Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    05/03/2024, 22:01

General

  • Target
    f3906ea267904ee1b30a91abaab6973cdaa27a3671033e582f811121c80932b2.apk
  • Size 770KB
  • Sample240305-1xa37sbf99
  • SHA256 f3906ea267904ee1b30a91abaab6973cdaa27a3671033e582f811121c80932b2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://83.97.73.205/MzUyMGI3MTIxOWFk/

  • https://aliatabakastabumerangs.com/MzUyMGI3MTIxOWFk/

  • https://aliatabakastakirkharamilers.com/MzUyMGI3MTIxOWF/MzUyMGI3MTIxOWFk/

  • https://alibabacankirkharamiler.net/MzUyMGI3MTIxOWFk/

  • https://alibabacankirkharamiler.com/MzUyMGI3MTIxOWFk/

  • https://kirkharamilervealibabacans.net/MzUyMGI3MTIxOWFk/

  • https://kirkharamilersavastayinebea.com/MzUyMGI3MTIxOWFk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.cityall4
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4472

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.cityall4

        • Path /data/user/0/com.cityall4/.qcom.cityall4
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        .qcom.cityall4

        • Path /data/user/0/com.cityall4/.qcom.cityall4
        • Size 87B
        • SHA256 97c83da19bc89ba9022fe787c854e6168bf2d52897eeadd0ee1e68d601a6fb80
        • MD5 SHA1 SHA512

        classes.dex

        • Path /data/user/0/com.cityall4/app_mph_dex/classes.dex
        • Size 6KB
        • SHA256 14522639c049dd8dd39b0927203df40a4760a41ad6d9cd054faf288f7e41d060
        • MD5 SHA1 SHA512 SSDEEP

        ingvc

        • Path /data/user/0/com.cityall4/cache/ingvc
        • Size 450KB
        • SHA256 b12817fff4b74e15717b0c41f27c9e64a441eebbeb681cd5bcc1ed2591eb8f53
        • MD5 SHA1 SHA512 SSDEEP

        ingvc.cur.prof

        • Path /data/user/0/com.cityall4/cache/oat/ingvc.cur.prof
        • Size 306B
        • SHA256 9fac50bc48b081f10e04484b2d2da5f3b864dafc3afb01e33fc38386320e001b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 f252a25bea0c81d9a697150623897cc706642f8a6b0233d6877c3f0edce68be1
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 45B
        • SHA256 20f5e119c4f2eb3bbcd7fb73f51cb0b66a1097e38b69c6e395ce20132703a5e4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 75B
        • SHA256 f09f11c0658d89cd37c0d1eafa79edf2adf42b93ab6ae927b4ac6131fa008be2
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 9939d99683074dff678165e8a74f41efea9a87aaab07a22080d67a80d1e24851
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 4fa7f251dc589271861f18bd588b5f1e7c160bb816ec6ee2fc4fbde7c26afee8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 1c769d9f4fddac47187d883c61a4d221261bcd3009e7bedff7b4afffee3c6dd0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 9636bbf5b738140f09b06591a3562a7319d4df15dfcc1e80de1facdf2547cf05
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 48ba55840179ff22c07a2e95a6b90fa83657e4851a7ec014f9b88fb9b4beae4f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 e75e5753be02e8a3a48c0b4ddaa8f74768a5e28856dc3716e03c4bcbc14afca1
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 89729e14d9d43a6ebde28b18a64a23ef557a7c17062b77ce5683dbd98c75984a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 c0f9614440a92797058c07a758c8347ac3266f6db4a4c71e08ad680d1b724822
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 35727244a4ae1e0c5c2cadc398beed209c067ca4f54de38b86b3a57d46199ed8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 71af38aaf25f255792f680710be8801f8216b8ac5ab03d44382c38c9c0a968c2
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 45B
        • SHA256 f3ab7e7ac03e6ce9210657a89ac41525778e0d5195382c6a21ebfec078ffd331
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 c59a4607e50c9d0260f8b82452f271da8991619322bcaf1c6b78305d3e08f9d6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 b610086de275557606cfe7c44e2718ddfd0c88a94584c8033a19252e9396ebaa
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 0edbdab6ad36f88ddd7b0fc7c59f3cf464f068aeebc9112c80cfb2a63a8a7d56
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 8fb93f94c6597585cdfe1c9b0c87af4d9b3eb1c302f39050e811fdec4bfc6413
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 a9d339ad060970055a3254ebb8cf02150f9826074c09c34b4e2a5a78fef3ac3c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 4be904d9147677e15c841b19cafac1c043fc4af94bc1ea9d0281f90503dafb40
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 8771bd6fa944fa20cd377e57e2db94fb7bc3905f4e1782bee1b543e9e2e7056d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 a5331c2c38445a9908bf9fad907cfee2c690d89daa749d3c4220c7a031dc101c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 44d9876ff6466c82e0fb3c460281ad92a7ed75f8bbfb0d3227483a6aa207e750
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 9b0ed82af83178a5351364bde6de4f59ff007cc49baa7ab8fe7f53142819f812
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 36b3ec0ecd76a7bfa9731d8d5eb5b5b805734f322622ba4438349b870eeb8e0d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 b35585bf1636d5fb8867bfbdf8868a9a35a0e7b8a9d80c3fbab0f783fc09d90e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 c4ebc00f5b6a42f2fe126941375c348948202fe604696636c5d44b8c6cfd4137
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 e73782072957ff39b472e8b25599cf9b1aecd57c6a2f40e2093a325002445231
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 3ff216b8825936f9c1e35e3a94db899d4fd4f487306ed54746e8fd2a8d0aed00
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 081978a0608c2bca1681d609c6646d62a6ee54f66f212177ee4def67ee4c699a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 8d146cd323e99c278d1a15553b31d60274ae9008b1c0ad86eee6f5ff52c2d5fb
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 71af10e1d8d8a4757e221846bce1bd7063850d4332019a24dc6b5fdbebb739c4
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 1f244b8d51d79ef4daff990f72ce5d8d1761f9e834b4642c34707acd99dbb6ae
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 739e85743a59095c57666c8aa53b3697f9e1a1fce7432194da97d0098e4060c7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 14d08d75eda85cc2072084963b47b5300e8ce7d05e0b89a60cded56ee192707f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 3851456bf67d4354bf39a1ce9d4d08a5a58d9169e177fc11889f00db486df68a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 cb077d8b25b821b4b3d23eee9dd89ba642b48c29043bb560ebd5cbc115a92c80
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 69ff6b0e92ff50c36ebccf293f918b3f4fe2ac1d27947fe011eaf2f9aaecc318
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 c23c88662a10b8f6d7ebf74c08b8739b57e9436f2c6859267ae2579dca314377
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 99942cd0e3dbd97f9364e65d30f8c97c09e1b43a45d57c02d014592bfee833f7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 823369f7e4eb67980efd24f8a921a8540c385e4d5f9123140a45395556a035b0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 3ed7797e20d2b9e76bc13aa9357c20d3b42c09e328d4a7476b8b1c6640f95331
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 06fd3704d113e1ac041c0b6c486a2be00468f79b3e07cc916b5be06c6469940a
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 63B
        • SHA256 db622bb961e2f964d6b80de1fe1fd234bccfc2f6fd4f1345eb04ca11d31bc50e
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 58B
        • SHA256 a7af95455728d6fdb39eae8518f423bef3882a6942cd753b2ee9b0c7a1d5e376
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 68B
        • SHA256 1424e310b6cc9b8034303e5c844679cdd2fac070d8286a3e22973f0355f0cdc5
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 76B
        • SHA256 4f6885c4cf7212d091dbd38cccbab852068b95eaf0989278f5d35a57141b052b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 237B
        • SHA256 162ae2c28398d4a080d9b24643323e4b6b1b10f88aefe5ec53db5a1edf1c3d8b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.cityall4/kl.txt
        • Size 45B
        • SHA256 dca4757c754ae81fd18da75ec571ff7c9f1270db8901874970eac0c2926d535e
        • MD5 SHA1 SHA512