Analysis

  • max time kernel
    179s
  • max time network
    186s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    24-06-2024 14:52

General

  • Target

    7ac003b2439dfef2304f0eed41b5767d4a565aa6cb725334618c39d3c878c929.apk

  • Size

    517KB

  • MD5

    12f3d40771a5310697ba218ebd2f92d1

  • SHA1

    3f54248f1d2acea6234e84a9a7d4a54d954ff890

  • SHA256

    7ac003b2439dfef2304f0eed41b5767d4a565aa6cb725334618c39d3c878c929

  • SHA512

    d0f0a1f0be9fa4fda4e21bea87038eb64f8cb4cb2a280c6ec009b773ae811c93a424488797ac32a69345b1720e4f36951442598de8e552e6c9b07f5574c4420c

  • SSDEEP

    12288:RzCnluxn+Tu+DGZWB/6k/f7NJsUy6g8d3sy:R+nlEn+Tu+sWBCEJJBy637

Malware Config

Extracted

Family

octo

C2

https://senanlamazsndili.xyz/ZjM0NjUxNDM5MmVi/

https://keskinbaltadndu.top/ZjM0NjUxNDM5MmVi/

https://zatenacikmisttm.xyz/ZjM0NjUxNDM5MmVi/

https://sokakdaldiregibas.xyz/ZjM0NjUxNDM5MmVi/

https://avmevsimibsladikk.top/ZjM0NjUxNDM5MmVi/

https://chennemburasialmnya.xyz/ZjM0NjUxNDM5MmVi/

https://gldigimyerchennmindibi.top/ZjM0NjUxNDM5MmVi/

https://verelmsnieldenele.xyz/ZjM0NjUxNDM5MmVi/

https://amagibikertenkeellee.top/ZjM0NjUxNDM5MmVi/

https://kraltacikralmisinhaci.xyz/ZjM0NjUxNDM5MmVi/

https://ustuneyagdimrmi.xyz/ZjM0NjUxNDM5MmVi/

https://bedelniodedkicmzynayna.top/ZjM0NjUxNDM5MmVi/

https://tlefondingalokimo.xyz/ZjM0NjUxNDM5MmVi/

https://birdnbireoluvrdihrsy.xyz/ZjM0NjUxNDM5MmVi/

https://gozlermkankrmizisi.xyz/ZjM0NjUxNDM5MmVi/

https://bilereklermibildiler.top/ZjM0NjUxNDM5MmVi/

https://sefernakliatfln.xyz/ZjM0NjUxNDM5MmVi/

https://uzanrmigokyuzuneumutlarm.xyz/ZjM0NjUxNDM5MmVi/

https://dardidardomama.top/ZjM0NjUxNDM5MmVi/

https://giydirbilirfren.xyz/ZjM0NjUxNDM5MmVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

    jp.co.netbk

    jp.co.rakuten_bank.rakutenbank

    jp.co.sevenbank.AppPassbook

    jp.co.smbc.direct

    jp.mufg.bk.applisp.app

    com.barclays.ke.mobile.android.ui

    nz.co.anz.android.mobilebanking

    nz.co.asb.asbmobile

    nz.co.bnz.droidbanking

    nz.co.kiwibank.mobile

    com.getingroup.mobilebanking

    eu.eleader.mobilebanking.pekao.firm

    eu.eleader.mobilebanking.pekao

    eu.eleader.mobilebanking.raiffeisen

    pl.bzwbk.bzwbk24

    pl.ipko.mobile

    pl.mbank

    alior.bankingapp.android

    com.comarch.mobile.banking.bgzbnpparibas.biznes

    com.comarch.security.mobilebanking

    com.empik.empikapp

    com.empik.empikfoto

    com.finanteq.finance.ca

    com.orangefinansek

    eu.eleader.mobilebanking.invest

    pl.aliorbank.aib

    pl.allegro

    pl.bosbank.mobile

    pl.bph

    pl.bps.bankowoscmobilna

    pl.bzwbk.ibiznes24

    pl.bzwbk.mobile.tab.bzwbk24

    pl.ceneo

    pl.com.rossmann.centauros

    pl.fmbank.smart

    pl.ideabank.mobilebanking

    pl.ing.mojeing

    pl.millennium.corpApp

    pl.orange.mojeorange

    pl.pkobp.iko

    pl.pkobp.ipkobiznes

    com.kuveytturk.mobil

    com.magiclick.odeabank

    com.mobillium.papara

    com.pozitron.albarakaturk

    com.teb

    ccom.tmob.denizbank

    com.tmob.tabletdeniz

    com.vakifbank.mobilel

    tr.com.sekerbilisim.mbank

    wit.android.bcpBankingApp.millenniumPL

    com.idamobile.android.hcb

    logo.com.mbanking

    com.openbank

    com.google.android.apps.walletnfcrel

    com.samsung.android.spay

    com.cardsapp.android

    cz.bsc.rc

    cb.ibank

    com.bifit.mobile.ubrr

    com.bssys.mbcphone.ubrir

    net.bl

    com.bifit.mobile.bin

    com.webmoney.my

    com.polehin.android

    com.bitcoin.mwallet

    io.totalcoin.wallet

    com.quppy

    com.sharpdev.fxcoin

    com.advantage.RaiffeisenBank

    hr.asseco.android.jimba.mUCI.ro

    may.maybank.android

    ro.btrl.mobile

    com.amazon.mShop.android.shopping

    com.amazon.windowshop

    com.ebay.mobile

    com.idamob.tinkoff.android

    com.akbank.android.apps.akbank_direkt

    com.akbank.android.apps.akbank_direkt_tablet

    com.akbank.softotp

    com.akbank.android.apps.akbank_direkt_tablet_20

    com.fragment.akbank

    com.ykb.android

    com.ykb.android.mobilonay

    com.ykb.avm

    com.ykb.androidtablet

    com.veripark.ykbaz

    com.softtech.iscek

    com.yurtdisi.iscep

    com.softtech.isbankasi

    com.monitise.isbankmoscow

    com.finansbank.mobile.cepsube

    finansbank.enpara

    com.magiclick.FinansPOS

    com.matriksdata.finansyatirim

    finansbank.enpara.sirketim

    com.vipera.ts.starter.QNB

    com.redrockdigimark

    com.garanti.cepsubesi

    com.garanti.cepbank

    com.garantibank.cepsubesiro

    biz.mobinex.android.apps.cep_sifrematik

    com.garantiyatirim.fx

    com.tmobtech.halkbank

    com.SifrebazCep

    eu.newfrontier.iBanking.mobile.Halk.Retail

    tr.com.tradesoft.tradingsystem.gtpmobile.halk

    com.DijitalSahne.EnYakinHalkbank

    com.ziraat.ziraatmobil

    com.ziraat.ziraattablet

    com.matriksmobile.android.ziraatTrader

    com.matriksdata.ziraatyatirim.pad

    de.ingdiba.bankingapp

    de.comdirect.android

    de.commerzbanking.mobil

    de.consorsbank

    com.db.mm.deutschebank

    de.dkb.portalapp

    com.de.dkb.portalapp

    com.ing.diba.mbbr2

    de.postbank.finanzassistent

    mobile.santander.de

    de.fiducia.smartphone.android.banking.vr

    fr.creditagricole.androidapp

    fr.axa.monaxa

    fr.banquepopulaire.cyberplus

    net.bnpparibas.mescomptes

    com.boursorama.android.clients

    com.caisseepargne.android.mobilebanking

    fr.lcl.android.customerarea

    com.paypal.android.p2pmobile

    com.wf.wellsfargomobile

    com.wf.wellsfargomobile.tablet

    com.wellsFargo.ceomobile

    com.usbank.mobilebanking

    com.usaa.mobile.android.usaa

    com.suntrust.mobilebanking

    com.moneybookers.skrillpayments.neteller

    com.moneybookers.skrillpayments

    com.clairmail.fth

    com.konylabs.capitalone

    com.yinzcam.facilities.verizon

    com.chase.sig.android

    com.infonow.bofa

    com.bankofamerica.cashpromobile

    uk.co.bankofscotland.businessbank

    com.grppl.android.shell.BOS

    com.rbs.mobile.android.natwestoffshore

    com.rbs.mobile.android.natwest

    com.rbs.mobile.android.natwestbandc

    com.rbs.mobile.investisir

    com.phyder.engage

    com.rbs.mobile.android.rbs

    com.rbs.mobile.android.rbsbandc

    uk.co.santander.santanderUK

    uk.co.santander.businessUK.bb

    com.sovereign.santander

    com.ifs.banking.fiid4202

    com.fi6122.godough

    com.rbs.mobile.android.ubr

    com.htsu.hsbcpersonalbanking

    com.grppl.android.shell.halifax

    com.grppl.android.shell.CMBlloydsTSB73

    com.barclays.android.barclaysmobilebanking

    com.unionbank.ecommerce.mobile.android

    com.unionbank.ecommerce.mobile.commercial.legacy

    com.snapwork.IDBI

    com.idbibank.abhay_card

    src.com.idbi

    com.idbi.mpassbook

    com.ing.mobile

    com.snapwork.hdfc

    com.sbi.SBIFreedomPlus

    hdfcbank.hdfcquickbank

    com.csam.icici.bank.imobile

    in.co.bankofbaroda.mpassbook

    com.axis.mobile

    cz.csob.smartbanking

    sk.sporoapps.accounts

    sk.sporoapps.skener

    com.cleverlance.csas.servis24

    org.westpac.bank

    nz.co.westpac

    au.com.suncorp.SuncorpBank

    org.stgeorge.bank

    org.banksa.bank

    au.com.newcastlepermanent

    au.com.nab.mobile

    au.com.mebank.banking

    au.com.ingdirect.android

    MyING.be

    com.imb.banking2

    com.fusion.ATMLocator

    au.com.cua.mb

    com.commbank.netbank

    com.citibank.mobile.au

    com.citibank.mobile.uk

    com.citi.citimobile

    org.bom.bank

    com.bendigobank.mobile

    me.doubledutch.hvdnz.cbnationalconference2016

    au.com.bankwest.mobile

    com.bankofqueensland.boq

    com.anz.android.gomoney

    com.anz.android

    com.anz.SingaporeDigitalBanking

    com.anzspot.mobile

    com.crowdcompass.appSQ0QACAcYJ

    com.arubanetworks.atmanz

    com.quickmobile.anzirevents15

    at.volksbank.volksbankmobile

    it.volksbank.android

    it.secservizi.mobile.atime.bpaa

    de.fiducia.smartphone.android.securego.vr

    com.isis_papyrus.raiffeisen_pay_eyewdg

    at.easybank.mbanking

    at.easybank.tablet

    at.easybank.securityapp

    at.bawag.mbanking

    com.bawagpsk.securityapp

    at.psa.app.bawag

    com.pozitron.iscep

    com.vakifbank.mobile

    com.pozitron.vakifbank

    com.starfinanz.smob.android.sfinanzstatus

    com.starfinanz.mobile.android.pushtan

    com.entersekt.authapp.sparkasse

    com.starfinanz.smob.android.sfinanzstatus.tablet

    com.starfinanz.smob.android.sbanking

    com.palatine.android.mobilebanking.prod

    fr.laposte.lapostemobile

    com.cm_prod.bad

    com.cm_prod.epasal

    com.cm_prod_tablet.bad

    com.cm_prod.nosactus

    mobi.societegenerale.mobile.lappli

    com.bbva.netcash

    com.bbva.bbvacontigo

    com.bbva.bbvawallet

    es.bancosantander.apps

    com.santander.app

    es.cm.android

    es.cm.android.tablet

    com.bankia.wallet

    com.bestbuy.android

    com.jiffyondemand.user

    com.latuabancaperandroid

    com.latuabanca_tabperandroid

    com.lynxspa.bancopopolare

    com.unicredit

    it.bnl.apps.banking

    it.bnl.apps.enterprise.bnlpay

    it.bpc.proconl.mbplus

    it.copergmps.rt.pf.android.sp.bmps

    it.gruppocariparma.nowbanking

    it.ingdirect.app

    it.nogood.container

    it.popso.SCRIGNOapp

    posteitaliane.posteapp.apppostepay

    com.abnamro.nl.mobile.payments

    com.triodos.bankingnl

    nl.asnbank.asnbankieren

    nl.snsbank.mobielbetalen

    com.btcturk

    com.ingbanktr.ingmobil

    com.tmob.denizbank

    tr.com.hsbc.hsbcturkey

    com.att.myWireless

    com.vzw.hss.myverizon

    aib.ibank.android

    com.bbnt

    com.csg.cs.dnmbs

    com.discoverfinancial.mobile

    com.eastwest.mobile

    com.fi6256.godough

    com.fi6543.godough

    com.fi6665.godough

    com.fi9228.godough

    com.fi9908.godough

    com.ifs.banking.fiid1369

    com.ifs.mobilebanking.fiid3919

    com.jackhenry.rockvillebankct

    com.jackhenry.washingtontrustbankwa

    com.jpm.sig.android

    com.sterling.onepay

    com.svb.mobilebanking

    org.usemployees.mobile

    pinacleMobileiPhoneApp.android

    com.fuib.android.spot.online

    com.ukrsibbank.client.android

    com.Plus500

    eu.unicreditgroup.hvbapptan

    com.targo_prod.bad

    com.db.pwcc.dbmobile

    com.db.mm.norisbank

    com.bitmarket.trader

    com.plunien.poloniex

    com.mycelium.wallet

    com.bitfinex.bfxapp

    com.binance.dev

    com.binance.odapplications

    com.blockfolio.blockfolio

    com.crypter.cryptocyrrency

    io.getdelta.android

    com.edsoftapps.mycoinsvalue

    com.coin.profit

    com.mal.saul.coinmarketcap

    com.tnx.apps.coinportfolio

    com.coinbase.android

    com.portfolio.coinbase_tracker

    com.bitpay.wallet

    com.bitcoin.wallet.btc

    com.blocktrail.mywallet

    org.electrum.electrum

    com.paxful.wallet

    com.bitcoin.pocketbook.btc

    net.bitstamp.app

    de.schildbach.wallet

    piuk.blockchain.android

    info.blockchain.merchant

    com.jackpf.blockchainsearch

    com.unocoin.unocoinwallet

    com.unocoin.unocoinmerchantPoS

    com.thunkable.android.santoshmehta364.UNOCOIN_LIVE

    wos.com.zebpay

    com.localbitcoinsmbapp

    com.thunkable.android.manirana54.LocalBitCoins

    com.thunkable.android.manirana54.LocalBitCoins_unblock

    com.localbitcoins.exchange

    com.coins.bit.local

    com.coins.ful.bit

    com.jamalabbasii1998.localbitcoin

    zebpay.Application

    xmr.org.freewallet.app

    com.bitcoin.ss.zebpayindia

    com.kryptokit.jaxx

    com.cajasur.android

    app.wizink.es

    com.grupocajamar.wefferent

    caixagalicia.activamovil

    com.abanca.bancaempresas

    net.inverline.bancosabadell.officelocator.android

    es.caixageral.caixageralapp

    com.bankinter.bkwallet

    com.db.pbc.mibanco

    com.indra.itecban.mobile.novobanco

    es.openbank.mobile

    es.pibank.customers

    es.bancosantander.empresas

    com.indra.itecban.triodosbank.mobile.banking

    es.univia.unicajamovil

    com.westernunion.moneytransferr3app.es

    www.ingdirect.nativeframe

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.whiletable82
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4635

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.whiletable82/.qcom.whiletable82
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.whiletable82/cache/enumcmbe
    Filesize

    451KB

    MD5

    163a1af175dcc6e79465a14948f0d2af

    SHA1

    160806021edf038e47f8db0bce96fe6b6cf4135f

    SHA256

    14e8289b6f8fcbe293a1a645ee5bbcf566543b06310aae5b6875686e997995b7

    SHA512

    7259335aab5bf353e8722a793d1e20c3f847b20355acf77a0c076c0eafe88d494d9878a027f29481a16f60eae11f0609732dd258c0e2b2d07bffd8b694fe5a57

  • /data/data/com.whiletable82/cache/oat/enumcmbe.cur.prof
    Filesize

    318B

    MD5

    8f31e29a7600e1fc76c069de8af66b73

    SHA1

    a81c153b7a034451cb40f86fe7edf05cba6a766c

    SHA256

    21d948c0137b33fc6fcfbff20acbb50ec11830f3f1e83ed4338d7ec9f1efde5e

    SHA512

    2dff2a5d0c80653bf50a17f8db2ea9c3ee47396ffe629f91e1cb7c3987b9feb5b652e46b226877b0d266264bfa39af8b6f10c6deb98edff43b6141228f868ddf

  • /data/data/com.whiletable82/kl.txt
    Filesize

    237B

    MD5

    1f6bd623db4f8ecdc19eadf4044a03d3

    SHA1

    3de7dbbfc1874f27b2f80c8c6cf1fef2dc2a5cb7

    SHA256

    156abd2c4a11546ae1810d5906478bfb016ff0961e765a7aaae2b367501af15e

    SHA512

    31eaf70b640904713e8485a5a70b6e49a84b3a81db36fac0ac1bf2be02e2d1506f8a5f2790aab8824bc4a248a3a08ad8a8de983223aa57e93d24828f1e11f34e

  • /data/data/com.whiletable82/kl.txt
    Filesize

    45B

    MD5

    af32865aff04249f650733fd5bd4587e

    SHA1

    9298b9ead2bf252325761fe8dc10d785589e45b0

    SHA256

    a2e41a050b4d08db0063f258cef1ffcff713b750cd513dc63388bee3de511dbb

    SHA512

    c7fe75fbfdf18385805368d0e34fd0ee723851c019f90f2cf6bb0428ab774f55a3236a396c82cfcb50f9ebdbdd9bb23b6ed1902ca3582948c3c2b569472d5ca0

  • /data/data/com.whiletable82/kl.txt
    Filesize

    63B

    MD5

    ddf1892db33ddd3820f865603ba0433f

    SHA1

    b0f3cc85f1fe2411e6b208549f82a9aee353662c

    SHA256

    24a91890f12ab21cb92a26f640d0092833f6316af501bfe9531fa49c110c803b

    SHA512

    d8ea812951bf0ed45a96d313af9924e5a7c842ab0cbfbef38de65952f9e4f9a7aae01584682437799ef522aee12d0db7d7267173993af754ca117b88051e9a2d

  • /data/data/com.whiletable82/kl.txt
    Filesize

    45B

    MD5

    7304bb57f8d430a0b7cf4da6737fdb21

    SHA1

    e8ed4eea5ef7a0ccf1d457b7406d203f3fec0a4e

    SHA256

    57842a3c414caf11dc7dd522b883c7b6ec1b2a20a89340317b288e23c14cdd5d

    SHA512

    4f63339333538ae562b885a2c291470f0e621ff16dd4d69189289a6fdfbdc430b5b917ffb23ad37b9b38cb1930a8e67fa5c9a0f690f8a08d7f505bd8f8330175

  • /data/data/com.whiletable82/kl.txt
    Filesize

    480B

    MD5

    2cac596ee48aab3d30679ea29bd8f108

    SHA1

    561e5163f5c8e578d5dc6d818aee4b8961712bbc

    SHA256

    106854ea27695f6bf0bb43b69d4cc3cc359bdf70d12aa5b7f6050accbf8e35d8

    SHA512

    b07164455fee4267a7dbb9bcd3c70c86a30c8e3419818159b72c3969772733b41a5dca671869f86fd24f9dfc2d3070dd6767b5d14f14a1db243fd36d42140004