Analysis

  • max time kernel
    152s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240506-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
  • submitted
    09-05-2024 22:02

General

  • Target

    91852b1df3455372fc78ed178b196968ce82e826df626ba97de79e044bf0861f.apk

  • Size

    517KB

  • MD5

    9ebf7f928e4b67824ac1c9655e71ae6f

  • SHA1

    0636dac8433af88cd7551a1f05bfd6cb24efcc07

  • SHA256

    91852b1df3455372fc78ed178b196968ce82e826df626ba97de79e044bf0861f

  • SHA512

    a0e51e569b37ceecfbb4d5eee694222740a7dc53051af48136587eb802a94cad4542e9d3215ff1a6894521b8b16625695e378da739edf3ca0858e4772c20b333

  • SSDEEP

    12288:ZMz5jnPVuv9cpYWI5XMJ8eTN0dP3CD9bVo71nrifFnrpCHvTz51oae/sdJFX+Snj:Za5jPVuv9c1I58jTqP3CZRo71nriftpq

Malware Config

Extracted

Family

octo

C2

https://zirbnarg.top/MmZmZGVlMjI3NzU0/

https://jilepofk.xyz/MmZmZGVlMjI3NzU0/

https://wustyelk.top/MmZmZGVlMjI3NzU0/

https://mixylozt.xyz/MmZmZGVlMjI3NzU0/

https://quoxvebz.top/MmZmZGVlMjI3NzU0/

https://hifkxarp.xyz/MmZmZGVlMjI3NzU0/

https://dultzown.top/MmZmZGVlMjI3NzU0/

https://kervplun.xyz/MmZmZGVlMjI3NzU0/

https://vikexems.top/MmZmZGVlMjI3NzU0/

https://bontmawy.xyz/MmZmZGVlMjI3NzU0/

https://sirljufi.top/MmZmZGVlMjI3NzU0/

https://glaxwimb.xyz/MmZmZGVlMjI3NzU0/

https://fruljilk.top/MmZmZGVlMjI3NzU0/

https://zoxtneep.xyz/MmZmZGVlMjI3NzU0/

https://yampdrik.top/MmZmZGVlMjI3NzU0/

https://zorbpuft.xyz/MmZmZGVlMjI3NzU0/

https://riltshuv.top/MmZmZGVlMjI3NzU0/

https://vempyurt.xyz/MmZmZGVlMjI3NzU0/

https://hozzkwor.top/MmZmZGVlMjI3NzU0/

https://dyltwerm.xyz/MmZmZGVlMjI3NzU0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.marktravelrbmg
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4815

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.marktravelrbmg/.qcom.marktravelrbmg
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.marktravelrbmg/cache/oat/tghlzrdeisaq.cur.prof
    Filesize

    312B

    MD5

    d7a8c332194aaf1d0ed124aeff437780

    SHA1

    a0e07525fdef7997378b06f2efc4e6963fe41d31

    SHA256

    aa1a154f427dc3e83fabd709cce6aaf86851d2d8b6b8eab18fe07696dab8670d

    SHA512

    c7cac470dd30d4dbf80314643e4db834d2a1dcaa0d8a9965298d2e41cf74821b4b79f89a47eb3b74a3ddace84f1fb6a82bf74838ff857bfd65c35ca8865c3799

  • /data/user/0/com.marktravelrbmg/cache/tghlzrdeisaq
    Filesize

    450KB

    MD5

    7d9b0b0bb0b0370214b65025e8cf4f8f

    SHA1

    83d37543b202e5d361bf3510739b8896373fa4b6

    SHA256

    675dbf715e9ba1c664ec082d345303dc4440feaf5be49d5f9824730bea1dbc63

    SHA512

    3ee97cedfc1ef3c88d7076353b98b94ce90910d8839d0acdb447d8f1481440bbe634e7114b69b71677ff49f31df53ef6717d788400ebc9eda067353b07d7fa57

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    fc029dcd62f116bd942c423dab7f80ec

    SHA1

    adac24275a068e13b07bc2452f29a61379b5143f

    SHA256

    bfdcb0610bca10d2ca19f05f14305a0c16745527817fff8413d5fd7e02879a0c

    SHA512

    7db612ebead0fd83e31e1137935eeca8dc8e459b4d13571ea73c3064d53b5bdfe0224c65b2b4536c68b2fe0d476898d3d0bcc2d56e5fcb2df08da0d13e93c941

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    be40b2418efd4449b88f982bae24cd25

    SHA1

    07b619a1259ca8bf7d883f07d2eed2e43f28c04c

    SHA256

    cbce3b67dea079ff428c7fce4880238ee316fc47443cd2d9bc9e5955912a2c6d

    SHA512

    ae822ddaf6706ff5e16e4d0eff6f1b67bcd9b5d8265ff07e77b3b3dae20c72fbdaa3e665c2c25c711de4f35e9265e50958bcb4fb1bcd1328256290301b00ae17

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    b777dab8049dacd3dba0863cdfe1ecc8

    SHA1

    f25081eaa7f170e1600f3ad870ad5b2f43cbd1b9

    SHA256

    c6c9895d3949250d802b2d24b875e140fc92579a409f87385b9a834982810907

    SHA512

    3a5863811fc377aa9dc392af35ae275d35906711f5d2b911a574ce1fc8c45ac7aaee766e1bba8531ac6652fc9719a94e76b3b75d8f4632eb6885d67c4d761e01

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    831667c4e5e32ee9931137af7a4aded7

    SHA1

    c195e41ce3b3be822e91754b292148ecfcbd5bb8

    SHA256

    0a90f9ce878d11f804b5abbc6d503e127c0be73484e3e4df1a3c2604e4bec08f

    SHA512

    20c50b0e37a96ed61c018b0193eb41c5845eb0802d7dd2c5f9535c9943037718dcfc976b598b1f795cfd166f8c05bda3febbf82312df6571738fa826f4efe18a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    e3c32e721fd57ed7fa664f994dafd1fa

    SHA1

    d21ed2f0174fe06f20a83855dbb3fad87d69f3d7

    SHA256

    45c74c9f38476c3c49606d1c8dc66f880af5d5c9395357e35d0cae9a624edebb

    SHA512

    73fac0a1d257c9818de0ab18aa07e5437cdfa81254b778550a45fe3433db67f93a0d40e9ac492558f79b557abe72201451f1f3a5ee534b7ffa5fe187be5f6ed2

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    56bb479166c2e4923e01ec64f8b6af35

    SHA1

    a75cfb119978e397e90c377f49ff704d54525ead

    SHA256

    d199a0b68f3862b767ae4a35a096d36d78c869b14da83da936a5a8f77550e1db

    SHA512

    84fb4af770b159b7ddb8fff40fdff89a8998dc2f67a185892296a717fe9f9a5c4023f596b277f466d50dc5c46fee156edae0f60fffb4a3b647df96cf262db7d0

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    7e782494cf5c0d77ddb0a48243dc4c38

    SHA1

    470b43d4de07286165cba2614a34cd8d8e9da22a

    SHA256

    8f712ee4d1e1e282fef11e8847b3a61409cf0c1d4ec486d83d4d170e3a63e2af

    SHA512

    1c38f7d52536f46e6fafe756542da22b3994b20a56dc105971874b0b25580a4687c4ca2ed9146044e823679409d67873f179636a89380775a905cdbe8f8a8620

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    93e766b68fac6ad29d6b14b68dbab88a

    SHA1

    2dd8d146ce3777c59c04aa0f0cbc8c89d03eb777

    SHA256

    c6064cc43d314319f31268526937a8f425ef6bdceac119db15c7ec62cf5d0e8c

    SHA512

    9a5611f709f77e8cf40784c7c692afc2634b5357e0e0f477386bedc912f6ca164c78ee3ac2eb6a99bb605eec8134c2475cfcf53caa41974346dd7fd4de7d966e

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    925827c2ccc22ec59d7a6bc648e12fe8

    SHA1

    29da9eb2c18c31d6f47e6c4a59142ce2716d1cd5

    SHA256

    36214d8ede357e706f0f69fa1ccac115f2bcc756b04335a4a70eb7fe27253be6

    SHA512

    472c9f0adf2a8476a1de9e8fc760cecc96804c6fef4070cb8686c3c2416c0a1f545b49cfa1d0a45f57d6c6ff6fe82e17b2586af5cbf39345b90e4ba539d8899a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    9bb32443e9445bb252af07f10570f26c

    SHA1

    c64e0441d9211287ede4c8dec6c05639bc129416

    SHA256

    da36a29410e04a1c893b6f9943250a638e122d7dcbb6f934df6d063d907d1d53

    SHA512

    b418270d23204cd7383d69752193916424bb1719b0c1ac17f20a18b2097865461bef5476baf99809b2bfee39969e91884606d7dfa7922f19775bf1e24553bcff

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    88f84a9a8b4222282e0f8143096b631a

    SHA1

    1cd8a9aeade4b1cb4530b6e667f0c3bc75762bcd

    SHA256

    e4e45da66e2eb484aea66f0681c80f880a78c17bff3b30b1af4083a0d031f253

    SHA512

    a67a287e5f80fd29ceb8db8c75b370abe40a825033b31f30623e21094904d7fec7fa87376798e43a2923b522a0443025cc1ad978431c60525760f367211def7f

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    2d185f210fbbdc8a381e4ee6d2ca014b

    SHA1

    bb32c9d7b5b50413404a0099caaf0cba5f2ed8af

    SHA256

    5e9ea49957eeebdfa10909f9f9d5ecb55a80c970a19c69bc3bd7fbfa1390798b

    SHA512

    bb981eee469f79f8c566210adee4add0fb25b614e3afffbc8365951689c0fa0b15e853e5681ffaca628d682776a761e0f5f5fc8b985419e2afa9287d285a09f0

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    08c863ea0892c55c4f44e886bb3c9cc3

    SHA1

    1c9f769a06892a94b7c7e7d932e6140ed62c8ccd

    SHA256

    26b0724c6c929559a4be8be39e6cc5047e82e3a007ec660544d6d0aa5ac43a6f

    SHA512

    8c52416e9760a00c4ad32d5e2b49f93453e126375532b08f66958b624bf8b11374a6fcd67b2361686a35455cf697c37b0bf34553300e64d21ef5f1b309a41ace

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    04143991c6c2762d1f88d3842c4bef76

    SHA1

    b27ce14dfdc33d48c5274d9d34dd7d813c63948e

    SHA256

    43b3030d5f2695171938c4a2f93274bd3f5cede93135e88e589931856c6b8dcc

    SHA512

    52b4af92166cacf3fad4bcb0e7ca8a3cc07f79aaf0f43c9c3b2677bedbf9415c089bae7d25aa3801dc5ee146658fd8ac4199087ec280f52e22bee9025857a4a5

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    ae9cb512b77d0b9128050c8938054ff3

    SHA1

    f41b6531a755571e00e4474c3b685e46f26a31f3

    SHA256

    6654516aabd1f36d6f25acedef0ec77f4f82208b7cf6230a4da34d78c0d9e90a

    SHA512

    044548fe18c4dbc8f9c84ffd071af881e174dd57e282556c13dce91511606e6f1cc113206dc08dcaa7b5f78cde0c11d81766fbc9eab9ca8a243c2f7bb10aac04

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    883fa8e943f7529192373c07f9398bf5

    SHA1

    defeaec2d19cea22940b27e208d4e986190067ae

    SHA256

    a1f9eb7af81bd21c23538bc4a9be0b0e04ca0205648ae300d9045276bcb31413

    SHA512

    3dbb1f9874dae77970c3268cdca5d73f8e0f4ef90b2200ad16b5a2f113373c429823f7de8457b578d71f16092afd374f8bedd1abe512d0976f6f9f9029ffa755

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    dc6f1ae0f2a6ffcff7dea7dcca7a0c79

    SHA1

    7c86400eb71bea07f29b2f56e5cb3f3559020637

    SHA256

    3146a911ac620e96c863383b20ddb2ef1b14036cd5b57927a7f87fe13571a1f0

    SHA512

    95feeac812a886db1962544e7159506eff658a002811cf923533e0d884c3b4be563b3da1320f9cd475f4469c3d3540fa8ae19991d69c06800032ed3a47d4bda9

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    732f36fed9c0e2912003261666b77fcf

    SHA1

    587a3dcf062da93247fdf1069b51ad51507228a4

    SHA256

    4bbc54d35b0fdac416954db92c415d8998e18c6802c1900b31c3a8748116c304

    SHA512

    b65017ab92360218fb907d4f8f3368603a33c1731b083b498c27c9f31f3f2d7ab472ba336da57488c04e804b1068138581aa6128ad40a542fedbe086d5a9e813

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    3bdc5878b216a6d8f73435955567379c

    SHA1

    b007f3f5fde9269159a6169c4360aad081bd769f

    SHA256

    3a4be9e837b37e2d32901c4f1df43d86472ed8668058b528b62483d2ff7c982d

    SHA512

    37e25100458855c0322339e64e8539cedbaa70aecc3200b53dd4a9e03d8d90e7d4481ed3bd0dafc3253b14ad6e2e676dce725d5ef82614ff7cd5e51ef8aedbfa

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    1da6934f1e4f082f33277f88a0581d3f

    SHA1

    4b5d1e6556383aa4a44f3dba9a82d7ff9ad4ab08

    SHA256

    150ed72cd92bd79be9d5dcd90b44e5e479d460e49600bca2a56747adbfd857c6

    SHA512

    70f55354ebd38c802409ee20492c34ecc5416af38114d6a5e1cd768f30f63341cd2004b68352acbee06f9763d45518acb13be9d474810645f2908e3f056b3fd3

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    69a6dcfa6b143163e0219d96d26e339d

    SHA1

    1bbb693c0177eea25c39a6e37a106fad49b71c86

    SHA256

    f3f89096e052ccb5ee8423fe3a641d11d5427f6eacb26bfd731b608831c5dfba

    SHA512

    1b8579e0279f7524f2032cdc52b5c00962a3e0567adeddd5ffd66963e8a228e066b7063e92bb90396bf426e4c73425190742476c76a2f43b92eb520b630a45a0

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    45B

    MD5

    7c43fb78bb483972d5ed904dddab6e03

    SHA1

    92a83c2494d7ca7d5fcf91fc4841b923f7e11af6

    SHA256

    b78680fa75ba1fca8c780737c2566c292ad7a4c479eca83f06fdee29290d4009

    SHA512

    53331f6a90dda9e38a1ce8afcdf159f8faaa938b7b220d2125999ca0db30899bc82099ae45ea13e5088ac61010a1b679f429ce5eb1040858ad7568b436293ac9

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    71eca93d4893ec38c7a76f86327446e6

    SHA1

    cfef118f50548dcfe87f47e6a259b1ebb5a18274

    SHA256

    a835a6e068951268edbb40ffb4441df1291e855ce7784017ecb25066f046e82f

    SHA512

    dede237560d080e4cd5085c90b5941c6a912f2803e9377d7032e669d3f857c3bc12500b1fbd49087b81d64914fee69388371777f812e119f9bac23edc27d7b0a

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    e34fc95b1e15c7e32dd6b3665e7e2c5b

    SHA1

    da169e04245a468f3169d095023b61df7a0ae11d

    SHA256

    530cb684b8884e8529dc94d2752cff8aad3dde0ed2c831c510ba40ec6db337f0

    SHA512

    d2707ef6f28e4d2077d8363eabbd7740b4371b28586aa09779b2464a6acc7ebef2623faaa0a88e78aebb3b78a03abca512152a9195f7684eb59d5fbf1a3df276

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    2332f794f6774aa67fac65b98d914e47

    SHA1

    3523ea24ecf37ef9023ae87e521fab1f80629cfc

    SHA256

    57441d9e999bd7f61ece88626624dfcb83fc0a7b4f0c1b5aea49674354429e54

    SHA512

    32b8ab313e1cf06e46d57b3961ecce0fda2d4bc0df4bb8e54562094a05e9c355caec2df24c721b47050aa6c669d2e574f79743fcd3fe96b179c6896959fc38ec

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    54a69e02de2e367720a5321ff774bc39

    SHA1

    cd40e9da7395a3e5303c1e864e67995e47f8c2cb

    SHA256

    6db8498fc6d62d0fa2da6c18230f8406444378d1aaf8380620479da312b78c47

    SHA512

    70e93351a0986c8750ef35f74f03404aa172b29f041431eccfe5f281419d1f6622ca7ff76156e0ba192f7b24e3f342a3f9a1b789764ae9ef4899d734522a3363

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    58B

    MD5

    c5706fb1476ce5f78b5ddc04d99b6dc7

    SHA1

    da581d1ce051c4e4691cf213d2605c03a8e17910

    SHA256

    c81922040bc244f9b396923cec1cd8812b9b0a2213262dff3e327f8c2525947e

    SHA512

    696044d7d80c4ebce71986b16c055f402e3ec42b002ede6b0337b8a6a1df78398bbf78eb52201d7a56ee2caca0ce41adeeedc34e7ab49eac72b22c4974cb10b8

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    b3c5d83b318c7c621dea74722eca58c0

    SHA1

    923c670a99a429516124d691ef57ff4176f8e15b

    SHA256

    b1bec1e8af302bfc0893430394aff7739ef76deb52cd8896b24ecc1b6ff61d7e

    SHA512

    a3761ce7a583bea925c6c19ffe4b96ef9f1640f87c04d2875febd8b651f4a269e9b19ebf6be1cc236b0de1dc84fcd8699d7f93f363242c19006715f3768fc1c3