfebd46cb55458824d5737666c2817a43a809fb78711dea
SHA5128908de27450682afe861be9de6815497f52f76fa495dc192bb6e54dc5c7037d4b5b7333e2ac88070c3152b80d4c52bf69ea04118b2a1b3ab153611fc8161a80e
-
/data/user/0/com.stilldont21/kl.txtFilesize
63B
MD509f7f548b7965522f984e8daef50b333
SHA1d08215db36b6dd097e1f7297f628bf9ecc50c76e
SHA256d06033578e4a01254c150c8c37dd662a7a1f6e26895e5a3982ff5866dd390f55
SHA512903301bfb9a93e49422d551cada96fbfd5d3acaa9867e3900357f388ea9fd8fbe12c4b65fbadc13515844c2897c56075ded7fc9c40537a69ed8b68867e6b7935
-
/data/user/0/com.stilldont21/kl.txtFilesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
/data/user/0/com.stilldont21/kl.txtFilesize
232B
MD5262c79efe85c0f97d2b30e8f778aa6bb
SHA15a8a13c1e2d728b49cbd378ef1eb182195f6ecbd
SHA256178fc1edb989c2d665c52ef9a1ad480d65b8a25954201d61dd48526af08387d3
SHA51216fa950dbaa84c0c8e58d7017d9384305aa1eb4b4be0c04a0983d25f44d9b86006dfe6025be0b2ca8cb5b3243ff8fcd2ed0870c7dc3fd14bb5d24f860b250a4a
-
/data/user/0/com.stilldont21/kl.txtFilesize
45B
MD55d63cf85f338fcf8c34ec238de6d80a9
SHA14b305012eadf9960cc5a0a42ab9e475a20d33d6e
SHA2565a48eedfb5e631f93755af8629dbef06eddfb8316f934fa014b34b792d07bbe8
SHA512f7ec902644db7414bdcd9ac059b9355028af59e692b0b1d58cc091994ad3f2162101aaac52a446d66f1b3732d21e80ca29aea41133e884b66be03a53cf62db04
-
/data/user/0/com.stilldont21/kl.txtFilesize
45B
MD506be8d341b41a834d3600e488a16992f
SHA11ae8deb2cc8af471c821804a3ff9520976a24cc4
SHA25627d17ac909e0d350d458b2bddac3eeb26cd9fbc28278aed297f66c7c24ee2224
SHA5128173a4f4b30d12350c1bebc74f79d9b2f8cd75189352a23734c1ac11a6c43204a5616f41b17973e008e016291a1d71971a611e6a41118be6bfce42f3d9830dea
-
/data/user/0/com.stilldont21/kl.txtFilesize
70B
MD57bf74bbe8ba70c911fe141905ec394b3
SHA1e25ec09d0e1033aedb7a11e9936afcd026f5a4c3
SHA25629c88ab9ba4dfb621efa2e748769ffb4e79e01b6d720326337951f89dc7b4af6
SHA512dcb34a3e2470f0b463c8c0583686c307ccf223f109334f1c52d25e421fc3ecbf5a0b84ca920240f7a902fdc758c23e9f508ab1b1032659dc4af9bc2d76a1721b