Resubmissions

03-05-2024 05:42

240503-geg91sge41 10

30-04-2024 22:00

240430-1wn9faae65 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03-05-2024 05:42

General

  • Target

    37b24f726f18682145efaded790a76fd95417898f383a5842f980a8484418e6f.apk

  • Size

    521KB

  • MD5

    16f8daf22ed3358f466ded48cd92ef9d

  • SHA1

    7d4c61d69c2ef9633a9a65728223fbfcf144e3ff

  • SHA256

    37b24f726f18682145efaded790a76fd95417898f383a5842f980a8484418e6f

  • SHA512

    7e2eb8899d8ba13ccfeb87217b647becff870b65a2abaaf4b15df8339becece9a94fecbefe144d30c6379f77f1d2c1805f96516cbda0d79530469ba29aea9671

  • SSDEEP

    12288:E9ybxTrJv6dUnVmP2NetPH5kEeSF7tNbUbAnwDRS:rbxTrJiOnEP26P/NtK0n9

Malware Config

Extracted

Family

octo

C2

https://maraksatandas13.shop/ZDQyN2NmOGEZOTIK/

https://teckmarakbads2.shop/ZDQyN2NmOGEZOTIK/

https://teckmarkanary1.shop/ZDQyN2NmOGEZOTIK/

https://teckmarkanmdas4.shop/ZDQyN2NmOGEZOTIK/

https://marababrtdas.shop/ZDQyN2NmOGEZOTIK/

https://techhubshop24578.shop/ZDQyN2NmOGEZOTIK/

https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/

https://kemertarladakal.shop/ZDQyN2NmOGEZOTIK/

https://kemerdastarladakal.shop/ZDQyN2NmOGEZOTIK/

https://kanarsdmerdastarladakal.shop/ZDQyN2NmOGEZOTIK/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.orderslowzez
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Obtains sensitive information copied to the device clipboard
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.orderslowzez/.qcom.orderslowzez
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.orderslowzez/cache/cmnbkskb
    Filesize

    449KB

    MD5

    56fbb6aab4884d17d4760a19eaea8eb8

    SHA1

    c5e03d9a83bd086ce8015cb77ba7f05cc16433ce

    SHA256

    80a5b9496f2b637a80ef8cdbc5a46a9dae705e76c4c203b687aeaad111bbc562

    SHA512

    7e4218f20289ce0f4ee26788e2ea73e4d69adc7984e751d4fdc0a1875a3ef769c97cd0fbfa13a6d255679a7c2f8b0a62db13b44b811332dc23093dfb84e93f8f

  • /data/data/com.orderslowzez/cache/oat/cmnbkskb.cur.prof
    Filesize

    332B

    MD5

    457fefa5c6714791656ad0d9870007c3

    SHA1

    69725cd9111888f6608b20b55e4ce4e58f2e5e56

    SHA256

    2e4a9d6022693cdaccdd95d93a6a65e79501247b4c96dc24c88acb8c3ebb2878

    SHA512

    677b752695f3ad13e49b20b8a29820093bcfa42b4884b04d200c4c0eccc3d49d3ca587204ea80879f503b8765627ced464c4c76793d616dc40c8891c47a6b8a8

  • /data/data/com.orderslowzez/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.orderslowzez/kl.txt
    Filesize

    237B

    MD5

    6eb06a66397853234674ec78eada03a8

    SHA1

    3fa7402436ba5255c76a827eba18e5cae7d15238

    SHA256

    2a97487eedd606e04d78a3a6bf79f7cb065b6a06dd0eb38379e6bb9a4f609e7a

    SHA512

    524e5e2ac4061de6271936f71f383fa5feb3da6506e57afb5558f666c0e8cf8fd778e81d6b23112845686b8fdc30ff1e13951391b15d99fcfec3bb55f3b53cbc

  • /data/data/com.orderslowzez/kl.txt
    Filesize

    45B

    MD5

    f8f546dfba3569604ba52c7070696f4f

    SHA1

    74fa30a7b8f694d68a1f56ddef509213855d11ab

    SHA256

    31ca48a124fb6cb7aad1bf4e2978672338ccc7e3e6130ad2039ec10bbe685980

    SHA512

    9f626977740d72c9aa1daac71245d9c99961cc8f50c9d06d32919378007616db3218bae08e8c70b2f9b3d90a2756603dc1c6d75c4e5586590e575302fbb85061

  • /data/data/com.orderslowzez/kl.txt
    Filesize

    63B

    MD5

    a7af51b8e045faa7bdf8f59e7f6bd1ad

    SHA1

    2b2463c341d4748316eaec673b82d52c2e5098e4

    SHA256

    d499ca9a7b6c36443cc5dbf1ddeac1cc27c6ba824ebd2e97e08222cf1ad8ddf7

    SHA512

    30b9699a6f3948865d8c02a1e38f9aa95ea6ad275c4720663389de0a980e6cd85f78d1fb6d8064060197ecfb511c80a668a1690231e9b606bfb18ed589121758

  • /data/data/com.orderslowzez/kl.txt
    Filesize

    480B

    MD5

    51664200cabd756031d910ee9a870f24

    SHA1

    2b51a4079a822b4da8086ebe7cdd4cfeb40bee76

    SHA256

    ce3c526c75e19125da4c98dbaf3450c55d430788dac1c239d11f7efe94f216d5

    SHA512

    233497d4e01ee28d6f56e8b8d0dd42fb694f39c4ef4d73c7eab7296c5b67354dab67a86cd05c8dfda95382a5bf23b322e3d3c207ca887a1069fd73855dea5116