Resubmissions

03-05-2024 05:44

240503-gfcqxsaf45 10

25-04-2024 22:00

240425-1w26asff8w 10

Analysis

  • max time kernel
    158s
  • max time network
    135s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    03-05-2024 05:44

General

  • Target

    0731c88a65d3cc56ff1103f8a94b80cc73a5653ba212adefb33bf3fca8b9d307.apk

  • Size

    541KB

  • MD5

    db012f28734d0babfd918a75ec5254d7

  • SHA1

    f6eac5da9b363d8e0741423b9fd832eaec0ab56e

  • SHA256

    0731c88a65d3cc56ff1103f8a94b80cc73a5653ba212adefb33bf3fca8b9d307

  • SHA512

    3fd10889d6ef491af942acef701074b618c73f9b23f3a2d4d6cd009c9e0e6be4ea483ef9bed4f0e445e11e2ac47a4a7d8cc2b5dedc79a961dd289af4e70664c1

  • SSDEEP

    12288:JNNRTc8IBupLB6s/811/Ng9EtjcJkY6tdeDrzB7yM6nsN:JNrTc8IBSLTM1lgm5cJkY6jWrz1yM6nm

Malware Config

Extracted

Family

octo

C2

https://33moneycshlazim33.shop/MmExODA3MDAzZjA5/

https://moneycsasfasfh.shop/MmExODA3MDAzZjA5/

https://moneymaskalandd.shop/MmExODA3MDAzZjA5/

https://moneycsffhgm7.shop/MmExODA3MDAzZjA5/

Attributes
  • target_apps

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sitcenter7
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Obtains sensitive information copied to the device clipboard
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4243

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.sitcenter7/.qcom.sitcenter7
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.sitcenter7/.qcom.sitcenter7
    Filesize

    87B

    MD5

    69ad9ad04a5fccb41e8cc2c561509112

    SHA1

    8cd378c45e3a981424954af511bd5aeffe5b56ed

    SHA256

    eb742ad88f74d3eaaa5d533ec5e8bf5e6676d54c24dd84733b5fc68f9e9bcaf0

    SHA512

    05987763f08b703f7bf67cfdd78b75c5fe502c37d4f8c1487e7bb8da8c04b1f31192393a0f635bb28243f42d51be4f9dcb94e7e3e71aa3827233e558690b888e

  • /data/user/0/com.sitcenter7/cache/oat/ugriqvnh.cur.prof
    Filesize

    396B

    MD5

    626a944998b99aa6b272086542efa839

    SHA1

    c88eea96002fb3a896aa8075beaad9ea955e7304

    SHA256

    8392d73ec0f6c1a7debcde6e59921ba78d816fe7de93ab9109e095e1ffe7cff7

    SHA512

    334e89b94c3ad78e8e05bda437ece501246d45ee171cdb8328c892a4f061e1da1640e4d35e9faf9b5df507902e0f5c396146a64ca6912b8432bd2fe0fbffd0a8

  • /data/user/0/com.sitcenter7/cache/ugriqvnh
    Filesize

    449KB

    MD5

    009527e1aa59963676448448f61c7467

    SHA1

    f36ef3b160e4faa8fed7cd1fd00b7215388c67e0

    SHA256

    d4664f0fcae468af5cc0ff40a283cc778cad25cec5b1a00fd8f0d41aa97f387a

    SHA512

    72501487eab1f574f61959da3eab046d389342a63aa8f319ba34329712a6d0dea416fd8ccf70a28588368972b52c05660b82c61bf9defbcd3f0ca61da6731a54

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    52B

    MD5

    b689f33e6f486afba7026520bfe34cc4

    SHA1

    f677084f1d63933d7eb55d64dbb3579a3e95d19c

    SHA256

    caaff602e84e7bb493fee471f195f69bdcb0077abc86d7b0f726ef98e6ba88ce

    SHA512

    d331f937c6ed073e6f5043a694e83a9bc59671e154edaa8369808fa9f9f06966a1fe426dc1c333d211a4b15335f6d93bd59e257084b07023881cbdf1fdf61caa

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    66B

    MD5

    2763fd6b6ca6cdb85df7c48e4a0e3c44

    SHA1

    a535c5065d551aca60b1e738d4b594a28216cc8c

    SHA256

    6d6592822d78dfb25cbbce4f01c5ba857a65daa560f810cce4f644d661134efe

    SHA512

    0c3e1792817eb0b561041e11aee37b6adc7a5672793d54b1ee29d6ddba50937a8b424b07fdf07e104861cba32b7cd868d6249a8b875591d03a4a08c71eb10067

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    84B

    MD5

    9c87194eed7a83ae3c7e43c5c980bcd2

    SHA1

    67fa6c266b76a25eb2e24469f39cfa8722a0d448

    SHA256

    e184aac7830b8fa30288153f519478cb2053879ba258d8b447269ae0b4b15231

    SHA512

    26b199fba3af13f4b322bf2b8d1c76e5d59bfcb643c648f04ba685ad1382c7a0ebfb48bf719845265920defc0bda109a21640ff56a2e0a0e9353b27ac3c175a8

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    85B

    MD5

    61ba791c954539deeabf414ceef8e401

    SHA1

    228889600b3b5a1083cd949f23cd21c080472fa8

    SHA256

    d86bf0664c6c1492dcfb769103bb048b7e945d7178901424823d03f4f5715216

    SHA512

    e7534780da874a6d76a8d8ab4d2a72385bf00e0192826ed0560ef87f7c2b521d2db85c438b17f526661fba1492134ee9011ef49b00c05f06d743e34797b178f2

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    68B

    MD5

    e45b5dbdc40e7ae11a4d8143420aeab2

    SHA1

    1f1d14eb062f0ad54b86651abb0c7e2d1ed0d6cc

    SHA256

    c198a45d37e38a2c1e125a7dccbb89bbe05abf56b6ed5b5f0fdc4b770c615685

    SHA512

    18a4dd58a79f9694d85d01f4d804d397a518d3beff5f5936ec3bbf02c59182449fed9bc84681499c02bd2d7fa9c9173b7a5809b7bf29e15c35955635d56f0980

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    60B

    MD5

    c66160a2849dfec2faf7adffe07330ec

    SHA1

    6de6d5fd27b02b68cedb61169cfc6df5488ec811

    SHA256

    ed3ad9681587e799236d60f735e38ae027b2f54e7084c4d0e2f4c6750a5adcb6

    SHA512

    6d0a3398af9f9c86821de7548f94a8832054b3c53dddb6936605b81dd8bd71f3fd2b9295e80c021f1754389fbed1130203dd49c9eb2f07d3d80664502966c369

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    52B

    MD5

    01eb9e465f5842295980b4c7c954df9c

    SHA1

    798fa717c5cdf86fc092ba72ed241789aac561eb

    SHA256

    91355c68850672d38a68b098819b580aae91d24d1e7fd0bbb58cf5044395c327

    SHA512

    746176b09a30af307e3895c4d825232c16c2a1d645aace8f377a171d6dcfbed18d185636487f16ad520ea6a95c4f4bca4925c33987fc6d8970cf98e5aab2aa02

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    66B

    MD5

    b1b392d6266d43dd321581aed601dac1

    SHA1

    30c7fd066886e9f91ffd17e778c4b4149a3461ef

    SHA256

    e30de6a2b9e84dc9980f842b1e3ea3ab1c487667ede124422196350b7bef22ad

    SHA512

    79768bd2a59c3818df5f5810bd845515126eb9ead27d658376cc03b75cfad36a3968d635e56f8e83604c62e6561bdb91cfa94a008ad9ea32051a40e2fac17f58

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    66B

    MD5

    af9ac31331e8cad957bfa2d3e2ad9327

    SHA1

    caf41dfbdc57d9586f8bef15b1feaf0030ed678b

    SHA256

    afa51ac836d657423dcb825ccfd3d181833515649d4a41ae898e321f3124272f

    SHA512

    1366f9e5fc6933845d355ec25df60f142cecfccc4d79ee5e884c091f54331058eccc49db0dadde61e7ab3c14941738adffc721b54b0b08374eab328810d0454a

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    68B

    MD5

    bb1f4d8005cc5bda9ec6b453038184b4

    SHA1

    3af1ab031d0e167dbec29dbbd3cfa500a40bdcce

    SHA256

    eceef7bfb3484b1f60f006aa4a91c094f4dbe96250d8c6f4948a7cb36038c154

    SHA512

    f1e909d40917139123a54696e6cfe75f13e4d563debdff27a9bbc74f1e02348accda27a65d413ae287aa0724798663f8fd9f9c6eed9a46e7b83dfe1423b8cd57

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    60B

    MD5

    004769a786b192cf1efc4b8640f4ec6a

    SHA1

    ea174865c510cb05fd911a59c2825274d550162d

    SHA256

    ea84929d2fb404c6ca0074e3c25cc3327e525f9fea2789eab49fa3f525863f20

    SHA512

    d0edd3495c8ba576f5b73b529e044af13c748e21b5d79d7843f4250ac0582c02d4911aa82a22abe2606c93a914838ed9c2c174779c481207a85d50f6d8df6af9

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    52B

    MD5

    173ec6e52fd74546e4e16ae1b06f0da1

    SHA1

    714a5aea4c3088b4ea7879b48a849ec3d3eecc56

    SHA256

    c7cee3cb8a895c7d43b31bb102775e2a8c4560d3e93803ed0e42b1492b698b7a

    SHA512

    9ba629a50a864c3fb1e288ff78ba494655428168a13e6e18ce6032e4d29c8aed7ada475d915a98a549a6c7a19dce21092c8e012683841159fa7a8f635cbd6da8

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    70B

    MD5

    cb5a623b2d21e793a4fdddccb56272b0

    SHA1

    ce39a507429e5acdcb7a580456a2e2660343ff9e

    SHA256

    7dd7108158b72636b17778fa9a039080922899f95e529ef9bae861fbc7fea337

    SHA512

    ff5f14fa81eb7134ab409414a432896f9610b1695c276e3ff3228a6f8a4b4b7a5b5430816781670aac856a410d08faa09cb55a4ac6d08bfee546c4cda4d5cb44

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    55B

    MD5

    58f1a3011b41d269d1daa171d7e4e8c5

    SHA1

    cad8944d75226fa0e0021e2fe0e25f7d1cda7726

    SHA256

    91f5f141cae9973edfb1ce4aa968a579b6d69dc6087d9bc7c1cc58177f52724f

    SHA512

    287e0e7da356d9b332da72a247b11c6bd1291391343dfaa9f839d575e3d34676f6139b2ec83d9cc9099aaf6a3439f77770adc4382f9f5abf75781060b045481e

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    45B

    MD5

    678b33c767ac0530a49f768497aad46f

    SHA1

    6c1b1925385efba35cc4a4430cbbb0dcf7a8fd5d

    SHA256

    896f4a396a313686efdea1ecf2592abb2c1761040e6d605793c0acf69fb25fda

    SHA512

    571e41809c4bd1917172cfa0b92204e80cc9e58d429b74592b9563e507f02c293fd7799b14930760a0a6d8329f365fb8b9826e0e625a62758722017e108f9a44

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    70B

    MD5

    3bc6aa9d5a2f66b8a01fc04b3b943146

    SHA1

    d7676cb8e66d5ba5d55ad4c32b0072824463117e

    SHA256

    54679bdb8eee28958b54d4645bb1ea1145d87246ca12d6af86a567f037aaa72a

    SHA512

    647ba5da08dddda541fa30c22dfb2bc3095cd58adf9997edb4271ad7631824373019e279a30b183089bad0471d1336668ab00f826f2123034b25bd058e2ab232

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    79B

    MD5

    dd6e6205d4788ca27ec5d81a8a034d9d

    SHA1

    7a95687359e2f4af4ca5b733d99383b88a430246

    SHA256

    51ca4edb80f7b7cdb42a1c0acf570ac981e129979b1e679eca01d984d046c9de

    SHA512

    ce392532b4c05b0810b8774b20a649036982f13b522b0d8bd61774f7b653e45c239451e0754cff69c29a0bb97b35fc1bde27fb764d9f7b59fd94564586968840

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    490B

    MD5

    64c1123affdad3e8123cec13752a8d53

    SHA1

    787cce92fa674b5ffb27a6e78a0a54c36f61a6fb

    SHA256

    74c45ea779e0c866bcb5b95278db30c5fab76820cfe4a5c17679f471ec5ad910

    SHA512

    aa282e9049ce525f34b5dee38c7c933dc357c96b1b9d677e97e4314233f9a77d3a8c365c1dfed337fea87c9695030d65718b8a9a8d4c632bd8b9868367101bf7

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    70B

    MD5

    721ab07a016f045caf12681c9fcd2db8

    SHA1

    859f9bca189fcdf441c98c4bf47453952e3ef07b

    SHA256

    ad09ecd5089b216debbd36eeff52e1320f4488fac658347721025a5a35488153

    SHA512

    05ca27b8d3a128f9c1947fc0f0ab7693b0c5e5fbbee8333faf6cef5a1060b85b1325ea142f8cd1c9d182273288e438dcaf22fe833aa1581c02b3ec9ec57259bf

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    45B

    MD5

    866684ad2cafe4469c9b66050f220468

    SHA1

    bd68ee06d4a4e152a2a96226d703f1ed7cda6a77

    SHA256

    2c838b3b9dfa1cd83e7e1fba6b59c75ab921a75ca7a8345a7955a42d7a540598

    SHA512

    7fbf7dae0d18847f090de1f6a30c5bef2b433f0a571d8f1c588e05daf0ca634645ef32bc8f5f4401a1616dc5b4b55719715198c3cc89967373a5f810eff1f935

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    68B

    MD5

    ccff49a209f98bbc937628b551f0d8e9

    SHA1

    8ce5c39bb959727ac887de7acb9d128b5d1e8ef2

    SHA256

    79d2fb6c78d2fa688f4793418367657047fe9709837054f6c61b0628c3cb32b4

    SHA512

    1f5cad3cefb896e25066a0549eca1915f67126e84a32d07998c6fad4a958e19e9c02f6211db33179869086463006f7856601a9cb5d46d73dcbd1eff386ab5dbe

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    214B

    MD5

    8821b31825259c4668ba5ef2f8711202

    SHA1

    fd632256982f84930c75129d42123f192f5207e3

    SHA256

    53e9d9275883a0d1f00544384306d9e45a2dacf29ff06dba60a7ccf001455149

    SHA512

    08357c598f02b4ef0d07412afd3c02b05e080d9565af75e4205a3509ee8970c8b74216e9db203858696da3747f871dc75aba2b748ec5fa11b5a237833bed2ea4

  • /data/user/0/com.sitcenter7/kl.txt
    Filesize

    60B

    MD5

    b838c881fcacfa2152b245218271fa6f

    SHA1

    c8c386f2ab9be56176a0db40b4b97ce80ea0c007

    SHA256

    e4b5ba30c1394e03c4f2bfef0041ffe875622890f1ee24fe41bae551f0ad2b6e

    SHA512

    7b8951b0ee9f089ea57a194fd078f56875ed71579b4622f6a617e89cf964cc38b8f95ee52e4b29800cb0811efd334b796a864a4b1048decd55bf6028a3f662e5