Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    16-02-2024 22:00

General

  • Target

    b67d4ee527387e1dfdd75842abdc3a4e3902035b25799abc013d772e9287c265.apk

  • Size

    1.1MB

  • MD5

    5b1aea7916437ef1a7062af9366c445f

  • SHA1

    ded69c36a276c54960a252f24b0b7a653667760d

  • SHA256

    b67d4ee527387e1dfdd75842abdc3a4e3902035b25799abc013d772e9287c265

  • SHA512

    d6d9b4d1699cc32a996305389b38b1f9aff5543d9a5bdba2efbda3a8925158e64d057c7ae9f9150186964cabfe9350019b1b922c5051b4be106948492e6f799b

  • SSDEEP

    24576:Cnuj+XiyXrHPc7khMHMJ+aDl+BR7Esry/ib9uh4FybdNfladLM:jjgiQrHP5hMHM+aAX9aKidNda1M

Malware Config

Extracted

Family

octo

C2

https://2.57.149.104/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.net/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.com/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.xyz/MzRlZGFmYzQ5Nzc0/

https://lilisiaplaksiminailmas.site/MzRlZGFmYzQ5Nzc0/

https://kemerstylerkka.net/MzRlZGFmYzQ5Nzc0/

https://kankalarkemeryerkk.net/MzRlZGFmYzQ5Nzc0/

https://kanamcanambanemlk.net/MzRlZGFmYzQ5Nzc0/

https://kanambanmabmanlkuy.net/MzRlZGFmYzQ5Nzc0/

https://kankambankamlldrpn.net/MzRlZGFmYzQ5Nzc0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Loads dropped Dex/Jar 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.feelthend
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4911

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.feelthend/.qcom.feelthend

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.feelthend/app_mph_dex/classes.dex

    Filesize

    7KB

    MD5

    1eea6f73d162cadc9b73b4cdca962541

    SHA1

    a4571c63345d1ae4483f632e7c816faf38c6baf8

    SHA256

    c66b9960f5043c38324aeb7b16cb02f3b7570399b5aab1b1145131a32e865ef4

    SHA512

    5c4ee86f170eebe183a785b509a902551846e4a6beb24151eb1f837f1d2431f2b186caab4572aa3c74be28fba82d00cd451724bbb1ee6eecfd8b2dff57277855

  • /data/data/com.feelthend/cache/dosvrhigwiz

    Filesize

    450KB

    MD5

    05c7e2b0c533356b8ca4db1ffe1bdd17

    SHA1

    5b5cff5ea051506639f83c174ef2596108b48447

    SHA256

    b71c43d845aa3ae593952a81d359c3dfc34620a571e355125bd3e6e64f440e93

    SHA512

    31647e5a78749795a6d47cc0d38fb5cde6cddb730a0a4c7c6c514bd206f6f3d9985ce247585859a80918cc466562fab229d258cb12009da6d02bb440ebee0d7c

  • /data/data/com.feelthend/cache/oat/dosvrhigwiz.cur.prof

    Filesize

    501B

    MD5

    6aa4897ee6863f0483ba8cac8894f374

    SHA1

    fc3d9e0f9a099e8842b3a852da55ac00159ab3d7

    SHA256

    fa8c302138532a2607c59615edd7fc383abac252382e0c251a33ec040f151b16

    SHA512

    98d1f53445061c6efff4c0ce476ca67928272a16655d7ce776db618dc69b33745034df87289d5d96cced8438e950b4bd792b04ba7740930f89a5ce0528140a45