Analysis

  • max time kernel
    152s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240508.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240508.1-enlocale:en-usos:android-13-x64system
  • submitted
    09-05-2024 22:00

General

  • Target

    5431c95fe02893244425d7cf0b7b5749876372168341a1d364ef504fea509d5a.apk

  • Size

    517KB

  • MD5

    218eb0fb962346bf439f9ec33989784a

  • SHA1

    88020a37f466fd49a0ef7bfbea05ed7f684f285b

  • SHA256

    5431c95fe02893244425d7cf0b7b5749876372168341a1d364ef504fea509d5a

  • SHA512

    79a62db45653b5159e75523eff446a62231cc5bf0e78b475ba0978aeee202a92b31136b61a54b8e0a2c979b55ce2c2df84fa94fba2ff19121d5b1193faab09fd

  • SSDEEP

    12288:34n2ilZnhPThAiPD8OkLghtaNo0/CZa6MKDCO54s06Z:34n2i/hPThzPD8OkchtuoSCZaWmO6sBZ

Malware Config

Extracted

Family

octo

C2

https://karaaslancamping.xyz/MjE2YTczY2MxNjA0/

https://karakutuoynlar.top/MjE2YTczY2MxNjA0/

https://oyunlarlemmi.top/MjE2YTczY2MxNjA0/

https://candancanda.top/MjE2YTczY2MxNjA0/

https://kaderdegulmzx.top/MjE2YTczY2MxNjA0/

https://sevmekdeacilar.top/MjE2YTczY2MxNjA0/

https://huzunluponsimm.top/MjE2YTczY2MxNjA0/

https://kaderimyaziklar.top/MjE2YTczY2MxNjA0/

https://canoyounları.top/MjE2YTczY2MxNjA0/

https://mkkaoooama.top/MjE2YTczY2MxNjA0/

https://sapplamacivatlaarı.xyz/MjE2YTczY2MxNjA0/

https://ataseiorunaa.top/MjE2YTczY2MxNjA0/

https://oyungouardman.com/MjE2YTczY2MxNjA0/

https://sevmenenenaaa.top/MjE2YTczY2MxNjA0/

https://canozturkkaka.top/MjE2YTczY2MxNjA0/

https://biggiyenim.top/MjE2YTczY2MxNjA0/

https://cigkoftebedavahizmetim.top/MjE2YTczY2MxNjA0/

https://vasathastalari.top/MjE2YTczY2MxNjA0/

https://kenedabirnumaratedavicisi.xyz/MjE2YTczY2MxNjA0/

https://kediseakiyoruz.top/MjE2YTczY2MxNjA0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wantless7
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4262

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.wantless7/.qcom.wantless7
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.wantless7/cache/oat/sjmafccglyaqlb.cur.prof
    Filesize

    367B

    MD5

    a0a1ec9c113a352237117af20fbe2e4d

    SHA1

    9a47bebe371f63a3415d9cf0e23023578a4ff956

    SHA256

    a38811e0287c7348e12b85a41488166a792e7701cdb5c34ef7e13adbc9d7a2b5

    SHA512

    ce220864f8e0625606c4287a0c41a5fac7d7404d1a24e0bdb51f128117f3a7783bf0e00e254000ad86745b1d4a833633db98e87499fa0e22175c28e310cb249e

  • /data/user/0/com.wantless7/cache/sjmafccglyaqlb
    Filesize

    451KB

    MD5

    609cd45af3ba82a4e0051575b9bff5e4

    SHA1

    790ff88a2766e4ae24b182e7640426053f66d34f

    SHA256

    e9dce8bab315d2ece8a709e8246e744260c6009adb23f8c5903d2ba487c081a6

    SHA512

    39ad25da4c5d284e96fbed4b78dbbc2cc6115cf5193ede1575dfc98ad6f42e8f28567deb633f037d2f113b4f16b71ec02c33d4f195c83b66f05f489cfc84b258

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    60B

    MD5

    24f78eb18a9c43945e1ee7f277e7aaa4

    SHA1

    07a268d9578dbcd8fdd1555eb23647501a841cec

    SHA256

    e06ea93540aa50fd66b169d063d05b45f9cc355e174e2cc8d0083908eabb68e0

    SHA512

    786ad1d1cd4db5b07586729f23227686f4e581e096f05c63ae1552eef2909bdc275244d7d64e490f0fbd08c4869845670d4812cd12906d1f4d466e0001955fb7

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    52B

    MD5

    f993a617e3c502d17898367cb2fba9c7

    SHA1

    2f9e5e38aed4168858661e62a51a80ebfd3be3ef

    SHA256

    353997a4de81d5527f6fe8168e2a7dc060e13285eecae95b29f22f9b3f489fdc

    SHA512

    0965c44d37b8659b3c4afd3ff43aa9df452e5988506f0a84126641cfd028125ada9661b0eb4990729d3c855f4dc1293278790dccb684da17492f23a1475a2e92

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    70B

    MD5

    d0a47436db4a644bbe836965cb35c715

    SHA1

    20439b4a963c5254e484eb799bddbe578a37093f

    SHA256

    d5e63e66d7f22494f4e7785c08ac7c9c863de088855505c364889a57f465207e

    SHA512

    35f2e0d115d85d615867e5d4564efac263c08fcdbf8f8db951042013dc7ed36addf689a042ba71b323e5d35059c72e7f0f558fd51899d024b5ed5c07f5ca7d5d

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    62B

    MD5

    b0327193c811e7c4521b12d249ec8da4

    SHA1

    5ff65accc54eeda7a563b065091d5d978a531c72

    SHA256

    47d05b171e01f260176fa0fcb77fb2306eef73f24486a004aa19c06688769a98

    SHA512

    8befbf8ced757d0896fb85eb28839c64a3946e5d8b389f37a61757b3c889c11ecb3dc62359f26268c74fa2204d33d81335ccd56398fff026f09894b20c99cb5c

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    70B

    MD5

    4e4d00137466c6f6dee0a90155a5b4fa

    SHA1

    1931792fb8a21fbf7fd73a7b1df6f0e95592b9ea

    SHA256

    18bb6791c255b7fbb368e6172a30a7c4c0994cc588aa43669599867c344a2d78

    SHA512

    8d448fbcc86efdb9362d19c8973abfc018275b173e5dc5ea965cb781b72d377aa3ecd01963548885dc9a92fa7d75ae365a4bd9038c0564a79c4d8749d443d301

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    79B

    MD5

    f582598b732daf63087aee4f95aa1aaf

    SHA1

    14ee5b24df1bfb11b75e81e88ea98920f7375b74

    SHA256

    c413faeb5bffa0eb4b3737fe5ea022bfcadf3db602dd3332a7ed1cc8d09c5dca

    SHA512

    9cab3260836643b78f401f94a9e1a58ef988ea628edfb1a3004067f570fa67aa301b459aa2708f37dc40b86a232af7a1f611ce709865025a24280658fb4c8954

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    504B

    MD5

    117d360f2292ccac85ada44d8ff6559d

    SHA1

    7c32237a5f73a2b635cdcad53a17f04926bf628b

    SHA256

    947cbbf1e9020e2e15b47a7e5b8c1212c044d8065136371c4f4188328cb4c2cb

    SHA512

    31682c82831af1aae04ba83f84467f3a38cf80e4358d9d29d9a66e5c89486276cd3c08b544e89766c31c976dd5bb7a8c86d3007d67e36343d24672383f77ad3f

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    70B

    MD5

    bf9881a9f56d31dfc3053be2be36a38a

    SHA1

    6f000047869599db48aa350d37de4840946c2bbb

    SHA256

    6a13112f50b50732279687e653ca6d8a208ba145853277df52ee2da1acf371d7

    SHA512

    9044a9b8b1c23947c2d71ce872fb35320433997dc5b96bf9c7654aed78f04480b4981f1ebf91704d3b24ca562ba17d6b29a392e2ad024d272b0af8ff1ceba9e4

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    76B

    MD5

    15b56d4f0a9c6725a190d2c99bcdf6b5

    SHA1

    5f814aa492b891cb36e980f6d8e6b6a4c77275e9

    SHA256

    0b9dd9f33cf9ff8947f520ac6f06dd9061c8d64e571c900259a6a41a87f1feba

    SHA512

    3e0d4b6cdeec9c4ab70b0e23673006267b8201f81c0cb1a6030543e0530a3a5cc3a346a92be8eb910c448b9028a1d8e4a91a9550f67131e15063102fedda792b

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    68B

    MD5

    620f0b7238684003f515c8338ebdb9d0

    SHA1

    dee4e049bdbe57fd71bf37b1592d122d46170545

    SHA256

    f3ebc4e7583b30c87451b7e6584b1ced00fdd51839ce93d1d5bd0416a8063d70

    SHA512

    38de791022076cfad0cbf5a2a84538141129a818afb45850cb3c13f24eff7264f16f70be301ef2fa84b06de7db25144b7a750b6ac013caa7e4a734bb8777b44a

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    70B

    MD5

    204064b35837c0e7da54f0798ff09b2d

    SHA1

    be5f8b87fe37b384911ccc948a2e83e5b5e2a77e

    SHA256

    e1eacc4eb599d87c03aac362bfbf78a7e22359d8d3600b78f8a377b0a2eab833

    SHA512

    79d5636594eb4a1261ca3f0b70f8e2e0fe69828d7cd08dd376b3952e2c44911b54041522e036dcd519d814b117bbb45cf5d3e79023b49206b4396f88996a8fd9

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    72B

    MD5

    e045e33f2b8e08449ffe546b5c546a30

    SHA1

    9075dec3478aadabd014dbf0055d8dbc216b7f7f

    SHA256

    1fb214b74527fd682e1529b0607f31922297761ff681f3abc8dc42ee5fb38b7c

    SHA512

    0b9fc90035e246a591b9c3f63eacaf2edd75bd334862f7bb25dd26142b6fa0257bdb7165db971f84611f55a66c7919cc91cf65effc43ab636f42d0d79d124797

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    76B

    MD5

    44abfe4e979a02c7dff09ae78623b2f0

    SHA1

    3a2da954af42a9ec9850129b81b583a6accdf932

    SHA256

    6ce1efaf75710ce5a64893339768d5d55218cdcb74a307dd80992284b52312f1

    SHA512

    f819fd9012cfe75ddbbc9ae559784bb2eda389a2f909ed6c1c30ba071e56a00d4c3e42186d6cb1a875fde75f4f6d62b05aac822bb7673899dd88aff5387f3c62

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    68B

    MD5

    52f82356dfcacf5765c958a10b3614d8

    SHA1

    86a99eb02be85f9edaa032e8ab4de632df12e281

    SHA256

    2f43a9936d631c3f9919f99978a73f53b2d56064ffcf319b55c0b866587192d6

    SHA512

    061e8a4a3260cc80cb865209cca83fb52d85585fef213c47fcd82f53109505f346f9a92e4f92c0c044ff6b5ebc353e8ce18ecb095f0cee07c4aa8d2f57816100

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    221B

    MD5

    5a6f90f7d85d78dd352216eb3b28def8

    SHA1

    6ad49f31dd787e343e754a91cc752ec58e6540ee

    SHA256

    3c9dd1d46345092d86378a9ce0613582cef779e1ecf1defd4e90f487a53682e6

    SHA512

    545854793e2fd971a085f732c60ac5fc140b81e80b9802262b240e6f52bf28b34a9924ec6b0a55e0e8e8df1cf5eed85017f86bb2edfaf1ebb1287840234c0d1e

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    60B

    MD5

    040f8c8d41eee1e4ea50a21c0e3b3c01

    SHA1

    45edd8e4e460fcca3751cf047c73d8d90bd447cd

    SHA256

    7df7a055806210d100d84ae8942445790ab93b14c2ef7ede7f34d00f478fe555

    SHA512

    b94470243d4d2328681d974a69c2a1d71d53d2cfdca8302369d7839e4b4caefac745ff5e941b7da16fce02fc81882607c4514cb65595e709266e163055be2041

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    68B

    MD5

    03ac50c80335e3077bf67632f07a65dc

    SHA1

    7663122666c7010fbd86425362f388c14cbea018

    SHA256

    3c3b49166a85dfcf93c35ab83d771b85c4eb4082894fea02ea8c007b06ddcbdb

    SHA512

    c7e2910bac399239f2fa32cce8c06d305773332b3f580c85c3692f090561c61a1d8195f82019f9ac1b824f0a8994f21dcd920e8a50a7aca2ce7781f10cde2f1f

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    221B

    MD5

    33a7890718446635655d7968b1508a0a

    SHA1

    cde8d376e3ad5f26f09f84c233f8783276e96415

    SHA256

    9f516eb08036ac73f36521c4287df32a757792c01f35f979556edb68b4ceb78e

    SHA512

    ad6384e9762a79dd92ec40b173aed4e15b9833a3295f15ddf36b374fe0a804f7ee876c7d7abf5aadc50b86d0618a5e7fdabb2413fcfe1aee200469b5c40acc90

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    54B

    MD5

    6fdc1fe32d1b13fedc9e10ea21e27c7d

    SHA1

    128a27737e8dbe952ca2bc697dd2a47a084eba26

    SHA256

    000e6a33cf176a3033dc553e1e24d6658c00bad0c11592675355a7c3365d66c2

    SHA512

    f2b398feb064b63dc2de45554d3aa8cc523aed09430d9bdab017a6061d369d74074bc28ed40150146c32b29d86c0145e9ee7e30e2ed7fbf9d2f07a976f3cd34a

  • /data/user/0/com.wantless7/kl.txt
    Filesize

    68B

    MD5

    ef68b1160793fd3d52954fdcab51cfc1

    SHA1

    ec7a04eee25d17053bd591ceafcb45240a0aa92d

    SHA256

    abfe79c757391c86195cf84c34aaad0f2fac69532d1154dffe037e8152558712

    SHA512

    dd234c372545750ff1aa0b36029ed38277569795a6db056e5954f08eb58a56079da7f2fa8ea10bc591ac17781c9e4e21de6a88b896addd268bc52da78fd4b3b4