Resubmissions

03/05/2024, 05:41

240503-gdxcjsae6910

01/05/2024, 22:00

240501-1wx7caha7y10

Analysis

  • max time kernel
    159s
  • max time network
    136s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    03/05/2024, 05:41

General

  • Target
    b07516e8562a838535fb5cdca22216647d4de9d88906eca7f4abbdb2a220e847.apk
  • Size 509KB
  • Sample240503-gdxcjsae69
  • SHA256 b07516e8562a838535fb5cdca22216647d4de9d88906eca7f4abbdb2a220e847
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • octo

C2
  • https://adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://2adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://3adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://4adiletasarim.com/OTM5ZWJiZGQyNzJh/

  • https://5adiletasarim.com/OTM5ZWJiZGQyNzJh/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.shouldwant6
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4243

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .qcom.shouldwant6

        • Path /data/user/0/com.shouldwant6/.qcom.shouldwant6
        • Size 48B
        • SHA256 b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
        • MD5 SHA1 SHA512

        bsmnjkv

        • Path /data/user/0/com.shouldwant6/cache/bsmnjkv
        • Size 449KB
        • SHA256 9970f0d6c949e8b32cd922149a77f03a595f5ae6318f37c47af520d1a68898ec
        • MD5 SHA1 SHA512 SSDEEP

        bsmnjkv.cur.prof

        • Path /data/user/0/com.shouldwant6/cache/oat/bsmnjkv.cur.prof
        • Size 370B
        • SHA256 d0bbf6550f454c474b47e30e915b4fcf49e488f2c5f6b5d95fcabef1f68ab333
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 60B
        • SHA256 fa819ec83f4aeb8e7bc553f3c46343f78a30139326c2daca0c25544bef9f2672
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 52B
        • SHA256 3c0b0a3fe309e10083f34dbac2bfb619bc400e13c3b9e962a02fd1386dda8242
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 70B
        • SHA256 12ebd35931d0405e0e8cbdf01bbb5c8a8c735fa3d43c5250e25f6eafdb3c37ae
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 55B
        • SHA256 efc1e77eb56274a948ffcdaf24c8d316ee4dc6dcd72b5955466ab78fce7f4b0d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 45B
        • SHA256 cc4f6ab5701dd5fdb27c9e8c96941949effca66a8ca4a9a29092d144de3af0d6
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 70B
        • SHA256 f8f504d27e3256fe50df5da94845663a4d6aeea89849ebf56ed790ed81975633
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 45B
        • SHA256 26eaad58e1b3083623079528c381247bf7c9a90eae4e96e187e569145543e0ca
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 79B
        • SHA256 911744fd261badb8bef8bb0343c4b246d6ba28e2d7d5d3ea8a358181b8dee4b2
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 490B
        • SHA256 cbab21d6e0e7e1f3106d2f62d9930c0156ecf96c77e9a98a2c04f51a07269ffd
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 45B
        • SHA256 6f30a98bf864f70edaa6268e775ef8ce10571faa5e9651da60e4f8dea56438f8
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 70B
        • SHA256 3644a14861deb125b2ca1d30d4d0c9d1a8cb0439804af6bcc3c4c665d681ff4d
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 70B
        • SHA256 3b1cfd04bd01c2f35298ba8892ca15d8cc8778b6639bb5aaee46be5ec223bdf0
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 84B
        • SHA256 fbaed5bd8e740a2e4e2983bdacb664610d40d79f8fbb2cb8cf8611a063029971
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 68B
        • SHA256 f0f35b5cfb4367d6bc0c5956593124d86c91ceb870938f9041d85e296212683b
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 68B
        • SHA256 9f2e26aa937121c200d5ebe1851f5a00d6f2da1fe60a303075c64c31c48aac32
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 214B
        • SHA256 bc9b2712c58b17304b93a140b020445ccbeed05917da1b55d9ab5868e28b40ef
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 60B
        • SHA256 93a1396b1aa63aa8422d642e860fdfa6468a781f0261f9a26bfc64be41086041
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 68B
        • SHA256 9e64fc83e52c846b2973e6c518411a7f5672a9f6827f6ac3702ec5fbd2193df7
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 214B
        • SHA256 a3f276f4d2875c2ab2b246361b738a9997cd7d515bc054fc943b73dea94c0335
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 54B
        • SHA256 0b8d55a66dea40026215edf0fb29abe0598eedd3845cdf0a52b3861605ee82a5
        • MD5 SHA1 SHA512

        kl.txt

        • Path /data/user/0/com.shouldwant6/kl.txt
        • Size 68B
        • SHA256 0b763d467ff832997396258daa2ae2749b86ffcb4abd45737bc6cf4917f9b2d2
        • MD5 SHA1 SHA512