Resubmissions

03-05-2024 05:42

240503-gd6wzsae82 10

01-05-2024 22:00

240501-1wwnhsbb96 10

Analysis

  • max time kernel
    159s
  • max time network
    142s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    03-05-2024 05:42

General

  • Target

    e51eb5f689a032af815a514b84b0773be1e85318b4c44600a0ac3f7cc0acd319.apk

  • Size

    509KB

  • MD5

    8b2f36eb8b0445e2a94253fba467c844

  • SHA1

    31e3b2bc4dac776102a29968955401bfd83b9e8f

  • SHA256

    e51eb5f689a032af815a514b84b0773be1e85318b4c44600a0ac3f7cc0acd319

  • SHA512

    1bb9c231edc916e6f8fb50a4842fa47368e9022b5e6f293afd9ce78b0385a77f0c4d97505a5746bf263946e4467f972d615307f0f3c431e541f658e69b8d4406

  • SSDEEP

    12288:yCySOQQVtC97zK9Qi0RK8+hnqMe8OZnrAxInT:FyGQOs0w5hnn1mn0qnT

Malware Config

Extracted

Family

octo

C2

https://adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://2adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://3adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://4adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://5adiletasarim.com/OTM5ZWJiZGQyNzJh/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.passnow88
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.passnow88/.qcom.passnow88
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.passnow88/cache/jwkcwcccxt
    Filesize

    449KB

    MD5

    f78521af4b319ac929824e1275408c20

    SHA1

    8d0c17f0c35a554c7319b379c4c31e9da4fbcefb

    SHA256

    19967c077eb4e9d67671cd7484153aaf7755fc489d958268816126c2ccc85030

    SHA512

    ff7b285e3cfc97af3327d79b68ba65b16c2967966694bf61638155ba6ce0dc8c904617144606edef724ef7813a5ce0ac9e9ee1df00bc8fe4dd293b5d08d56aa3

  • /data/user/0/com.passnow88/cache/oat/jwkcwcccxt.cur.prof
    Filesize

    377B

    MD5

    1b73a728bfc29cbc676bf924fbfa0b86

    SHA1

    c390cd1bcac1449886d54f7fdbe1a459b1b50c83

    SHA256

    5f162af7582def4f64df0bc9803c44e51e43d075ef42e6746bc8e4739f498511

    SHA512

    d5b4fd5a40dbb90cfd8c4cb7ad7ebfb92273d28beaa1461f881b033916b49bf0848176a11a312190780fef416d29d9070dc25601a2b2b4a60e9b4d2e9a93e3cd

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    70B

    MD5

    e626dc832ee9e22f188050bdbdd9ada9

    SHA1

    9bbd64d50e965094cd6355022ff37e16e910be12

    SHA256

    02bc667c59b59015132ab790de9073b77250cf5166320835bf1b115e20605864

    SHA512

    3f004f68f25975ac1b9c28dd48fd42cbfb0bcf8f3800952bfa0440f893a0fc6560be90cb44907d09ef5af8f4071f7d127f66d2636fd4877056d169ec39603d1d

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    55B

    MD5

    8731c0efb82689dae23a8d0b0975039a

    SHA1

    21ed6dbd053e7d0dba3003c03eafa2ba001b6ea8

    SHA256

    cc7394c091386a7129c3b34cd9f07090eea41310d36a15dc71841681c15f159e

    SHA512

    89c9f69bbd0f1562255ab4773b41f4a1dca4eccdb5ca6a38a178c324613a2fe8baaf1265f9a1128ba97d3d47d35778a5d47ac89bc483cbacdb5173246ec9bfcf

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    45B

    MD5

    062797a1929f670285eec0a26bb8f5b9

    SHA1

    2d12c5faad1d5b790fe8329ccd9a8d1cfc6f0b51

    SHA256

    3509db98dc4273935f0d36beb6286441605fd11bbcd09e249ef4cb809e29c259

    SHA512

    c1f9baa807f00b9ed8a5ed20f43b9c63aed202e9b9e8bd7723eb1647b67a8f4edcc483c7e2b5fea42e71ebb74421cf43758b99f9dffe2028fbdac870299bd2d0

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    70B

    MD5

    8c640e31781cd8d9e1a614df60a27715

    SHA1

    28f1be930ce95b79975fcfcf689954ef8c27c5d7

    SHA256

    e3d2904e7c897469a7b2b6a9d96bc45b34ce10f4d226182390c8e1b547fa65cb

    SHA512

    20d216504f14bfa6a25857e2a8243773a7c88d62b6fcbd3a523a2628e72e1c47e93b1dceba07f2ec0da9ebcb3ffa9ab50fe70443291e23bbdbcb366943782786

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    45B

    MD5

    0597ae0c6aa5696e5e2629bfd547c072

    SHA1

    89c32813aa51f607df45154eb468a239fe53efea

    SHA256

    93d922dd5ad98a0ba2026d65a7dd1965c0d8de2186e581f84b946863844bc931

    SHA512

    d66379eb3bf3208d1207aa72a2b25799a184db1fcbd9994aaddabef81eb20a100d6974ab45f3709f74f610e433fa9681344d4dadbdd27bfb1b6e162da30d1a13

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    490B

    MD5

    a342f46c48e12819133e28c810084c37

    SHA1

    cbe3ef343d7a8344503ca43c8bd42430252631da

    SHA256

    d4213f964e80d990763fd2c24b8f49e9b8426fb6d1bf65cce2f664f921a87dc4

    SHA512

    c8e1cee4d4a93797edd52376fd053b973023e1fea03f62adf5ac07d7caf08635237dc682534d376f44eabbb6bdd25109918c7a33381ed81b136050454fe0453d

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    70B

    MD5

    d1e7cb96757d981f3a2492d2e9e84cd9

    SHA1

    75d19bdf330db699055fca1e5b85e70993810998

    SHA256

    f274693699acc365dcddd819baece871e6110f70564359206ed6196ebbd50189

    SHA512

    38fbf2ece5fecf73a87132c0e8816a798a2330ef088b383690b665c14f7f252741a9dc588b83a6daf0881d7106af247b3cea9bd71965d18dbedd36db58b98f1b

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    70B

    MD5

    f2e3420a1000b89235843acea0359630

    SHA1

    056497a9f6f2a33abd299c19c0e964e1235d0af4

    SHA256

    3407b1d822ba932cf7b5e138586a11272d3041508c00ef7577fdd2ae38cfbc3a

    SHA512

    a7aeeca6dad1e2aaa318211b3e6e0f2c6d33743f380f2dd780475313072b5179ebfa97fe11d05d7cd6fdd6b9a40d6bc23a3369d62adfa83ac03073ebe2a38dbc

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    52B

    MD5

    91e60ae88516dbfb065ea62bb2a7b7df

    SHA1

    ff2633af20a83f60a1ac5f74ad1c6024edab945f

    SHA256

    b1ee6e788a0eeaa9035b182c7eb4e1b40c10e31d6cbcefeba07d6d07a66701fa

    SHA512

    cbf4149d5697ef0cd2675100c2408801a4a5ea072968d610b21fe03b5777754979192679609db19e9c772abf24a55ac363cbdc48d4508ce9442b87f77d6dc0d1

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    66B

    MD5

    14bc049f350e979acfa41a58ca0653c2

    SHA1

    4fbb5f1aae8b9a657b7b9c6ff4224dde233faf27

    SHA256

    311916dc465f1f8ed331471010992e0cd664d2c713c3a43b590ced6c2fcd913a

    SHA512

    94d2066becd42cb0baf52b37570bcd38e97bd40debb2bb25ae59f4504c9c45aea8e08dcc739feb19733239f95d0d5b20911f4f3b8b0061b804b1bbac40b69143

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    84B

    MD5

    3a14eb1b111876a60d3432fe3054e098

    SHA1

    9efa630efc97b99f722827c297b59b9028126e68

    SHA256

    210d58e6e6607c72841ff38f39aeebb9f924f15df81676a2d1f43b40b02a840c

    SHA512

    690e278fb69b6975ba11049d7f3eeead8db3329b85f8ab551d8a16232a6d31fe49a19d57a8d3acae5a2151256207c509bab41404b3df0680b3735ced4c0ca962

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    68B

    MD5

    5c1ad67dda38e0e3376c09ce8d1a09e0

    SHA1

    13be4c267f982cd39dc104f1d3e9c7d8d65a17ed

    SHA256

    ac4eb0ef5a7a2850a8f1fe72cf4f8dea4747a87dd768c1581667db163b593a98

    SHA512

    51fe0455127ae23cf2869064700deba0aa530249c67d557a59f4b76c5914da2d20e990ebb4d1ea51bba98134ef5b3565baca2ddc8d12fdb8163017446fb9d6d5

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    68B

    MD5

    c1b68e1eb6a3a5292afaff88cbfd7405

    SHA1

    2233306927a8a1acd7b2e9f17bd34a157eb47055

    SHA256

    fabf2d3e4c57c7cdb9503e3ba6f99df1b448a3080966fa90c39af0d5b5e539fa

    SHA512

    140063ef8d8a0543d6a2e77bcf5befbd5c7acd78cf34c2b63ba26bfad48547be11ffdb2e2231806d29b1d9fca27b1bfa729345d92195a62207be9df1c5f4afda

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    214B

    MD5

    66029cd828e1bee4df8c37e3afd1fcc5

    SHA1

    5edb8bcef537c75582aaa4bac9c11ff13da7784b

    SHA256

    985e1c924dfbba4584ba4f221623c9af1b34c08bfe8cd5101e1edc76d29fbb43

    SHA512

    6b57e5661415015f29df12c1c4e517b25b3033f71f1632b159b113f1d47dcef247f1836fa974c5d3ad59d60c47e8377a71297350c14712c8e9a8fe891920ab71

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    60B

    MD5

    4aaedb66a3e79c338a4eec544c59ecbb

    SHA1

    61c2e4de1a9fbe02a7d580cd76a8a9cede7b318d

    SHA256

    e903df9d5a98dc5606e73080e94f02c16839af6ae3596d2cf6040f2c109e2fcb

    SHA512

    cb930dbbdf78870696da1df8889e1b4034ecf1a07520135a19db75441b196a723e970e8fd22a6f23be9969489f299fa7000f60d3ee8afb5a361661ea35ec2762

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    68B

    MD5

    d1217c8daf9b68f68b4b81bc13d0b1ea

    SHA1

    d0cd7a89694370b947c37f98e18d67ffbc52c983

    SHA256

    99424b5d4aa04756194019734c55aa0b9bc07811ed9aaaae7bf1ec8a0e5bca2e

    SHA512

    c190966884a4a37d917449083bb8948b3284d2d95010f0d379fed1e2f90de527a80b4de9078c7805ec344d71cec0abadd63af2eccf4cc43adabd8e933cdb2514

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    54B

    MD5

    930ec0edbc21ab4f4aec93e533cbcb73

    SHA1

    48279db6549ece9bd981ef0ccc07e8b170a4420d

    SHA256

    831855c82310fdfb8466e398d9f1d17dd88181de92505a18ea75357eb940667b

    SHA512

    ca329f35d0d3d77bb2e59b971fb14be2ea335153590cec0b46ab1a55b8da5452190949ec17d5e3617e4689c5c9acf8f26388b11430b4b3472d1130dc8f5e8a7b

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    68B

    MD5

    4343de6ab823b5f65ea558cdbf67cc4d

    SHA1

    f197b30aee7cfd03cbb3230278d474246f997041

    SHA256

    da3a8f021a58e1a30f514ab7b4242e44635f488467ee2953f55d74f286624f25

    SHA512

    bd2856a19428c5612059984b6fbc8adf8d79e5b3370bf48671921dc354de3982c2aa67f2cc43a5b81985b45bc03e22e5dbf7d57471c08aa2169e7af3c4033c5c

  • /data/user/0/com.passnow88/kl.txt
    Filesize

    52B

    MD5

    535d8ddf12c8f029069dea6f35f75f4e

    SHA1

    25c4b299894247539aeb6701ac3c8c5a7f234a60

    SHA256

    cf8175dc59e98781ed0129df8ba079582b3d00cee4e7107d52d9e0344f7be263

    SHA512

    1d8ad8379625ffc7e54c309d0cb21437f6cd276b708f578ac33e129a21aba4b5a7e5ca880b85021ec772361fd7b963f92981828939cff2f15d34de759ca8235e