Resubmissions

03/05/2024, 05:42

240503-gd4fvsae7810

01/05/2024, 22:00

240501-1ww92sbb9710

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03/05/2024, 05:42

General

  • Target
    d8d8131ee4a6a7c93bae3395cff2823a3f7855d5915b348ec683c601e64bb52e.apk
  • Size 509KB
  • Sample240503-gd4fvsae78
  • SHA256 d8d8131ee4a6a7c93bae3395cff2823a3f7855d5915b348ec683c601e64bb52e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://2adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://3adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://4adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://5adiletasarim.com/OTM5ZWJiZGQyNzJh/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.roundmuch38
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4623

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.roundmuch38

        • Path /data/user/0/com.roundmuch38/.qcom.roundmuch38
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        jhiusxkdek

        • Path /data/user/0/com.roundmuch38/cache/jhiusxkdek
        • Size 449KB
        • SHA256 00253d072599ead162eaf915cfa919da74ad6bb0c9c0a1c6740e07859aad2bd0
        • MD5 SHA1 SHA512 SSDEEP

        jhiusxkdek.cur.prof

        • Path /data/user/0/com.roundmuch38/cache/oat/jhiusxkdek.cur.prof
        • Size 300B
        • SHA256 fa61dd7f459972fe67a3a3e86495b90980e2e44b4ea4c355f2c74138348aaa96
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 58B
        • SHA256 ba8f7da23a747faead05ff84c7d55dacaee2c807c29c29c2d42ed54c45ccb278
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 3a5db376ccadb5fb2004ddd2658f788f81843fb3533d35efb166aaf7060d4357
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 66B
        • SHA256 679b33815f97d37376397542ad22fdc329dc8888dce5936dad35e5c4177d54a3
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 84B
        • SHA256 85bac427a5c4f78779a9698f8bbb26af6c3d37c8864a9d0e3ab7fe28dc6caf9f
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 f0abef9a6e95a09695d7c1096a0a9f6ac45295dc2e20544a3fce47c8c213a25c
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 58B
        • SHA256 5a351e2d45f01b6c8aeb51a56e853d6b19826e08a56e353c07116faa8a5fce46
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 55310d0d65b1ae61f15ddd62b4d4e01b997e1f2e6afba8c2a6aa15ea3c1527c6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 230B
        • SHA256 89f5bf93f918bfe47072d4e895c1ff28f913fb8ddce2296a4803ad17920e72be
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 03ef9eff37db0bde2fb2dbfaca73b20d5b14bf1989d896476668fb9c2fd099e0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 68B
        • SHA256 424b2ee44ae7d4ca270c2daec023cb4fb78d7e076e0818dec2a70d4d6eb9f450
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 45B
        • SHA256 26eaad58e1b3083623079528c381247bf7c9a90eae4e96e187e569145543e0ca
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 466B
        • SHA256 41a024b2ed6b56c614deb51b4590d6156c67b9706c78a2f05825ec3de9a43b13
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.roundmuch38/kl.txt
        • Size 63B
        • SHA256 9f7a81dba3fe792340825dccc277e533daac7e1e533c78865db1e46b34ad8748
        • MD5 SHA1 SHA512