Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240506-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
  • submitted
    09-05-2024 22:02

General

  • Target

    88499c1359d6c784174b6dfedba0d13a87427ca64e35bb6e0b62ae7cf3ab23bc.apk

  • Size

    517KB

  • MD5

    366a733c8017b9ef3cc09f50e7c825e1

  • SHA1

    5803d0119f2487bf827b913296eabea2c89ef02a

  • SHA256

    88499c1359d6c784174b6dfedba0d13a87427ca64e35bb6e0b62ae7cf3ab23bc

  • SHA512

    20d7f4cc86b80df606f25ea5114f8c72030ea7b3d3791811ac8a303d2704a1952c3016a393d00ee5d906aac33a35b18c88d50273a41b3b2cd57f28722384f47c

  • SSDEEP

    12288:SCz5jnPVuv9cpYWI5XMJ8eTN0dP3CD9bVo71nrifFnrpCHvTz51oae/sdJFX+SnT:SA5jPVuv9c1I58jTqP3CZRo71nriftpy

Malware Config

Extracted

Family

octo

C2

https://zirbnarg.top/MmZmZGVlMjI3NzU0/

https://jilepofk.xyz/MmZmZGVlMjI3NzU0/

https://wustyelk.top/MmZmZGVlMjI3NzU0/

https://mixylozt.xyz/MmZmZGVlMjI3NzU0/

https://quoxvebz.top/MmZmZGVlMjI3NzU0/

https://hifkxarp.xyz/MmZmZGVlMjI3NzU0/

https://dultzown.top/MmZmZGVlMjI3NzU0/

https://kervplun.xyz/MmZmZGVlMjI3NzU0/

https://vikexems.top/MmZmZGVlMjI3NzU0/

https://bontmawy.xyz/MmZmZGVlMjI3NzU0/

https://sirljufi.top/MmZmZGVlMjI3NzU0/

https://glaxwimb.xyz/MmZmZGVlMjI3NzU0/

https://fruljilk.top/MmZmZGVlMjI3NzU0/

https://zoxtneep.xyz/MmZmZGVlMjI3NzU0/

https://yampdrik.top/MmZmZGVlMjI3NzU0/

https://zorbpuft.xyz/MmZmZGVlMjI3NzU0/

https://riltshuv.top/MmZmZGVlMjI3NzU0/

https://vempyurt.xyz/MmZmZGVlMjI3NzU0/

https://hozzkwor.top/MmZmZGVlMjI3NzU0/

https://dyltwerm.xyz/MmZmZGVlMjI3NzU0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.marktravelrbmg
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.marktravelrbmg/.qcom.marktravelrbmg
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.marktravelrbmg/cache/oat/tghlzrdeisaq.cur.prof
    Filesize

    314B

    MD5

    f54d13e41c543a2563380dc99dba4d86

    SHA1

    e520859b5122435d5dfdf108e9b0002a052a7dc0

    SHA256

    cd16a053e8561adcaacef465c35c57f59d5ced426d72c12783e2f9aca9e15a30

    SHA512

    43e797c91728bb9fba060b38a3048f485f8cbe5bea1e63a7a33f1d919101dcd8ad43a15438801139899536fa5f3fcd2d64d56537e18547946f3423e9759b2d37

  • /data/user/0/com.marktravelrbmg/cache/tghlzrdeisaq
    Filesize

    450KB

    MD5

    7d9b0b0bb0b0370214b65025e8cf4f8f

    SHA1

    83d37543b202e5d361bf3510739b8896373fa4b6

    SHA256

    675dbf715e9ba1c664ec082d345303dc4440feaf5be49d5f9824730bea1dbc63

    SHA512

    3ee97cedfc1ef3c88d7076353b98b94ce90910d8839d0acdb447d8f1481440bbe634e7114b69b71677ff49f31df53ef6717d788400ebc9eda067353b07d7fa57

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    bbcf4f69055b2ae1e3245fcfd2e92dad

    SHA1

    d7f393f4f17b3749642ba6da56dde2860adad4bb

    SHA256

    767039d2b808e18891515e4e366bf4125c6cb20b9ac2a875251b9adeed5385d4

    SHA512

    22e9cb9063a188cc91c2b46f915e0f49bc00197814bc6a1444fe28da02f6bd5190ac7e8741507ea2e0ca5f8635b09d2094c0b00f1a7229abbdccf156c5d3c874

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    fee4f0d6ba2acce9cce7b9a855d6d68a

    SHA1

    b4f0a95c0508071c9d5fbb8f684425379dadf797

    SHA256

    afa0e8f5f97b6ce9e54dbc07e96ba3bcdfc27b8c20843371221f75eae96efc12

    SHA512

    779cbc34c71d6dfc268b7a908e4bb9820279f83b3ac6bfbe3b661ef2bea4323ebd158e7e96a3926b924301a2b14b3b88668918aa839cf2ff287e9ab837662fb7

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    7669f22462bb7b4b5fa4482692ca94ab

    SHA1

    7a8465106d263a16ae7790ffb7bd3f6e448ef7ab

    SHA256

    1791030f2c9bb9bb658594fbe754dd497880f206e94407d5add5bb4472a2e10b

    SHA512

    554d077fc8a011fd647cae3557f103298491f87b20adff3c3732469efa60097514ac8cf561d0774002fa7b4cd0317a3e92ba6360d641f12330aec50b5b68c1d2

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    befddca33aa131ba8492bebf5cb59543

    SHA1

    98e4fdef41bcb24af77567f7aeef1fe2f3c183d0

    SHA256

    104ed52140e3940e16784f90dbbdd038d330fca342226446cc0115a79c51dade

    SHA512

    1f64ec6f41a85f245e236f076d868343e7b9c96db2b4d837497a3b480df26edd11d38bdd3975b7fdffbb39563d34d0e74a92634b43bcd8f66476e62bb9b4e8cd

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    251de46ca54e42ff25458e3c67d3cf69

    SHA1

    f62a07f780a17a77fc2b77064ded1a70a194d597

    SHA256

    775f3699156b5dbaf8818aff45712085c4b76f6c72cc77fe493ef713d32b0b9a

    SHA512

    b80e00140dcbd592d4ff4025a3236e724ce57a87aa9cb4fbb78898d187e3f0b6daabb4c12749b90661f425d06d630866ead7aecb858a6b905f30bb9a6bdb1a97

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    2f0eb804fef5c0f6ad9cdaddce08c81b

    SHA1

    55aba741da5c547b22d1cb06986b64c98daa882f

    SHA256

    f6c55c378593264abbad2e5633600878db7d8ba6d6253d166825fa775583e76b

    SHA512

    19a2ac86466e6e6c3f4e1bf9b6f171e7486cc6dba0dc81c85d74243c5ba6d3e693bd10e2a2d9ac5343505c531d362b1a1a1057a0e22b20c66908c2e0536eef74

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    54cd7ecd4a3cd62d045d88b395b84f00

    SHA1

    84a2d09c41b878aa8fd24852d71518e73d55c309

    SHA256

    0d38ff350b0a200ec502d260d60815aa5ad66614c5844f6aa0e779f6c09766e8

    SHA512

    9f9872ee305927bc1b8cda4f320a103ed3ae4029ac6b770631795db4b18a91629ac8d5c492f5e1d8ae8cf0450026883f482ec43be6aad8d04a8105a85ca3797a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    ffd29e1eabc182780f171be9d2e4da35

    SHA1

    422af1fab7f82054cc7b0e59a6f2d0564b265028

    SHA256

    bae57f8bbf53ef070b6dc8497d30b53fd97dfa148ee695fb23a845d3fe85d03d

    SHA512

    1dd8dab7640a57db5b0854456f8ccc6725c159afbe615d3ee797593a5725c8b403d6486ccd512f8cea991671c6ead7040c3c014f7c7f32a9514947870a5a058a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    d964ea0d26d5de4f96af78a50084f71c

    SHA1

    6a87a9415b5aa18d3f2be3a956b85d9c28c8cb86

    SHA256

    af7828f77b5fa052ad5d66b65e4fb03386d02f97b777ffda354176e7c932b456

    SHA512

    da3241fc977b25b6e9b4ea10a37e003e24eced2522c694c7d9881be24070a738536d41786bde64034085208a8e6e1fa5fbcc3df55714d0b7f65bd08b56ffb092

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    bd323f0b943bc30146c66630078ab263

    SHA1

    6ee139d6fe9569c4618faf9f1d2328eaa2ef9385

    SHA256

    3bfb4588e9c0cb789915f97dfd3a1d824d5ae392199e7f48c1dd8c665e0dc975

    SHA512

    8dd21fedc47e147ab7a05a3df6ff3246f6677493549d1ea567b8563341d46f8e5b3006aa1fc8d78df9a69cbf3ea4e8b135e00b3a488e87c18db571bb2da93c02

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    835ea383808b4df137dea7e223abffd0

    SHA1

    f25e5b2dddd8714cc4eccbf3ed6c159314d00e6f

    SHA256

    1865be6e260f6178cac457f5da3c82b2604cd807a9445feb4102ebd042475449

    SHA512

    8a3959edb6ceb39648607b299ca301d9222c87322a0181e1045ddfe7fdd41282fc1bfcedb0d108c2350d085369db98f7c465ddd7e4de6490fbcc1141f208e478

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    f6fe341f4ffb77893bbf409d60e0c663

    SHA1

    d3446416c12489df091f54f418542c601ce01310

    SHA256

    7b4e7489a085c35074f683a807fe0f10a74b1829af38321a54b74663f64128e8

    SHA512

    01073b63dffd41c3cf23b074403d7a4e033a5ca501320c6036bb719f083785b1851bc437b35ad8eefa2c35de3e8e1899955db4ae166454692459dd303c7f1c02

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    3c067f446e3ffbdc25909603baea4026

    SHA1

    e24555efc31c9ca80461e007fa90ed7fdffeeaec

    SHA256

    4574c3fed73c443d3a92799d6f18a8fd74d3071395bc74b53caff119465f345e

    SHA512

    9d47d5fe6a6bfdddcc8df68bd4a4dbb1c8055ea29442bd98bf9662bc072443b05f5e7f7a605d578ab6c769ec89d4fa08295cd5d0890ed384497ac2407a6d244f

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    cdd0fbf695d81b5f694c3004fadd289b

    SHA1

    54077c9346f95ad6dd68c6c7b5396e7b3545a899

    SHA256

    7658e3b2a0a7db3ac567a6a04d9db346521fcec5d354276d44f321bd4c3f905e

    SHA512

    7d3f47048e10b9da33087f823ff3f8338251688b476a0ec32f38a14c4b1eb02513b494d34542aaf3cdeb06ff3f2df09ee2179e17966c451e41046d21b4b3f1ff

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    4430a8aba85aa25a9dd37b6bd7fa5524

    SHA1

    5c0e275b4c5041efcfc3d312597b5747d6e1034f

    SHA256

    ad615c3ed9456a1d29f695b97dab55861f422810058ae5f254fe8c8f9dbca78c

    SHA512

    513a6ffa4b231aa98bb1e3208929d7684b0ca848cdae958a248fc3b28e2a9e0e907783cbebd1c1e4cc5e84ee4d82b08feb321435b05b814491fec9dfdbae6e13

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    6bba3568f433f389032752e036b869c5

    SHA1

    932c43cd644a0f72fab278a50d527e8497f29338

    SHA256

    eed3d9f8b6ee076020aa09eeeae4ef51b2721d2027a1ba195b472b80173fb731

    SHA512

    eacad8073ffea9e83f3870f12398c08b5b2af07cc3f59551ab0f74d817531c16386fef232fe8505ed4a7ca6559a501ef18f30ff9e922aa8afff11bb48472399c

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    556992d4b16a1cb4515a40feaa6cafb3

    SHA1

    d4284a224c3376330bf3d3d36619fe18671114fa

    SHA256

    804f8a7d74bb7c5472f2e6484f4e311f29a6a3f7df2fdd0f310411b21b6a4afb

    SHA512

    379148e10fa3965e935696378beb790de7d906179c8ab97adc0379e4b0f7f6f519a829f2090ff8bc16e62891e42e0bd61c4226568ad5c80dcd368cf324c5b748

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    d09aefa2967e975ddc3d75fbe9336a81

    SHA1

    c6b241c2b11296c80e6bffc4ddabf949f568a6b1

    SHA256

    58879254003a556839c8729057f52fe803dd540f99d1cdac37c12d7fdede3d67

    SHA512

    b01bc051fe51b03bcd45e07bc87af50a0a477e54442d01c89ecfbd06c6a248f2297dab2ce9feac2c883c76552ac2334a00bddb0c9e677f6bc1721739ef49a1f6

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    5e6fba1443d1763715c8f592fea4f99b

    SHA1

    b70c29f9fc09889dfa543f01a33bdeb6aed0bb45

    SHA256

    ccc51d014950bc5f4f89ffb7e79d69ceb84209a60ddb5357e53a30ac9b284950

    SHA512

    942abc576ee6f6df7efb6b2f436af2fc6d4d0b16ee07142a92c2699cc9abeb36ff91010e44851575b57db1a05ff6c4c72a1fdebdd8833e22d707525859a9b126

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    9098f8694439dc2273aa38821159dfd8

    SHA1

    ad69f814ccb3073befd628f1d42065270e786d5a

    SHA256

    84e1dd205d69ad8ed37835ec897b45ae1733870eab6dbfae9c221c3378fb0f41

    SHA512

    c4712b42ff8487aaf33421cb91b71a65d6bbc2d8f2da78d2082088306291efa8eddf7247c5da853b2fe44a2de42aa6a4f97dd0101d4c6f4d9d47d687a3e62ed3

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    a45dc403b6f4a495460ff147d5ac859e

    SHA1

    20f8f6f038f0f54010f7e897c19cf7e7e6dfb01f

    SHA256

    c27b63fcb121e02c6bcf47f7a8f741f01a5d0f1cd1f3a76e207237847d2eae3b

    SHA512

    008a00aebbe780a3e1d41e36f94014802a9c8b178061f0362defac8efed1c6cd24aa4fe12585b1fd39c49ca1ee40012a115163653a2dbc3edf8a6db23a7c2709

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    45B

    MD5

    4fe0a11f15a1659d25242910a3aa924d

    SHA1

    ebfb3f014b2ce2a6229ecbdbd75c8b6bdbf3f674

    SHA256

    3c431aedb5cd290ceaa0e408d72b1015b7a0613df0f636fad36cdbb8461aa08e

    SHA512

    2ee7f23dbe8380b06c20b3781e415aa5f89661063ad58a02e019d8357e9cb589b9b468b89caa89e4e6c40cfbb88bee3fa97463b721ae4e9d9acfdc723d2ce653

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    a67c66ec6e5fc4a4470aea28eba0d3eb

    SHA1

    adb7dffeba67f645eeb722890ba3852c00c3fd01

    SHA256

    fa6aa949eb2a0bb6d65b8dab46517d5590a82f9a98f0b27bfbde1e0bf9712cdc

    SHA512

    800f763362b2fca6b896fafa267e2bc917a66d572e44daeb81526401523e355660968e84f63342c1677b10ecb40d5275cee139c4854241e26590848bb5ddf717

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    6d180b7d9bfe78e46904355cb2158c88

    SHA1

    a78c4cdf8c6ce5423eef536660979cb3fe94acff

    SHA256

    0400cbaf192c16a3a9cac62190de4bc0cf623ae7eb8964229c4f7d4401d65e8e

    SHA512

    60e6ef2407e9325ab2d9b1ef57de4d94585d166bacf6d38f546c1ca7399d2ee66166e30cd9bfa56b5ae1f94e9cf233d8d4bf6f99d8394b865f705dfa3531c4bd

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    14048ce4f9ec570f40509696e4ec4b4a

    SHA1

    deaad3e134185280ac7a4075d02d889fea4d1053

    SHA256

    7aa34f62f3c1bf1150b1ca45feffbea5f4722517bb9678a0124be41543a2f2a2

    SHA512

    78a76e1fd5b947317b78d322a4d87b9bf95c049bcd1cb2f7063062690dd684f87294c8a1292a4d12323abbaff10640d6a388d69ff17f1fd11d42c4c091f38c24

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    1caf18e39321db038faeffd1911be820

    SHA1

    36a8b1dc8737e0ca32856263484604738916142f

    SHA256

    7d8996cc05858c20bf9075d19e71cf3059856c6b8bccb906c0a31ec88c636be0

    SHA512

    b3af34824b209ec4054229b4a6eb8187c44e76c1fc6769883815493aac9b4a2c7e31c8d88892ee5157a58fa5afe281611f62b67417af7fbcc757066e85c98b6a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    0e9ac7f52ac215903895a83caf433584

    SHA1

    7298d25733fba8cdbd30de5a02746b12d536b5a0

    SHA256

    eaf7e8862feb0b4bbbeace5c467b03e9dae2dadc189b91ed4b9e07d0d4669820

    SHA512

    f3a5fe7d85d88a028f221cb985f603ce3c2dca94b85b59a8c4b883f267e2af352730dfd0736c86dc8f6017e521f2c873c003588da6c5a3d06f24f8d349821ce4

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    6efb4c50400efd1413f54ce3f7ac50a0

    SHA1

    ae3facf34e62428544cf6f0919724eb4be5d5d9d

    SHA256

    a5597eb793c08ea278c82ff6dc4cb5ccf7d3e557df0182f52ba799ddc7b85949

    SHA512

    38b878b5a7641c69d16831204b1ff4259ee0ee5cbdcbe7546a35d078f657bc8c72c15a82185103dcf3b68e346fe154c82e3a2539deaf50db2864cd36dc16ef03