Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    23/02/2024, 22:07

General

  • Target
    1154984469ac6f8fa6bb9f7e2ea3796e78859590bf08b10811ac6f8742033b61.apk
  • Size 541KB
  • Sample240223-116dhsag71
  • SHA256 1154984469ac6f8fa6bb9f7e2ea3796e78859590bf08b10811ac6f8742033b61
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://91.240.118.224/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditionksla.net/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditionalsk.com/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditionpskl.net/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditionctfm.com/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditiontsma.net/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditiontols.com/NjQyNDcyMjE3ZWU3/

  • https://asamanaproductioneditionkdna.net/NjQyNDcyMjE3ZWU3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.buildatj
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4474

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.buildatj

        • Path /data/user/0/com.buildatj/.qcom.buildatj
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        nuhqnbkgb

        • Path /data/user/0/com.buildatj/cache/nuhqnbkgb
        • Size 4KB
        • SHA256 19e88898a0596382e9b34915d7aa305fc6f60154c61eede8aff4e85bf8e0f0ed
        • MD5 SHA1 SHA512

        nuhqnbkgb

        • Path /data/user/0/com.buildatj/cache/nuhqnbkgb
        • Size 450KB
        • SHA256 e06d4f592feec945b94a53fb67deaa75151ac36f5a62379962e3717c24940bb9
        • MD5 SHA1 SHA512 SSDEEP

        nuhqnbkgb.cur.prof

        • Path /data/user/0/com.buildatj/cache/oat/nuhqnbkgb.cur.prof
        • Size 305B
        • SHA256 d8d7915f74b35038cc2a3eb1e0bcab260c2ef435ae17fc86897168197d637ed4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 c7afb029e7780200dd28b0755e0a38dbe34494390113ed356eec97978fb80cbb
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 2cf433be3c3a2ee99a18e2dc571c38d7b35419f4b1ff017f08493d84a7d2b582
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 d353b393a1d94980f2a0387ee0bc9ca338b238e1b650ccb6a0cea93476d8d58a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 45B
        • SHA256 9c26a81cb59df480b58d2dc7c8cf95b46db77d297fbd8d96885e7928fbfbd11d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 d964af5b573cfa4b13e3e2634f70d0b6a688429aa2bc2929555ab639165c6292
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 15372c3db33953cfd9752f93ee3896990f6e0633150f4c44b4c83046725b2819
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 9a95f1c0fc2faa59f44ef85bfe3f35dd04145d10248a854cc34e007050759507
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 4993990cd11c50c93a16388d9f8b7d2336b1c629329b4ba58413c8e26cd175ca
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 12cd9679302e443a5e10930722bc42d282ba3f8e7f2ae8cbd9ae6986509a1718
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 254ef451acb26db61bff216d6077a02400bfd8fc7efb8e566609d6a5884355b1
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 b16860443e8d2f155aa820a6fc8d3d02bc7e45ac1269e16df63129b1f0309c25
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 2f30401536466043d88dff755ded16933c6d0ae2e8aaef73f9eac05dbed12186
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 63b2c0481582e61c2db27153dd36c9b5832b7b1fefdf37c3eae6ddc39b14bf03
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 de7c352dc5ca3ba95f75a61bbfd7e55fb9aa404a6ab1b808300557669640022c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 36bf2d62ec7a8826b1a26e247f79f20b8f0288ee25eeaf1515bd74072540e988
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 4f44dd87649ee35d4ce7783c6acbb29383e244c64cb597b213af82f465c8065f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 aa7b1151896df85565b38ebba94570229a4a8f8de59ffadec60340b5f7d0de61
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 7880b12c1281902ca38f8cde38431a0cb2d39c7bfd15f95b0f0b88b484c6ac2d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 7bc61463ef43d71a25bf7131aaf47db769d8f4627cf0ea19071b1517e8878412
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 517af644d13d747921fc265157261e950945c520a23be196c4b01f80fd1a8cc7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 5f5b5b7d0326b6540d950baf748e0c449183705e1d2b9c92520046fcd893e8bf
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 945a76b24899f09ff702548b5135f7a252c09d8087213bdb892576f9a52e9ac9
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 4a8209412a38b46cf9ca1cc7463a0af3b610cf6d141ae42e3f02ed744d46c973
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 d8d27d5d7691f167d0110980b9b9f266a37dfcf8e45b2b09011a6b706a8e24f0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 230B
        • SHA256 aaf0ecd53eb49021be94ccdceb39f1639e002513ceb0df196c0266f4ccf6defe
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 73d04c9c99eb11bc8882a0939498645476a9b8231c5f255c049b58dcad142c9f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 960b9760392d7eee233786ced4462b163575eb1624deeb6be6b867e7bafb89e4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 97134bdcf49bf8c717405ce9397c239be85857e76745cceb6c8bfaab8799f9a0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 acfebddc2cc8968f027b8616802e2cbd87402db91fc1ee6ead1fe86d8a29606c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 67b1d0dc3d20394f907f87468a2dba0bb76f461009665678f8f4a44598aa545c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 f9983ffc28e383932accde9e82d8df3296a93f79523833ee7e54be4f076974c8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 32b7fa8689e924115b01262c5e880a7b7f496e330e632ce7ab11197340ad8309
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 deb46ea59f3e02693541aa0597a5199090c44a9da74517b4e9c419528bf6e2b4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 e43e1a6efee8d89c6f86c1be8af4e45dc32dd4d14be31046aaed290f4c7b16fc
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 543a2556b3c514ab14782699c89ea1aa21e7bd448a6eb5a379444d8e6b26edbb
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 61c7c150af680958348c9f449248341daf3b849ef84c6d244e28516b3f71db2a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 568795308324aa3972d8b81f7aa3a75780c18d7ccdeee7db9761c0b8524b3840
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 109fce533ad4b8f5f54374654aa295e6b0121c5a21795bb67a23c54a4d254f1e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 d2d5cbee36ab7cf7537494543d9c7841aece3af0048a24d3a033d69e3d6226a3
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 805af534477ffa6c1231eed3aa6ec98c3003f5569e524ccae0b5e874955a4d2f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 c5bd5e7224cba6c47b5dc5f421aa625fa283049dac37f4d4376c3435193a2609
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 7364b4edc443a3aba735010ddf3584cd2ed58596deb718a302d6fcc4b7751c0e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 a3712b4299fdbba9a5e42be8bc788c5a4e95a29ecef09f824670f5563a9993ac
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 58B
        • SHA256 f0c998988da0bda5d00ce422578b41d08c231b67a6ada99d5a43efab94737d59
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 e1c47a4910f5989bbb516d793641ed4c1bd2817b88c56933cbe0bdf870e63127
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 a3c5b9728f085eea42406261b7e21b77bdf7e46a3e6d5683339041c80549c343
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 76B
        • SHA256 920381200aafabe63db2fb5a92ce5a2f8bbfc917536e2e61c48fae008d4f8a6d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 68B
        • SHA256 d9c51508ed07efa24190301a90a413e11ceada485509a4ed514d31f8ab94a40e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 45B
        • SHA256 9ccaf5cc2a8f9a8c529bc99a3be745b6b267ddffeb2e81f2330880cb83acc6d6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 25485ff72528ddd0fd206e5f88fbf7e47b76c3f4abaf7582d056ba18fe497a68
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.buildatj/kl.txt
        • Size 63B
        • SHA256 ea38e3d266a99744a977bb27e63d38bec2057e287e0ad749095478cf1a42e118
        • MD5 SHA1 SHA512