Resubmissions

15-05-2024 07:54

240515-jrt6fsga83 10

09-05-2024 22:02

240509-1x2k6acb72 10

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240506-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
  • submitted
    09-05-2024 22:02

General

  • Target

    838d6dd49693cdc1c25d72978c4f6ce54953103452f45fff609c16ecd489ea4b.apk

  • Size

    517KB

  • MD5

    130eef47e71b3381ee955c0d7b55320b

  • SHA1

    fe3f28cf35caed8f2026a4815dc65225830f5e34

  • SHA256

    838d6dd49693cdc1c25d72978c4f6ce54953103452f45fff609c16ecd489ea4b

  • SHA512

    1ae28788cd883a6620a75e1dfa6dd0fc34f079daa70b8e527b35e24bc8ce6f3753e141aa745054e6c8eb7d54f822c924e35f5c0d76634a408d0b466681db15c1

  • SSDEEP

    12288:VBz5jnPVuv9cpYWI5XMJ8eTN0dP3CD9bVo71nrifFnrpCHvTz51oae/sdJFX+SnH:VV5jPVuv9c1I58jTqP3CZRo71nriftp+

Malware Config

Extracted

Family

octo

C2

https://zirbnarg.top/MmZmZGVlMjI3NzU0/

https://jilepofk.xyz/MmZmZGVlMjI3NzU0/

https://wustyelk.top/MmZmZGVlMjI3NzU0/

https://mixylozt.xyz/MmZmZGVlMjI3NzU0/

https://quoxvebz.top/MmZmZGVlMjI3NzU0/

https://hifkxarp.xyz/MmZmZGVlMjI3NzU0/

https://dultzown.top/MmZmZGVlMjI3NzU0/

https://kervplun.xyz/MmZmZGVlMjI3NzU0/

https://vikexems.top/MmZmZGVlMjI3NzU0/

https://bontmawy.xyz/MmZmZGVlMjI3NzU0/

https://sirljufi.top/MmZmZGVlMjI3NzU0/

https://glaxwimb.xyz/MmZmZGVlMjI3NzU0/

https://fruljilk.top/MmZmZGVlMjI3NzU0/

https://zoxtneep.xyz/MmZmZGVlMjI3NzU0/

https://yampdrik.top/MmZmZGVlMjI3NzU0/

https://zorbpuft.xyz/MmZmZGVlMjI3NzU0/

https://riltshuv.top/MmZmZGVlMjI3NzU0/

https://vempyurt.xyz/MmZmZGVlMjI3NzU0/

https://hozzkwor.top/MmZmZGVlMjI3NzU0/

https://dyltwerm.xyz/MmZmZGVlMjI3NzU0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.marktravelrbmg
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4889

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.marktravelrbmg/.qcom.marktravelrbmg
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.marktravelrbmg/cache/oat/tghlzrdeisaq.cur.prof
    Filesize

    322B

    MD5

    276bfaa0ae8c80328210b490b8589ec1

    SHA1

    665b12df9a52998cba550f93815fc22493b96d64

    SHA256

    66e73bee3b271ed7c782e0178c197e70248a2efaabc92a0e50618327594bffd5

    SHA512

    8fca1b5765f1123175916ba7f882bd0bee6b5983c1946fdb392d78b03e4808c14635b224728748a95b58f9eee0ed1e2174f86df6c9c049cd38070a131c09c2fd

  • /data/user/0/com.marktravelrbmg/cache/tghlzrdeisaq
    Filesize

    450KB

    MD5

    7d9b0b0bb0b0370214b65025e8cf4f8f

    SHA1

    83d37543b202e5d361bf3510739b8896373fa4b6

    SHA256

    675dbf715e9ba1c664ec082d345303dc4440feaf5be49d5f9824730bea1dbc63

    SHA512

    3ee97cedfc1ef3c88d7076353b98b94ce90910d8839d0acdb447d8f1481440bbe634e7114b69b71677ff49f31df53ef6717d788400ebc9eda067353b07d7fa57

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    b7526c07e6bceab9d41f01b323b03364

    SHA1

    c5482cedcc0233c6a36b10d1966854bfd6c66adb

    SHA256

    903129be313ff2a07332739d2955fed4900752f1cf11c770ae1c807483fa9204

    SHA512

    88e7c6281d8b1961d0318e28139f2e1fc12e6cce5add51a192322e40e49b2f1de74201a0bee090173c3226b3d6788a2ed0968311d983fd24b03ccee0daf280cf

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    45B

    MD5

    2c599f86b206da52ad238340434c280b

    SHA1

    0369c021c040af27453864b16251f4310b545530

    SHA256

    350bbfffb81e3620f03875d15fa2bc326df49519d06f3c62440eb7e25de29152

    SHA512

    25b646ccee8f211ebd0f54e339987a20d1d1beb9e92bdad20718973ceffb82969c123df7470973890cd07c60bfb5ec32e157c52c44f74317a24b46bf20d83405

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    d3142a088570b5ea38a515bff8fe8680

    SHA1

    1f95c7bb723ced9b8fe91b101fe24466833d78ea

    SHA256

    46e8c230f89391b66c834ba1c2cc502e9bed60628c94fd2f2de114e79af4e20c

    SHA512

    bc2c05b0817244a029172d84775d7f5bc68352603e41d259b86df8441faea369b23b5fcc8d7cf227615480bf0fc737487496d2692bd7295cade1db9c013f9364

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    fa630c00e13fe53bd8e3b288d609b48f

    SHA1

    117629d18558b3f9367c702312fb715795b3b990

    SHA256

    b1e85443406284cd4fa3aef3be0fd38ac49e97a3963babf008e138757e64bd9d

    SHA512

    93ef42d2e314ba7e4726c8b1edabb4a405627a5ffa67cf1c85b16ebce1b9242577712699016351c187be90ec1b50a1b8e047c09b57827e8aaae2d34d56e678be

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    31a6f6d7f972a1afde701e3f8649e2e7

    SHA1

    58db3e2ad9e22aac52aec769655a6993928d3746

    SHA256

    f6a3d262864d7510302f59306a400af587f5f106b021cfda6800af2d6cf5d8d9

    SHA512

    dc6da00e116cce82dbf2da817c0b097aa425a8a0dd9a46ef2a8a54506b33f92b1e880b79acad1e0bfa4a213874246e4beb9aac3f6558f5ca6ab00d43c9be14a5

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    230B

    MD5

    515276bfccae431c9a12ab426a83b7de

    SHA1

    5735ccd057b253d2c021ccd6cd5cfd72c0b9f833

    SHA256

    754398f1029294f54417b0a00bb9ca1b00e9413ea087dd54df197364433f7fd6

    SHA512

    93240ceb22723cd68ac39704363ed1a3bad3950fdf51a9e7e899ed0884f1f5cff4d178b753bb0aa3f063632c85c2739073a6633e5033f7907f4f59f0c6120858

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    54B

    MD5

    b1d7c9d9364d9cf524017bb037287baf

    SHA1

    718a6a3adaf97f8d475ddd93a0ab4d38b16480b6

    SHA256

    8f825c25ac7bfb484842316da38e6bf545bcafcd5d5cdc32657ed6b80d2b631c

    SHA512

    523c811dcf2ea0b3bc36e225e2a1822a79d2af47b005a55403c77244ef80d42418b933bd7f4dcddc255346c43d0a2324cff4f60d2240fb79416efd2ca4cc1da1

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    497fff170fdc46c322347a1b208099e3

    SHA1

    c6a9430c18068be782b521c7a8f0a36ed286e3b3

    SHA256

    509282a0adc0fad5a432f87e175b86721ba76a8febe0f869e4c0c4d10c9c50de

    SHA512

    3f0a3fd967c77e8a01c5223fc6fd6368bbcafaead6fc33ba5fb75224fd5c3abeff09ade399ef0ba59562561bfb01fe362bd0bc046390df0025c0a65b4b1b0f17

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    1878083ac013e0ec6442609ccbe54f78

    SHA1

    3d69432d3fef4ad6270bae449794cd675a0cbe2c

    SHA256

    243d3e4ad582e241f60eee26dcbc0b5ac95403a39100a0f94ade0a2b5d709ef8

    SHA512

    c4637ef3bd1f5cc08ad91224fe1943f6d279946ae3f66e0f7345b400e191c4fa810ff422a2c0d58ea87dcdeca0c94eb8e07df80bb1267a1527c8640318ed55af

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    3e03206c935c2f2c867383e8fd9c0f26

    SHA1

    c5c3d105d0733b4e4d2c2b554cdd7f0e1c3591e7

    SHA256

    53cf5ec0efef64e9da39f5f4806bd446f2d07ff2d191097a34ecae78d15f8901

    SHA512

    eb40029997e75b44c7e7611bb90a834b78e5b981dd9131d09f5f566edad30c66262f0028a222e85bd04155c8888eeef8f5fe80c116a4681f43feaecfa01331cb

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    76B

    MD5

    2b3ccba1b42bc606393cee7a8a117a40

    SHA1

    b50680ea4bf952a141077dd8d5a909c68e116177

    SHA256

    83d99e0ae76ee1e134d35268aac99624342e3d5e68c078a4dabcf5770420cd26

    SHA512

    320b2ffe0f7ec31d7fba3cadb3592eff3b25757160ec9a86c835971103f6d46d17dc2c1ce4dc16704c0b679d9b49d97e7f8035f1963fa93a5e338023166b4986

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    230B

    MD5

    961c3c7deca1b315a5ae82c7b2ed6923

    SHA1

    b3506bb53413f0f8ad275eba66532f32f8805e88

    SHA256

    9b8faeabce35cb42a91b6d1e0673e67b8d238e9aef3f1cb01f417c3fcda7b9e7

    SHA512

    a3d183ece388820593c4233beaa2d3fccbd52ad12d04984bbd189a7a8d5ac339834fc6e858f151ee227ffa11ce9655d23ad07ed999570c5962a25263cb76f018

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    63B

    MD5

    e99d868a97996a326ca48a21b700352f

    SHA1

    2d1e940a9fe96ebf9d2a965c6c6d80675749bb22

    SHA256

    73063c430f0d77af22c0a578831755ab1bb3859ce45c180bd448d22de94c5da6

    SHA512

    cabea686fd61f2bbe69dd876f1c31bc78f8c742869aac7037325798c365a464eaaf7450f33cb6183cccf3ffb67f07806140b122156f569fa2874288c19379adb

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    d72ec877b65bab37f1dfdf870207e398

    SHA1

    dca42bda85f6621254d58a1e9ce7b39b027f2cba

    SHA256

    b57dc2cf91d12f60c9952b6f1fc60119ee81a3bdd37f1ac81e63204819cb1d6e

    SHA512

    c95ecde6a9da1fb49bde48f86718cc75bb089883908cd2fc11899e2c354c4a08999914461e19a40a471ae6e834479a29d62e409632da500ba4278f695312f318

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    45B

    MD5

    34eccde36e5da4831809ba24f90cb9e7

    SHA1

    43ae312dd60c78fad2069cad978d741746e72c45

    SHA256

    c815095d7aa185cec606e4efa1cdeec78e08986e5ce6fd3be73e6fe6ccdab4a0

    SHA512

    1011c0c942e7977cc8100f26ee15566607d2cf363239cca22cd90475e6c472a9e85f7aa3da6cbfd193c9ae3a9abce6372278e4f8aefa6a89b250bc121376ff9b

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    466B

    MD5

    36058555a60b7f589ff7fc61f3fdc65e

    SHA1

    896ff21370cf53c47772c4f9d28f74e8845dd1b3

    SHA256

    7d9a123a1d5e95ee8bd4c52c0805868ee61f7d810a8a10f7e8bb909ebc542c2e

    SHA512

    0cbdc41f7add5bd480d60ce2308ed86757d24b77b46c4b41858d202a6c410f51069c78b5b4a2ed3e0633d01d297a607d61e77d0855b3b09a24c821a426fd8c14

  • /data/user/0/com.marktravelrbmg/kl.txt
    Filesize

    68B

    MD5

    faacbc26168dccc091bff9290b8edaac

    SHA1

    4b409f49937d68a23f7c85326418bb4fe1042c59

    SHA256

    9354b68576e654c4bb00ca3b794b879b08d9df4974141c354df8e3e003c2c09e

    SHA512

    3e905a5fade7c4b90f3fbfc7ef208194cec12017ba1a62aa12961b8c47f8d073e326c4438ea7c4fd4e10ad82a4b1bef7a38b06ab9c95e08bb0ae49441de8be17