Analysis

  • max time kernel
    178s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    19-05-2024 22:00

General

  • Target

    8876d90ca56b89ba6b9814643460784823980b35b1c238affe6d72ea0b19ad39.apk

  • Size

    517KB

  • MD5

    53aa1aeceac2f6b394e53ae7ffc6a95d

  • SHA1

    191bc473bff1d863e2e6d0d30811ddd511719ab2

  • SHA256

    8876d90ca56b89ba6b9814643460784823980b35b1c238affe6d72ea0b19ad39

  • SHA512

    f9fcd0a9e7dcbfbdde9d8d9dddf065a54d05aff763fbf14f739e2f39343819aec088100eba690f16ae6dd1584813a315adfb780137cd237c1205fd17a0582294

  • SSDEEP

    12288:gpnrbY+kxOfT/LdyUkMAGwkZGI32ZkzvSMPOb67:+nrbdkxO7ByZ0NZGIIkzPWm

Malware Config

Extracted

Family

octo

C2

https://tabukareler.top/ZjM0NjUxNDM5MmVi/

https://tambanunakere.xyz/ZjM0NjUxNDM5MmVi/

https://fesatokero.top/ZjM0NjUxNDM5MmVi/

https://lemanobelki.xyz/ZjM0NjUxNDM5MmVi/

https://tutankamunhaci.top/ZjM0NjUxNDM5MmVi/

https://karakapkaraklpak.xyz/ZjM0NjUxNDM5MmVi/

https://buzbuzdagdaglari.top/ZjM0NjUxNDM5MmVi/

https://bilebilegndere.xyz/ZjM0NjUxNDM5MmVi/

https://saybyebyetohepiniz.xyz/ZjM0NjUxNDM5MmVi/

https://ruhumdnzincirr.top/ZjM0NjUxNDM5MmVi/

https://kefalmefaltefal.xyz/ZjM0NjUxNDM5MmVi/

https://gecelerisvdmpkiyasen.top/ZjM0NjUxNDM5MmVi/

https://kranliktaaradm.xyz/ZjM0NjUxNDM5MmVi/

https://yoktuhcfener.xyz/ZjM0NjUxNDM5MmVi/

https://dlounayyanimda.top/ZjM0NjUxNDM5MmVi/

https://izlemebskasiyla.xyz/ZjM0NjUxNDM5MmVi/

https://astralanahatarim.top/ZjM0NjUxNDM5MmVi/

https://anilardvrimi.xyz/ZjM0NjUxNDM5MmVi/

https://leardolordoloro.top/ZjM0NjUxNDM5MmVi/

https://hadikapanikapatsana.xyz/ZjM0NjUxNDM5MmVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.endbetween46
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4238

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.endbetween46/.qcom.endbetween46
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.endbetween46/cache/nkbkg
    Filesize

    450KB

    MD5

    49942b1e9ef99dd6efd7610e2f4887a9

    SHA1

    8bda7cb915aba3b7026d8438357444c2f17673f9

    SHA256

    ffb1d94e8619a2bc50279883c65bd06b3690e5dee35b24b4dd65ef73583ba3c4

    SHA512

    3f308dc3dd25ff82711749c5ef03c7c9ff73c6835ef4c527a699d75b5cafd11cce9c4f1619200bf9f72c7078a73053f6b601d6dea01f7ce1e98719bf6c4c7812

  • /data/data/com.endbetween46/cache/oat/nkbkg.cur.prof
    Filesize

    509B

    MD5

    2a7632cb5caaa176c0a9faff630e25af

    SHA1

    9380b1f82e2a1a82a3cd2654e367968b9230df19

    SHA256

    755c1bf74a5b6acba39762dc9ab80a732ca9b6112c27b41059cd156b5b6df02c

    SHA512

    ff695f4aed6924dc52c1c15596b46edf432ba4d7257f6b48807ce032ab104cd8e31004f8ba204852809e5e7cfd0afb53b01c938521316fe97d51742f6e74edfa

  • /data/data/com.endbetween46/kl.txt
    Filesize

    237B

    MD5

    744ee8ced41efaa723eb15cd37e6251a

    SHA1

    003f6653636f85a87b570f668d640319e9f0d53c

    SHA256

    95334dc94f51989588a6eb7bb5ba32138db47134d2caa6a1126a281854f0792a

    SHA512

    eb50d1d798a3dd54ab8d08e80c03485af495eb119e657c70b22fd5a8f33da466f95666746b96a435126c214e831c74318ea727b41710c263b030f7d053d2b7c5

  • /data/data/com.endbetween46/kl.txt
    Filesize

    54B

    MD5

    d748905870a2c56ea0c81b44e23dc51f

    SHA1

    b7b7f2d63528e215eeea7fd2930ae7e1fc3221c1

    SHA256

    a9bb28ac1bffd458c4d6056133cd92e14b55cf68c4c0fa707ef6cedc276848d7

    SHA512

    3837c07d36cef927b62a96fb37b333d060d97e15b84741d6de7acf5de9451af53bc6746bcb60f07e0b03799a2edc706dec17888ca7be10642a681a75018f69d4

  • /data/data/com.endbetween46/kl.txt
    Filesize

    68B

    MD5

    7bd3e290d2c66ca59511be8391970712

    SHA1

    db0139b612d0e04b6f4721d6c03a2249e3f1caea

    SHA256

    0e6d431a2ba5dd1829ca68a2af62216e87aa7e07da23d6481c3eb68f70a47dda

    SHA512

    2b74abfe3581f369aff05e57748a299867a8f1f3bf941380267d0835d6fef9f458250fb1dbc84017afc12512753631130e89f889e85b40e105c4fdfbbb943349

  • /data/data/com.endbetween46/kl.txt
    Filesize

    63B

    MD5

    b7d34d0793f9722ba91e7a94767d7d7e

    SHA1

    770e7c723b5c9358814bea8aa04aa28adc964c33

    SHA256

    ddeffe158ad49858725d7423a34266f0d151476e70489aea5e17eb2139053023

    SHA512

    9a939db31b0d64d0197c5f44d7dd1391872354330d19d6310ff26906d8ce62b32256b6808e46367f92f867473a8b05949cc436d1b5c89423203f20e9ff379565

  • /data/data/com.endbetween46/kl.txt
    Filesize

    437B

    MD5

    35e0f00b7872d10d05949b0972b86ecb

    SHA1

    b3fd3bea7809e7bebb0690ded979589b4eaf2745

    SHA256

    170de179aedb2b633f3f1b1533c52ad61d3ec69fdd72c20c3afbd5d3565d66d9

    SHA512

    0b42b9b23f4a979aa0249c7a208109a1c5400fadc97d082b21f0990d91fbfc44a9ff393eb855232edb6d6fc5e0344588378ceea2cde92366cfb524d5a6774b1c