Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    17-02-2024 22:01

General

  • Target

    5f8d3e7abe25c3a918735f5cf7f962495c240ee86be4a0e3037b47bae153496d.apk

  • Size

    545KB

  • MD5

    ed3328ac9a483066ef04f29047a88011

  • SHA1

    29c2d962ff657b0df07db6abe6ef8bc9dd1f8145

  • SHA256

    5f8d3e7abe25c3a918735f5cf7f962495c240ee86be4a0e3037b47bae153496d

  • SHA512

    be92e98c6df65662c0556e0799e0c4812d75c255b3e47269fa7743d8d1d2c8f446266af148d7dd13af9be49ac6a34895046d52170a24d325d5eeb74aa0f5d798

  • SSDEEP

    12288:wpb1WlYCxQuKq0sKZmP7T9Ud0i6vZmr6RLFNnY:5t2uKqW4PX9Ud0i6x6WFNnY

Malware Config

Extracted

Family

octo

C2

https://91.240.118.224/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionksla.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionalsk.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionpskl.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionctfm.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontsma.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontols.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionkdna.net/NjQyNDcyMjE3ZWU3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.centerselfv
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4473

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.centerselfv/.qcom.centerselfv

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.centerselfv/cache/hloxnfzwnmfaz

    Filesize

    450KB

    MD5

    8f31d93863ccf604f9db59e46b521d13

    SHA1

    187ae24ae4c84074a2c843af89d64937a934e6a8

    SHA256

    e81fbfe4c70f8b433a0ce67b6a2a0b3e989e2dd59a32db1ca95b93038a05951d

    SHA512

    14788a8a73bb840bb2cabefed3a827542901fd4c04dfb1687f0b3f88ed28d0680fea242c5cea73ce1d81a22010fd9691c091482a6a125b077afa702713393f40

  • /data/user/0/com.centerselfv/cache/oat/hloxnfzwnmfaz.cur.prof

    Filesize

    319B

    MD5

    da9eed4051a8b7322c417b2594532678

    SHA1

    e05ba449aa3ab0b8715b5e8ddb1ec36d70f23c7b

    SHA256

    7c79d19705fe1dedb83fc5817cc2d1134213fd33c5f28e711e59af2d7dd9734a

    SHA512

    00a36b9d4a8d555cbe873dc66581a4626abb069b2f8c6f89ebb0f2cc08dbab4ddb4ac93df988e2ed05bfd22b2049f435cc93a4cd9b4e7e630b57432a486282f6

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    45B

    MD5

    1f3f5bab0fab9d80f06e0ed5284baf09

    SHA1

    01e86efbcf46d53960fd25c7014954b3246ed346

    SHA256

    a3948f8f88cd6a357c759f691e37e1e0c1d638e3fb3e3f36914cdfa09fdf5898

    SHA512

    86e371eb6b02786e8ca65a9a964cfb0e189f6cd20fd2d056c1d2c05dbed42363b4b3cc8806e5a7a805c6d12622030b171d8128d41c437873f26a0249378e090c

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    63B

    MD5

    f453fac8046df34e7c79e6ea566e7ac5

    SHA1

    d7fab0d911190b059d0f5f6b99840a868388884a

    SHA256

    add25eb65e239b990489ce29dd4c4ffcfaca0f08f49c901992005a6759f0b763

    SHA512

    1a92174a9b9c7e62d229c0716bdc88dfcf96b7d284c09227c52bf46af730a5652f8355e6c7b0018f70578e06d9128ef549291ae2c3527fb2a52d1df0a1c14ad2

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    512e8211955a5bfdbb471f61bab9dead

    SHA1

    918ad7b562e5ba56cb70f01b47a34408e526cfaa

    SHA256

    64be3d220d792541ea306cf0f63764133dbe78a32f9bd5023c26e10bad526496

    SHA512

    f374285d55c4586416e211b5d7022c4e6d9a9a99c08146047d8ac7ef0e8e885f2ff57170a6bb6af291cb5b8ff6d2f8f5f242435f6038bf995e9ea1e6365104da

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    76B

    MD5

    b6e6a68ec154ea008c3d1717fd355a6e

    SHA1

    886ae593da7c40c2c0710eb252ff33e2053b33ce

    SHA256

    d011265647cc70d258edd35426c8277ca86d8186301b9a2127c5ceee3432fc98

    SHA512

    e7627004c5aac13e6e1611ff3b64e46b4538f2d9c33e94798dfbb36d01bb2091c69f59b90869cee640fb141d4dbd823384a182651ea0f78e2d0e13036d6703f5

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    f95bdfc627a1fe8a9bb660783754f877

    SHA1

    2c6fcf6fee4390c95d6a85cfe649b571321f2fc2

    SHA256

    df423230226642a281a3c8fbd73f7157968491f72f5080e9c4ea62107790b2b1

    SHA512

    ea37b388944ffca0cd5b288ba6b6e3cd6eddbf9dd8d703bf1de1612fd1f25d24b5e139f1dc5e197fa4ec67b7b972924dc8c6288666e29ebc3be706c87346f194

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    230B

    MD5

    bb055cd488d0769a6d52d761de0234c3

    SHA1

    9cb7fdc6169defaaf1554d876de576ff840e3055

    SHA256

    b74a18432929b681dae2731f3ecec65e12be18fa565e97d8c9ef0731f080a597

    SHA512

    6a4e235e6ef8eed47991555952880a8379b67fe1f55a1425bd45f4255b63b23fd87e258cc7e735ebec843bfa9c0b97bc455118edf6448ed59590f5684bf2f4c3

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    54B

    MD5

    76b7fee414f7725078782d43274e22c7

    SHA1

    d26749d0e7b16bd70d050f2bac12858a9e036b04

    SHA256

    ca0120ddf2d2d34ae7e9afd9e3085dcbe37d720eb217456c035fba0b8a0fc3a8

    SHA512

    ceb67453739bf096ee4590faade33512cdf8c06159b304c9b980bd07049331b69bb1a2964b1794b786e66f2beafea106f9caaa64ebd1e13eb519de586c83bda0

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    6a568f1b3da9783405a7e66132e45382

    SHA1

    18d17f639d6a4c77e6a92c4d333a3f7b383a5872

    SHA256

    d1013ed58a0c1e6ff7accadafb844c37a429b37bed30ab64fa67dd99bf379477

    SHA512

    36d7eee87d9d0379605ee5d8740c2479116795396ab4491a4231f6809c0f2c03570b4d04a39ea245366cb643408dbe9f0190997529d56acd12d3e74429b6a16a

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    76B

    MD5

    d98346d0c3087741bd3bfd2207e282f7

    SHA1

    dbd9baec364076f0347c93336f34fbac1b69bb37

    SHA256

    3f559de9d2d8dec06ff1af88efed481369d3e461c1d30f20509f302aeeab4dd0

    SHA512

    92a3f27f0517b934c667f42f0ffc271f3c961188cebf52916d1ea68b13929bf332ae5b716fd5327cbb0229950eaf610cf251cbe7679ebb8f49ddff7a27f42e6a

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    ce20a32ee92e2925bbcd337c59a133e9

    SHA1

    84ee583200db0b2d2fed52bbf5727e126fcbfe67

    SHA256

    de1a77eef71952acb2030d86285a29a6082f915622efc45a683388986fb69f43

    SHA512

    3efd5c31097ae483853731b482d4b8918e6f6f8591b9c44859861d6e4e79122c8fe66ff5ba8f8287eee3ddcb387f0fe7ee021c11291bf75ebbaa15c4ff5a1498

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    c7373fa653dc37dda9118354cc20aff6

    SHA1

    5e7359eade370d54777082cbb7b28688eb165483

    SHA256

    cd87a94d49eb21aed4879fe78306642e4026066805b9be4c9aaf150dafdb13c0

    SHA512

    fd5ce792018cb59982110699a58c4469b49d83f9c9117ec3fbf3928c4100a61d9de89cccd8e7b6b630b6003969b310d007a2d9a2d4759441abc6327aea7192ba

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    230B

    MD5

    fc95dfc3fc3b28fbec59403cb791d167

    SHA1

    9a3673ce288d32d3b4e82726dc69e57126fa293a

    SHA256

    3f7bc5abda4b6e4ff35e8f02dee41e5505a0ed8290124d4d0e9189b1caac0352

    SHA512

    e7d9613b1e5b92d4da768ca29e54709740b1ff7e4f73825618bce36c4c6fdbb12d96920a7ac8ae798b7269f057c58d837064ec29a085a40f246a66e863db8d39

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    63B

    MD5

    4ffbead2b75c25b71ac01ae37950c606

    SHA1

    510562c2e307c9986a8bf97e9d6c91b95e083114

    SHA256

    fc1c74ea6af7011dfdef5bfce7a79faa0a1a8e5de757cb55610d73b92ba4c7fd

    SHA512

    91463789facdcb23e557fe322e04c11bb01347c1491d1564a009fe82a6842e1c47230b0777b619429934564ae77a0afc9480312515439be345dac0c6bdfa8eac

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    68B

    MD5

    535dfa13ae327307423f39659dd64d5b

    SHA1

    39f4bf37571933e224ad744d7d172a54dd9409a3

    SHA256

    54083024aa5aac480bae021cb280011269ba255ec4b699bd739ea7f8c8e0f3b5

    SHA512

    dc1d8e03fb7206692030567c8dbd57a431b99f8581bfc318a09f1f2f19edc9787076418f12cd808a797c9baabe3cc99fab8833345335df1dd922595e6fe2f3f2

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    45B

    MD5

    24ca20f0efd26c028730199691385855

    SHA1

    cfc91d7793e815852b69d0cd30e39d802b5bf29b

    SHA256

    3e7ce1d1ee790e905da58e853d04e086f9d41ce38a52f34f0bcea142f4c07aac

    SHA512

    951d14ed38d15cca7793bfb13504d6133de9f3641bd862f3503a1e0c3c5051f49c49fb7f8d09d816969ee42e939cb54adf15bad19b021571ae35b356db4bade8

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    63B

    MD5

    d9a04f27c42292b37238cc8530c3d971

    SHA1

    7390ddbc9ad885216e7b859777bb61b09c272662

    SHA256

    b7d8ea43e2435454838a9de2ae417f2a0c1b30f5207702996bd6876c562570ff

    SHA512

    62eda0e993ef0dd4079359d7eba5d8c45a6de82a5d3a27ca8476fb1e61da132740cd5632d559572afa2a7441074d96c89ff7799204d92533a0cc9ce65c3d7c79

  • /data/user/0/com.centerselfv/kl.txt

    Filesize

    63B

    MD5

    5066dda0839922bacf92a941c047c662

    SHA1

    2a81d66c21841c03efca9ce7b0e2535c4abd36c3

    SHA256

    f185bd757b7942045dba6a989567785ecf2228aa1d2d6ca2c8b2570739b11e39

    SHA512

    dddf089871a80201c9af2e75bdb0dcc7a79d61bc5bfb5e14e2361d0949bed0f285e80edb78c794643f21f8813efbad91e3592cb0655a5c4ff177cafbec6efca1