Resubmissions

03-05-2024 05:41

240503-gdxcjsae69 10

01-05-2024 22:00

240501-1wx7caha7y 10

Analysis

  • max time kernel
    66s
  • max time network
    133s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    03-05-2024 05:41

General

  • Target

    b07516e8562a838535fb5cdca22216647d4de9d88906eca7f4abbdb2a220e847.apk

  • Size

    509KB

  • MD5

    1a0fa5a72ad80fb5848f8c6f3cb5870a

  • SHA1

    92ada2721a72b9154d8e6ff107591d42eed8eb6a

  • SHA256

    b07516e8562a838535fb5cdca22216647d4de9d88906eca7f4abbdb2a220e847

  • SHA512

    2ed9b852423e7caffd82548abd1ea035c5f47f46e649944b952fa2000eefb71b7e3b2fc6b8f870d4ffd177f87cdd390974616a3536e0307a0e15102bcf3fd7fb

  • SSDEEP

    12288:DS0wDla4G6eO8S8qFSev59r2z9DE473Px0VF+kaf7W971VFdInD:Dct7ehXWr2z9D7To6u71VFdInD

Malware Config

Extracted

Family

octo

C2

https://adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://2adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://3adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://4adiletasarim.com/OTM5ZWJiZGQyNzJh/

https://5adiletasarim.com/OTM5ZWJiZGQyNzJh/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

    jp.co.netbk

    jp.co.rakuten_bank.rakutenbank

    jp.co.sevenbank.AppPassbook

    jp.co.smbc.direct

    jp.mufg.bk.applisp.app

    com.barclays.ke.mobile.android.ui

    nz.co.anz.android.mobilebanking

    nz.co.asb.asbmobile

    nz.co.bnz.droidbanking

    nz.co.kiwibank.mobile

    com.getingroup.mobilebanking

    eu.eleader.mobilebanking.pekao.firm

    eu.eleader.mobilebanking.pekao

    eu.eleader.mobilebanking.raiffeisen

    pl.bzwbk.bzwbk24

    pl.ipko.mobile

    pl.mbank

    alior.bankingapp.android

    com.comarch.mobile.banking.bgzbnpparibas.biznes

    com.comarch.security.mobilebanking

    com.empik.empikapp

    com.empik.empikfoto

    com.finanteq.finance.ca

    com.orangefinansek

    eu.eleader.mobilebanking.invest

    pl.aliorbank.aib

    pl.allegro

    pl.bosbank.mobile

    pl.bph

    pl.bps.bankowoscmobilna

    pl.bzwbk.ibiznes24

    pl.bzwbk.mobile.tab.bzwbk24

    pl.ceneo

    pl.com.rossmann.centauros

    pl.fmbank.smart

    pl.ideabank.mobilebanking

    pl.ing.mojeing

    pl.millennium.corpApp

    pl.orange.mojeorange

    pl.pkobp.iko

    pl.pkobp.ipkobiznes

    com.kuveytturk.mobil

    com.magiclick.odeabank

    com.mobillium.papara

    com.pozitron.albarakaturk

    com.teb

    ccom.tmob.denizbank

    com.tmob.tabletdeniz

    com.vakifbank.mobilel

    tr.com.sekerbilisim.mbank

    wit.android.bcpBankingApp.millenniumPL

    com.idamobile.android.hcb

    logo.com.mbanking

    com.openbank

    com.google.android.apps.walletnfcrel

    com.samsung.android.spay

    com.cardsapp.android

    cz.bsc.rc

    cb.ibank

    com.bifit.mobile.ubrr

    com.bssys.mbcphone.ubrir

    net.bl

    com.bifit.mobile.bin

    com.webmoney.my

    com.polehin.android

    com.bitcoin.mwallet

    io.totalcoin.wallet

    com.quppy

    com.sharpdev.fxcoin

    com.advantage.RaiffeisenBank

    hr.asseco.android.jimba.mUCI.ro

    may.maybank.android

    ro.btrl.mobile

    com.amazon.mShop.android.shopping

    com.amazon.windowshop

    com.ebay.mobile

    com.idamob.tinkoff.android

    com.akbank.android.apps.akbank_direkt

    com.akbank.android.apps.akbank_direkt_tablet

    com.akbank.softotp

    com.akbank.android.apps.akbank_direkt_tablet_20

    com.fragment.akbank

    com.ykb.android

    com.ykb.android.mobilonay

    com.ykb.avm

    com.ykb.androidtablet

    com.veripark.ykbaz

    com.softtech.iscek

    com.yurtdisi.iscep

    com.softtech.isbankasi

    com.monitise.isbankmoscow

    com.finansbank.mobile.cepsube

    finansbank.enpara

    com.magiclick.FinansPOS

    com.matriksdata.finansyatirim

    finansbank.enpara.sirketim

    com.vipera.ts.starter.QNB

    com.redrockdigimark

    com.garanti.cepsubesi

    com.garanti.cepbank

    com.garantibank.cepsubesiro

    biz.mobinex.android.apps.cep_sifrematik

    com.garantiyatirim.fx

    com.tmobtech.halkbank

    com.SifrebazCep

    eu.newfrontier.iBanking.mobile.Halk.Retail

    tr.com.tradesoft.tradingsystem.gtpmobile.halk

    com.DijitalSahne.EnYakinHalkbank

    com.ziraat.ziraatmobil

    com.ziraat.ziraattablet

    com.matriksmobile.android.ziraatTrader

    com.matriksdata.ziraatyatirim.pad

    de.ingdiba.bankingapp

    de.comdirect.android

    de.commerzbanking.mobil

    de.consorsbank

    com.db.mm.deutschebank

    de.dkb.portalapp

    com.de.dkb.portalapp

    com.ing.diba.mbbr2

    de.postbank.finanzassistent

    mobile.santander.de

    de.fiducia.smartphone.android.banking.vr

    fr.creditagricole.androidapp

    fr.axa.monaxa

    fr.banquepopulaire.cyberplus

    net.bnpparibas.mescomptes

    com.boursorama.android.clients

    com.caisseepargne.android.mobilebanking

    fr.lcl.android.customerarea

    com.paypal.android.p2pmobile

    com.wf.wellsfargomobile

    com.wf.wellsfargomobile.tablet

    com.wellsFargo.ceomobile

    com.usbank.mobilebanking

    com.usaa.mobile.android.usaa

    com.suntrust.mobilebanking

    com.moneybookers.skrillpayments.neteller

    com.moneybookers.skrillpayments

    com.clairmail.fth

    com.konylabs.capitalone

    com.yinzcam.facilities.verizon

    com.chase.sig.android

    com.infonow.bofa

    com.bankofamerica.cashpromobile

    uk.co.bankofscotland.businessbank

    com.grppl.android.shell.BOS

    com.rbs.mobile.android.natwestoffshore

    com.rbs.mobile.android.natwest

    com.rbs.mobile.android.natwestbandc

    com.rbs.mobile.investisir

    com.phyder.engage

    com.rbs.mobile.android.rbs

    com.rbs.mobile.android.rbsbandc

    uk.co.santander.santanderUK

    uk.co.santander.businessUK.bb

    com.sovereign.santander

    com.ifs.banking.fiid4202

    com.fi6122.godough

    com.rbs.mobile.android.ubr

    com.htsu.hsbcpersonalbanking

    com.grppl.android.shell.halifax

    com.grppl.android.shell.CMBlloydsTSB73

    com.barclays.android.barclaysmobilebanking

    com.unionbank.ecommerce.mobile.android

    com.unionbank.ecommerce.mobile.commercial.legacy

    com.snapwork.IDBI

    com.idbibank.abhay_card

    src.com.idbi

    com.idbi.mpassbook

    com.ing.mobile

    com.snapwork.hdfc

    com.sbi.SBIFreedomPlus

    hdfcbank.hdfcquickbank

    com.csam.icici.bank.imobile

    in.co.bankofbaroda.mpassbook

    com.axis.mobile

    cz.csob.smartbanking

    sk.sporoapps.accounts

    sk.sporoapps.skener

    com.cleverlance.csas.servis24

    org.westpac.bank

    nz.co.westpac

    au.com.suncorp.SuncorpBank

    org.stgeorge.bank

    org.banksa.bank

    au.com.newcastlepermanent

    au.com.nab.mobile

    au.com.mebank.banking

    au.com.ingdirect.android

    MyING.be

    com.imb.banking2

    com.fusion.ATMLocator

    au.com.cua.mb

    com.commbank.netbank

    com.citibank.mobile.au

    com.citibank.mobile.uk

    com.citi.citimobile

    org.bom.bank

    com.bendigobank.mobile

    me.doubledutch.hvdnz.cbnationalconference2016

    au.com.bankwest.mobile

    com.bankofqueensland.boq

    com.anz.android.gomoney

    com.anz.android

    com.anz.SingaporeDigitalBanking

    com.anzspot.mobile

    com.crowdcompass.appSQ0QACAcYJ

    com.arubanetworks.atmanz

    com.quickmobile.anzirevents15

    at.volksbank.volksbankmobile

    it.volksbank.android

    it.secservizi.mobile.atime.bpaa

    de.fiducia.smartphone.android.securego.vr

    com.isis_papyrus.raiffeisen_pay_eyewdg

    at.easybank.mbanking

    at.easybank.tablet

    at.easybank.securityapp

    at.bawag.mbanking

    com.bawagpsk.securityapp

    at.psa.app.bawag

    com.pozitron.iscep

    com.vakifbank.mobile

    com.pozitron.vakifbank

    com.starfinanz.smob.android.sfinanzstatus

    com.starfinanz.mobile.android.pushtan

    com.entersekt.authapp.sparkasse

    com.starfinanz.smob.android.sfinanzstatus.tablet

    com.starfinanz.smob.android.sbanking

    com.palatine.android.mobilebanking.prod

    fr.laposte.lapostemobile

    com.cm_prod.bad

    com.cm_prod.epasal

    com.cm_prod_tablet.bad

    com.cm_prod.nosactus

    mobi.societegenerale.mobile.lappli

    com.bbva.netcash

    com.bbva.bbvacontigo

    com.bbva.bbvawallet

    es.bancosantander.apps

    com.santander.app

    es.cm.android

    es.cm.android.tablet

    com.bankia.wallet

    com.bestbuy.android

    com.jiffyondemand.user

    com.latuabancaperandroid

    com.latuabanca_tabperandroid

    com.lynxspa.bancopopolare

    com.unicredit

    it.bnl.apps.banking

    it.bnl.apps.enterprise.bnlpay

    it.bpc.proconl.mbplus

    it.copergmps.rt.pf.android.sp.bmps

    it.gruppocariparma.nowbanking

    it.ingdirect.app

    it.nogood.container

    it.popso.SCRIGNOapp

    posteitaliane.posteapp.apppostepay

    com.abnamro.nl.mobile.payments

    com.triodos.bankingnl

    nl.asnbank.asnbankieren

    nl.snsbank.mobielbetalen

    com.btcturk

    com.ingbanktr.ingmobil

    com.tmob.denizbank

    tr.com.hsbc.hsbcturkey

    com.att.myWireless

    com.vzw.hss.myverizon

    aib.ibank.android

    com.bbnt

    com.csg.cs.dnmbs

    com.discoverfinancial.mobile

    com.eastwest.mobile

    com.fi6256.godough

    com.fi6543.godough

    com.fi6665.godough

    com.fi9228.godough

    com.fi9908.godough

    com.ifs.banking.fiid1369

    com.ifs.mobilebanking.fiid3919

    com.jackhenry.rockvillebankct

    com.jackhenry.washingtontrustbankwa

    com.jpm.sig.android

    com.sterling.onepay

    com.svb.mobilebanking

    org.usemployees.mobile

    pinacleMobileiPhoneApp.android

    com.fuib.android.spot.online

    com.ukrsibbank.client.android

    com.Plus500

    eu.unicreditgroup.hvbapptan

    com.targo_prod.bad

    com.db.pwcc.dbmobile

    com.db.mm.norisbank

    com.bitmarket.trader

    com.plunien.poloniex

    com.mycelium.wallet

    com.bitfinex.bfxapp

    com.binance.dev

    com.binance.odapplications

    com.blockfolio.blockfolio

    com.crypter.cryptocyrrency

    io.getdelta.android

    com.edsoftapps.mycoinsvalue

    com.coin.profit

    com.mal.saul.coinmarketcap

    com.tnx.apps.coinportfolio

    com.coinbase.android

    com.portfolio.coinbase_tracker

    com.bitpay.wallet

    com.bitcoin.wallet.btc

    com.blocktrail.mywallet

    org.electrum.electrum

    com.paxful.wallet

    com.bitcoin.pocketbook.btc

    net.bitstamp.app

    de.schildbach.wallet

    piuk.blockchain.android

    info.blockchain.merchant

    com.jackpf.blockchainsearch

    com.unocoin.unocoinwallet

    com.unocoin.unocoinmerchantPoS

    com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

    wos.com.zebpay

    com.localbitcoinsmbapp

    com.thunkable.android.manirana54.LocalBitCoins

    com.thunkable.android.manirana54.LocalBitCoins_unblock

    com.localbitcoins.exchange

    com.coins.bit.local

    com.coins.ful.bit

    com.jamalabbasii1998.localbitcoin

    zebpay.Application

    xmr.org.freewallet.app

    com.bitcoin.ss.zebpayindia

    com.kryptokit.jaxx

    com.cajasur.android

    app.wizink.es

    com.grupocajamar.wefferent

    caixagalicia.activamovil

    com.abanca.bancaempresas

    net.inverline.bancosabadell.officelocator.android

    es.caixageral.caixageralapp

    com.bankinter.bkwallet

    com.db.pbc.mibanco

    com.indra.itecban.mobile.novobanco

    es.openbank.mobile

    es.pibank.customers

    es.bancosantander.empresas

    com.indra.itecban.triodosbank.mobile.banking

    es.univia.unicajamovil

    com.westernunion.moneytransferr3app.es

    www.ingdirect.nativeframe

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.shouldwant6
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4471

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shouldwant6/cache/bsmnjkv
    Filesize

    449KB

    MD5

    cfc4c5c6fdaca7669c4fbb2406ddfaa6

    SHA1

    1fb59dd40293f2fe75257a2877c41058bdc692fe

    SHA256

    9970f0d6c949e8b32cd922149a77f03a595f5ae6318f37c47af520d1a68898ec

    SHA512

    dc96731819f8dbee612c71f7912ff61094268e154b233cf1379e0766b923ed04e4f6198c7a27747389614508fa5b4e5635af5a5b7ae8d4a96f88d3c19f738e87

  • /data/data/com.shouldwant6/cache/oat/bsmnjkv.cur.prof
    Filesize

    461B

    MD5

    d3c894515adfa5d07899c6d06f31b4cd

    SHA1

    6540af7e75a7d82f5cbce4bf3b5d3ff9bbfa52ed

    SHA256

    8342080467de4f8765a9aaed7793839bc924a3c14987d31e90aba9a2eac14b32

    SHA512

    58881be2ace5a1b09e1ace3bcb2816860c703333c83818c3d79c24f6cb52280b0667764ae0603cdab5be1e09d29900b68e8093656564ed6b57e0cb200a399b56

  • /data/data/com.shouldwant6/kl.txt
    Filesize

    230B

    MD5

    00c43fde6840c04da40c4efe76e97d2b

    SHA1

    32ff51268052b246a239578cc1550d1dc56f0196

    SHA256

    d65aa2313fd869754505894ee564c653cf8d56382392d79ce8f668be8a40051b

    SHA512

    8120524a682b2665b605b561f80cc19aae64c6b5bc3ba7e9d62bc30b17becc9f7fdd750cd69594c3248488c0b2dbfab8d3cab4f08ea7c8ff8b191ad911e8832a

  • /data/data/com.shouldwant6/kl.txt
    Filesize

    54B

    MD5

    21705eed069c8da947d040761f11d19e

    SHA1

    910899d1ce61700cfc43749b27f238635c45c2e7

    SHA256

    5638227cb696b552cbda889c43735ac80904cbb1e61c056fff459e68db4c5c1c

    SHA512

    33fddd35a0bb696066a353f22ad5ca2382b46980821e71dfcc19440c083abbb51a4ed575794fadbfa2b6c9bde82ce5e942d487e24292398e453070fd6f746640

  • /data/data/com.shouldwant6/kl.txt
    Filesize

    79B

    MD5

    9097dc69fabbd26db6cb655bf59cdff7

    SHA1

    df25f4e3a389696143a0c81b51a0de2634bcba4c

    SHA256

    48843ff0df78dab775a7d349249f5d870785ed4f7fb65e4132b0ca5db1c3b165

    SHA512

    9c643afc2febed4158166bb235e5b2a368a49a40da02cc9da87ba318f3f27cd430caf5ed45f8f07a961febb204b1983a4512b025c9777eeca55c327c9593e5c8

  • /data/data/com.shouldwant6/kl.txt
    Filesize

    63B

    MD5

    5a9be16711c74e5bf3e19de097d73c2c

    SHA1

    fadb1f2f799c5dec565a149ae7b95d7aa57a8bac

    SHA256

    7f181cf8f0f2aecaf00379b0a3ae2f232582c0dfc9e12226411c629cb9d5f98b

    SHA512

    99a0f2a0368e9b3fab5a1db8e8256522b6890d544f07a7d9fae9e8112ec04ae238e22e6eb2b1ad4360e5fe922281a614ef888b22d5e7e8c7819dfa0d2854e0b6

  • /data/data/com.shouldwant6/kl.txt
    Filesize

    423B

    MD5

    ef6cefb2653f28ab75e738a865174790

    SHA1

    f3c5e81a9ca36e4d447af699a032aa69c698960d

    SHA256

    7a72c92715e88b677acb48f6e831bd3db7d4ca5d3379fd90bbaeb6fb984485c0

    SHA512

    6c73bdcdcbb94bb1e2f3982e65086955e0633db89ca204a6cc1e9b22be3db28382b9d3c2d7c76fca3eb19f4be8c015da8ee815b8c8ea5987513de19c1b274247