Analysis

  • max time kernel
    144s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    20-02-2024 22:03

General

  • Target

    61bdfe6aca8ddd26ec6337aa93d89e99ab0c0b930be39ae8ac96d1e346e156a3.apk

  • Size

    545KB

  • MD5

    1105c3693b67940ca4f434ff9e8e2067

  • SHA1

    47a000df9a4b462db9187290bf28465023ec1c35

  • SHA256

    61bdfe6aca8ddd26ec6337aa93d89e99ab0c0b930be39ae8ac96d1e346e156a3

  • SHA512

    5f643bd1fbd3d79917156655e5ab3b5711dbe61c4f6657db7e79460137bb759899eb1f0ee564357c9e74e918b02c1a70e00719f16cdea15c836c93ce45781c48

  • SSDEEP

    12288:iXvMVZGWNyAsUjGczJ9+cy9Hsf+PSIYW12d+K7Wbn7:kvM7G0yAsU5JA5SImYnbn7

Malware Config

Extracted

Family

octo

C2

https://91.240.118.224/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionksla.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionalsk.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionpskl.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionctfm.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontsma.net/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditiontols.com/NjQyNDcyMjE3ZWU3/

https://asamanaproductioneditionkdna.net/NjQyNDcyMjE3ZWU3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.butdevelop8
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4249

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.butdevelop8/.qcom.butdevelop8

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.butdevelop8/cache/oat/phdyakdrajra.cur.prof

    Filesize

    518B

    MD5

    4994cd8335a1397962b0110288caf3e0

    SHA1

    9acb6759e87f6454df7d80275782c0f427b2f9b1

    SHA256

    fd4d40497940404a2eaf0790357c0a1c4e314720fb3722466496d8a747c117c6

    SHA512

    51675b29aa74597aa3c2eb54d8048289de5cc08009d72ba5df64cbe9f3e09e3c028bf7fc274859b31a55f0da3ff982846d15015a1648e6d155afd8fa37c4b25c

  • /data/data/com.butdevelop8/cache/phdyakdrajra

    Filesize

    120KB

    MD5

    0d37325614e4a4509794624fc01b1bb0

    SHA1

    3cae7a8efa3f9eb43c9185658f95890b3986632c

    SHA256

    c1bb021155aa1e425749561145f363ef7896b2ed30c0b51c7ede3f91513dc1c5

    SHA512

    0c620e983bbb5d46625ac3e811d7b27ec78fd1d5a7fc51986053d60832d29b8ac29909a97b49411907023198649bd5c6be0c297698405315b1586c15d80e678b

  • /data/data/com.butdevelop8/kl.txt

    Filesize

    230B

    MD5

    201ff232ca9c971e7606f0650b6e0574

    SHA1

    0cb6b907629c473436e2c7f50e72631d624c5af2

    SHA256

    0888e96e6fcb918337bd4c65860733af32cccfdf7bdf53e3e8b512b01713f4a5

    SHA512

    81534c5edd16273eb937dc9f167a35c95447c7fc5e246e11f1df28d14f82f34a6d71459b35902cf9d90bb3c13d013c3778656f937d57a0c31e17285b4e56861a

  • /data/data/com.butdevelop8/kl.txt

    Filesize

    54B

    MD5

    ea3aab0a7bc2d00051413695a98561b9

    SHA1

    52853112221aba2a88d47d11ff50aaac6dff6ab9

    SHA256

    0361c7b9d87eb405813907798ec96d7d4bf17eaa656dd947b8591cf226953050

    SHA512

    7ef9f6bc6df44bfbb3ecb3c6454b62ce2b2085027957eb114aff953ac9cff81bf3fb4592aaf2a187c09c8499afda0f059160bd4c27fbaea4de287a4527e60b29

  • /data/data/com.butdevelop8/kl.txt

    Filesize

    63B

    MD5

    4c1457cecb4a41a0c5009344593b7379

    SHA1

    3809600559a133ba0ed94cbf50bf25896fc9cd93

    SHA256

    90497e5aad7d191ca17452edd08c2784dc15edd3f7033b66b678ca14d9b72497

    SHA512

    5c2da9102c19b8e67614cc0cccbfb440c2e338fffd5b6ed1867d24ad4378d90de0cfc57e3b846a56e086d49d964f94adb9ca8dc9e1c9c27983bce987f356ffc7

  • /data/data/com.butdevelop8/kl.txt

    Filesize

    45B

    MD5

    80a062b3b2fae3636f1001c6e4808842

    SHA1

    e0362882881f8d2a6946177b23405ace52ea44a3

    SHA256

    c3a61fda9e22005e83475d1727a225db45ad33579907a82fa8bd8532438dd2e7

    SHA512

    3a5534b47695d3bc2fc006423ed2ebb64442d9c98cb131ddaafcedf966edd12fdaa856c0ff262c85f34a627e156eb2b69ede74a68e70067850774b618ead543f

  • /data/data/com.butdevelop8/kl.txt

    Filesize

    63B

    MD5

    d27845fbf6a70989018ac6635e4ab216

    SHA1

    99a8ce5735676b018bfc115189521bfcc33a78e9

    SHA256

    33b3a74943217aef1ca1d471e5f1bac3670ba8bf4806b7fa921138d7f9a4e82b

    SHA512

    ffedc0a0cb07b5de887bad77b8bd80288c7acab08902a4f916b3854b09d81df5a3474cf24f2b0acc5732e13973a7972adf4a6c0324464237d393b0153583d3eb

  • /data/user/0/com.butdevelop8/cache/phdyakdrajra

    Filesize

    450KB

    MD5

    dcc81481bef1f682bc8f245d75c5b849

    SHA1

    1cce72d507fbf67399992fcd3570216bdee8b187

    SHA256

    e0e0e7f572f8d2beae03523c50fab8b7f9bcecfeebf9374c20b4b1cbeeadb51b

    SHA512

    3b2a378b67b0bc62fd969b51767000da909d6886a8761a19b57e8ab776786cb666a3ded8e653b9368c0006cda855a0ffa12a12963d34bf06a0a239f0545f4f1f