Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    16-02-2024 22:00

General

  • Target

    b67d4ee527387e1dfdd75842abdc3a4e3902035b25799abc013d772e9287c265.apk

  • Size

    1.1MB

  • MD5

    5b1aea7916437ef1a7062af9366c445f

  • SHA1

    ded69c36a276c54960a252f24b0b7a653667760d

  • SHA256

    b67d4ee527387e1dfdd75842abdc3a4e3902035b25799abc013d772e9287c265

  • SHA512

    d6d9b4d1699cc32a996305389b38b1f9aff5543d9a5bdba2efbda3a8925158e64d057c7ae9f9150186964cabfe9350019b1b922c5051b4be106948492e6f799b

  • SSDEEP

    24576:Cnuj+XiyXrHPc7khMHMJ+aDl+BR7Esry/ib9uh4FybdNfladLM:jjgiQrHP5hMHM+aAX9aKidNda1M

Malware Config

Extracted

Family

octo

C2

https://2.57.149.104/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.net/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.com/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.xyz/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.site/MzRlZGFmYzQ5Nzc0/

https://kemerstylerkka.net/MzRlZGFmYzQ5Nzc0/

https://kankalarkemeryerkk.net/MzRlZGFmYzQ5Nzc0/

https://kanamcanambanemlk.net/MzRlZGFmYzQ5Nzc0/

https://kanambanmabmanlkuy.net/MzRlZGFmYzQ5Nzc0/

https://kankambankamlldrpn.net/MzRlZGFmYzQ5Nzc0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.feelthend
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4257
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.feelthend/app_mph_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.feelthend/app_mph_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4282

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.feelthend/.qcom.feelthend

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.feelthend/app_mph_dex/classes.dex

    Filesize

    7KB

    MD5

    1eea6f73d162cadc9b73b4cdca962541

    SHA1

    a4571c63345d1ae4483f632e7c816faf38c6baf8

    SHA256

    c66b9960f5043c38324aeb7b16cb02f3b7570399b5aab1b1145131a32e865ef4

    SHA512

    5c4ee86f170eebe183a785b509a902551846e4a6beb24151eb1f837f1d2431f2b186caab4572aa3c74be28fba82d00cd451724bbb1ee6eecfd8b2dff57277855

  • /data/data/com.feelthend/cache/dosvrhigwiz

    Filesize

    450KB

    MD5

    05c7e2b0c533356b8ca4db1ffe1bdd17

    SHA1

    5b5cff5ea051506639f83c174ef2596108b48447

    SHA256

    b71c43d845aa3ae593952a81d359c3dfc34620a571e355125bd3e6e64f440e93

    SHA512

    31647e5a78749795a6d47cc0d38fb5cde6cddb730a0a4c7c6c514bd206f6f3d9985ce247585859a80918cc466562fab229d258cb12009da6d02bb440ebee0d7c

  • /data/data/com.feelthend/cache/oat/dosvrhigwiz.cur.prof

    Filesize

    442B

    MD5

    c49220fdf158144ad70e2f2ae74a41ed

    SHA1

    2a6f000af5ca382330220f75ab26abe1f376531b

    SHA256

    3bc869c793dc5ee057782a04c63be54d8e696e979b71c02b5eac276aea2e5659

    SHA512

    db7dad17fd825f8cbdcb28c5bb16eb5ff3a76bc472f3a29820722bf0bc0392c746942c8f656ce39b1771d5636c71a3fb95b8aad38b455679e563a48fa1874ffd

  • /data/user/0/com.feelthend/app_mph_dex/classes.dex

    Filesize

    7KB

    MD5

    0c87ab9356d19848b0d1939046089473

    SHA1

    2d594aa4fe9a0b9d79a250b311c13f389e35af57

    SHA256

    d877affe343a061bcc50a092ec2ab92fa962811daa929d22fa60d31484b9842d

    SHA512

    d6d9990ff5e09b1199def56a207a8efe180e9711c6d8372262e0193abb7f4197e0dfb2c409501f1d068f7c35697cb976ded7cecbf39361bfa6c4be2c5c6284d1