Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    10-04-2024 22:00

General

  • Target

    4a21cbd33e5c736c7bf8aa2a9f80b94ff5d7d2b776b698c4243b53848a5fa7d2.apk

  • Size

    184KB

  • MD5

    4479e07cef5a5194b0b8611db3117173

  • SHA1

    70f027f4d7b970663875e050e8941bb13c1283f2

  • SHA256

    4a21cbd33e5c736c7bf8aa2a9f80b94ff5d7d2b776b698c4243b53848a5fa7d2

  • SHA512

    3ea4c1b06c97bfd0562ef53e3f43b89cfc54838759cbd57a06aab53ee2c19e5ec0d4b53c6aa639c0460cd8549a3b4f8fec18957a33520b407d65661859bcc7c1

  • SSDEEP

    3072:e5lhQeGqu5d/9eJvPITp28g34Yfn07MIPZC8oLu9ifxlfkIMS0CEcgr7zHXVu:e5l85hEJ3v8VYfWJPeKcZttEZvI

Malware Config

Extracted

Family

octo

C2

https://trendyshop57899.shop/ZDQyN2NmOGEzOTlk/

https://techhubshop24578.shop/ZDQyN2NmOGEzOTlk/

https://organicshop89105.shop/ZDQyN2NmOGEzOTlk/

https://vibrantlifeshop12345.shop/ZDQyN2NmOGEzOTlk/

https://artgalleryxshop98765.shop/ZDQyN2NmOGEzOTlk/

https://thopris578993215.shop/ZDQyN2NmOGEzOTlk/

https://empoximwave245768.shop/ZDQyN2NmOGEzOTlk/

https://toxrfusion19156.shop/ZDQyN2NmOGEzOTlk/

https://unxevibe123459.shop/ZDQyN2NmOGEzOTlk/

https://eoiumdlight987656.shop/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.beginhigh19
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Checks memory information
    • Makes use of the framework's foreground persistence service
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4288

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.beginhigh19/.qcom.beginhigh19

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.beginhigh19/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.beginhigh19/kl.txt

    Filesize

    230B

    MD5

    f3a53a88c16a786412fb74cff9d815f0

    SHA1

    9f2fab7a9da2e8cd062f7ad4aed506cb262efdcb

    SHA256

    0e71e89b2b64be1ab63f902fd728620c4f4da46e1a94007f2a9fb9844dd02990

    SHA512

    9ffffdc683033691d605c6cc08e425cf9ac5c09bb7343119cf07ba3ba5608560b9124e3d8cbfac52e1ddb0a837293cec15b2e7b676d512213b555a17df0cb2f5

  • /data/data/com.beginhigh19/kl.txt

    Filesize

    54B

    MD5

    3be2923a4ccb3712d6a3b58fd1f7cdd8

    SHA1

    6612631ca8e92f8e6628f5b0722e7665c995c37a

    SHA256

    16cab251d5b4ff83f16760a879bdf5ef18e7464659fd6c0f3bd81537e0958428

    SHA512

    5483f8ff5350d8454496a61f4809fe3c440a91be45334d957d0019c5e1ff935a80ee9df6cac36619ae0842cf180b5ce6e378d7a91f46a7052ba7f044a40a6f2c

  • /data/data/com.beginhigh19/kl.txt

    Filesize

    63B

    MD5

    d222e33e1331e5a37bf9df945e303978

    SHA1

    1a9015837ecd14d19848fdf3fe732a1eef533099

    SHA256

    c04bd813ea0b3aa6c6822c9782862ab95dcbb7126e3336c5460e6d9b98777132

    SHA512

    1d3e39a0fe2f23ebe7abcc19f80bc4ad9365222be8de35debef17ed3e0528ed8499bc9294ec245bc28a5054edfbd3b4552db8b88b668ab204189696359e35b3c

  • /data/data/com.beginhigh19/kl.txt

    Filesize

    423B

    MD5

    18ac89f88854f20910bc28fcd73f74c1

    SHA1

    04fe28326f8a1bc629d34b5d9626b3b0d4aa570e

    SHA256

    09a2052f36ee1935d10f102200eefeedf27428b3578a863b8168987761b7432b

    SHA512

    b60de9e50bf7838ddec6298cbd47f34a9db963e43b70662306446871c736d4925cbfdd76a7e50a3754bd34996febc22e6b9ce0290fb68e00f553ea73f3b62632