Analysis

  • max time kernel
    178s
  • max time network
    169s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    19-05-2024 22:00

General

  • Target

    8876d90ca56b89ba6b9814643460784823980b35b1c238affe6d72ea0b19ad39.apk

  • Size

    517KB

  • MD5

    53aa1aeceac2f6b394e53ae7ffc6a95d

  • SHA1

    191bc473bff1d863e2e6d0d30811ddd511719ab2

  • SHA256

    8876d90ca56b89ba6b9814643460784823980b35b1c238affe6d72ea0b19ad39

  • SHA512

    f9fcd0a9e7dcbfbdde9d8d9dddf065a54d05aff763fbf14f739e2f39343819aec088100eba690f16ae6dd1584813a315adfb780137cd237c1205fd17a0582294

  • SSDEEP

    12288:gpnrbY+kxOfT/LdyUkMAGwkZGI32ZkzvSMPOb67:+nrbdkxO7ByZ0NZGIIkzPWm

Malware Config

Extracted

Family

octo

C2

https://tabukareler.top/ZjM0NjUxNDM5MmVi/

https://tambanunakere.xyz/ZjM0NjUxNDM5MmVi/

https://fesatokero.top/ZjM0NjUxNDM5MmVi/

https://lemanobelki.xyz/ZjM0NjUxNDM5MmVi/

https://tutankamunhaci.top/ZjM0NjUxNDM5MmVi/

https://karakapkaraklpak.xyz/ZjM0NjUxNDM5MmVi/

https://buzbuzdagdaglari.top/ZjM0NjUxNDM5MmVi/

https://bilebilegndere.xyz/ZjM0NjUxNDM5MmVi/

https://saybyebyetohepiniz.xyz/ZjM0NjUxNDM5MmVi/

https://ruhumdnzincirr.top/ZjM0NjUxNDM5MmVi/

https://kefalmefaltefal.xyz/ZjM0NjUxNDM5MmVi/

https://gecelerisvdmpkiyasen.top/ZjM0NjUxNDM5MmVi/

https://kranliktaaradm.xyz/ZjM0NjUxNDM5MmVi/

https://yoktuhcfener.xyz/ZjM0NjUxNDM5MmVi/

https://dlounayyanimda.top/ZjM0NjUxNDM5MmVi/

https://izlemebskasiyla.xyz/ZjM0NjUxNDM5MmVi/

https://astralanahatarim.top/ZjM0NjUxNDM5MmVi/

https://anilardvrimi.xyz/ZjM0NjUxNDM5MmVi/

https://leardolordoloro.top/ZjM0NjUxNDM5MmVi/

https://hadikapanikapatsana.xyz/ZjM0NjUxNDM5MmVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.endbetween46
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5119

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.endbetween46/.qcom.endbetween46
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.endbetween46/cache/nkbkg
    Filesize

    450KB

    MD5

    49942b1e9ef99dd6efd7610e2f4887a9

    SHA1

    8bda7cb915aba3b7026d8438357444c2f17673f9

    SHA256

    ffb1d94e8619a2bc50279883c65bd06b3690e5dee35b24b4dd65ef73583ba3c4

    SHA512

    3f308dc3dd25ff82711749c5ef03c7c9ff73c6835ef4c527a699d75b5cafd11cce9c4f1619200bf9f72c7078a73053f6b601d6dea01f7ce1e98719bf6c4c7812

  • /data/data/com.endbetween46/cache/oat/nkbkg.cur.prof
    Filesize

    508B

    MD5

    c90aeb6bf037f4361abfeea884c2507f

    SHA1

    dc68124493100714f2e0d51a9d28ec25a9d2ee0e

    SHA256

    7f6f00692a1e643ae88d7640ccfd5cd4c5074c5ae1035ecad7fd34b24bc2599b

    SHA512

    6ec3eaee7142bcc470cd0613231313176caabb0089a04b12b05a8427e6209e5b4c60237648fbd37beeaf8c72f5d93781ece0fedd18248317414e99d55d0b74b3

  • /data/data/com.endbetween46/kl.txt
    Filesize

    237B

    MD5

    c15f06e40697566acaa29cfdb26d4831

    SHA1

    9174029b5bd8150a25b7c533564f4614d636d192

    SHA256

    296aaf48771b0854d84860c9e19fa35fa81a2476386f90d51b5f267c43a816f8

    SHA512

    1c260b1e78af58770b21ee0e4eb230221f8659cc16fb35f7742c00cf4e97e2ea897fd031d432a70b81d36d6935022d028470cba33cadb58024f755e865dd0fd0

  • /data/data/com.endbetween46/kl.txt
    Filesize

    45B

    MD5

    5684ab41e6ea30762272c15fc8812a81

    SHA1

    1f78fbab0989440b2aac5a7c2c2a977521a7d0f4

    SHA256

    46c1f32d7175d4d0a601f6978488c2a201fb21c50f559313f5203d5b38f1bd5f

    SHA512

    c9a785de604fce7719f6090fafd375f1642b0829b8f37b958e56e9c135d9f1b5ecda2e19850ee3548aaf76cb456033ce1bed3c91eb4793994efcc0921830b6d4

  • /data/data/com.endbetween46/kl.txt
    Filesize

    45B

    MD5

    6ee7380c250d8ca8574485a4e754d621

    SHA1

    8c332068112767dcc5944a8850015dfec89a2130

    SHA256

    f1e0ca0aab81c2a11448ff0fcebd0835db8d886915f9b26d076c01a166234dd2

    SHA512

    67a3ff61853f65206552ead5afc108fa0fc0d4b7a48b9bdbe3920e94e65a3fcede81a563b49f60a0a9473fb92215b761c343a1cf561e4a150ff3e1f74fcfef1b

  • /data/data/com.endbetween46/kl.txt
    Filesize

    67B

    MD5

    c61e1ffcb92b20cfdc202651776729ff

    SHA1

    6bd4ebd2bd0433af78984483752a354c2d31d32a

    SHA256

    afc8bfd18de574c58c14d0ed2363aa825a1814378a4c7765d9abf1b7b65e15b9

    SHA512

    597fabec13fa04b2f8b43d7cad06881b3d5bc19c463374d933865b902f896481f6464564770f96e47c13c2ad97328c1c1fc461ee24e2dad6c85740446194c8d0

  • /data/data/com.endbetween46/kl.txt
    Filesize

    437B

    MD5

    0e25256687a391d8b1b1ef04704e732a

    SHA1

    79c9045baf41af11e3016e82edcd3fa9d43e4c0b

    SHA256

    43e85eaba3192a3e2a0250aa0bcbe5b1c10fefc6c8563509d246629635abd89e

    SHA512

    c6b0622527c75a1d079bf28057d811d271848ece1cc27f41045eba2cb1db590c6b9fe8f2bb7a0317224b6318dd030e496a856d9bd4a78ee3ce7ca2f3e19790ac