Analysis

  • max time kernel
    144s
  • max time network
    136s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    13/02/2024, 22:01

General

  • Target

    49031e4c567e1bc3681dab5d046e5ba9d10d909ee128940d4216ebe0dbee6dbd.apk

  • Size

    545KB

  • MD5

    61efbdb4f4c32e584c111ef9da075046

  • SHA1

    2fbac49fc6776d46090b8970ccad1f327ab03fa5

  • SHA256

    49031e4c567e1bc3681dab5d046e5ba9d10d909ee128940d4216ebe0dbee6dbd

  • SHA512

    1c4ff8b344965561d4ec2ba41cadee50dca6f9c1264686f5b91e31eb19a05330ec7b46a80ce2837c890ccfd0c23b05d8b4b5804d4011eb1e2187de68b93a39b3

  • SSDEEP

    12288:rrguZcUq0u9XqP/u2gFQuY9zMYqbXDzh3UMXqvOW4fGUTYUni:QuZJyZq32yuY9oYOR3UMXvW4T0Uni

Malware Config

Extracted

Family

octo

C2

https://91.240.118.224/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionksla.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionalsk.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionpskl.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionctfm.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontsma.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontols.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionkdna.net/NjQyNDcyMjE3ZWU3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.thoughsimpleugd
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4270

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.thoughsimpleugd/.qcom.thoughsimpleugd

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.thoughsimpleugd/cache/oat/vitejgkminynh.cur.prof

    Filesize

    510B

    MD5

    c647a331513acae04b26a91051ff0401

    SHA1

    62378d881957220da21d4bfd556327913d3f9c0f

    SHA256

    b27a89109dd669b140258bcef6b5fe9e2b7bdfb121e3fec88ef13ac2df605042

    SHA512

    d4f7175dd8d8868f03a0ce7fc43537a74b02bf91cd87a93e59799f0a24719f3b0c17cfac63954a8d35861d66c3e1ec94a61e53d767f9a88dfe6d98ad0ecaa4de

  • /data/data/com.thoughsimpleugd/cache/vitejgkminynh

    Filesize

    450KB

    MD5

    d811c2f2f1d85df879d22386c7b3e287

    SHA1

    6a483862fec7fa56bf3823faf599a9161c14ac13

    SHA256

    ec8687dc3119ee72741c96d7312355b665fa2dd1b9dfbbd94920cbb27035f218

    SHA512

    c86ab492cb0f49faa5bb52788cc939e375016b9f1d6d67270bea6ca94dea021781a991e6d142f16af168d5e2e19494cc33d2dd78837d7d726a91bd28c6091ba6

  • /data/data/com.thoughsimpleugd/kl.txt

    Filesize

    230B

    MD5

    d9451d211de56df34744b0c6a0430c90

    SHA1

    0bcca8c33c72e1079e9be733fd4005232ab55e97

    SHA256

    c71b15c2ecb3b34987196396ee947af0762b791c36b9d3f1a279daed768fc2e7

    SHA512

    d50ca727ee7b2f67cf9a71133b6d09105e83ce5deb2c02f32219ed7418d49221cf9595e05be490708c6bd7d3e59abd16fd8140ef4a8e10410b05d603add3d68c

  • /data/data/com.thoughsimpleugd/kl.txt

    Filesize

    54B

    MD5

    19b8f71fdffb924f16446194249c7d29

    SHA1

    0e2e1ba78bf5f947669d24afa8423c155d9406ba

    SHA256

    345dae1c32c2e4ad20d08fc370ab6a5bb1ec7e95c964a4a3bc390c6d966fc2b0

    SHA512

    5c0c47cabebf49ea05f719e802a0b54e7f28c07b525b13040d65bfcf772763908f6ffaff8f357e63697a72c72fee86558fda2150f831596efd32f1881ca5e034

  • /data/data/com.thoughsimpleugd/kl.txt

    Filesize

    68B

    MD5

    bd6c9b050b30f264cde0e18a0e443f15

    SHA1

    840f2424d0a3b9fd78410b01987f5cdd644d5901

    SHA256

    fb4c6e2374e05b794b4fa7a08686777175b9c4d82d93339d8bcd87f6fc44a588

    SHA512

    9486df16948a19362e8b6041b3bb0c072d1d5e0ee0872789744b6dd2f01a5cd63d5fdd8ccc05c507180e4de17db3abedf2e02341520ecf251cba6ddcf2fc3829

  • /data/data/com.thoughsimpleugd/kl.txt

    Filesize

    63B

    MD5

    17af76111cede16543bad703fb1fc867

    SHA1

    30648f48fe5f6ca316b7767fd965d9a3027c712a

    SHA256

    e1ccf5f6ddf7a103bb79c680d59cd044bec73fb7da8c7cec14a7691c62b72bc5

    SHA512

    89106561d5b32a52503b0bd46469b4633c3871a8e6ba5f71ff2548ae216bdc29d89aa1775c6b4ad4b50040c510e31baa8a20e9ebba9f16a3a7cd8ab21d4f8d75

  • /data/data/com.thoughsimpleugd/kl.txt

    Filesize

    79B

    MD5

    e5fc6715ef30824da559b845e2a92b7a

    SHA1

    49eea5bc435d70118e8287438c33371faca419a3

    SHA256

    fe91897c52e3d80c8ee6de0ce34398fde933704854fce50d171016a82fc04f58

    SHA512

    eb63f223dcf42e928f6a41952965d7f9fe4a1d2aef50c6c8ccc0513e4dd987452377da27a6e736bdd803c70e00757fd64f51ce004ebfcc14a3af62e20feee94b