Analysis

  • max time kernel
    73s
  • max time network
    183s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    22-07-2024 22:00

General

  • Target

    ba26ff02c0654d5d1401d9e0479575a456fbfeca122857d0e455251e0828f050.apk

  • Size

    509KB

  • MD5

    3754b31a5c4e2ba4dd04ef1d9be25bab

  • SHA1

    294493e7f2d2c719ee270c88240d335f4cec4efd

  • SHA256

    ba26ff02c0654d5d1401d9e0479575a456fbfeca122857d0e455251e0828f050

  • SHA512

    acebdc1ab20ff019e12dec2be25e3ea6285eab8c7bd9ab412bfd652e8952709575e97578b13049156286afeb613c50077e3fb78f5adb06c4b695a769b2093dd2

  • SSDEEP

    12288:WLvrXpUmvcwwHwPCdj5rK0K6HrI9v0O7lx00/nT0p:2TkwwHwkFKF6HrI9cOh60/na

Malware Config

Extracted

Family

octo

C2

https://selamcanoonaber.site/ZDljMGYyZTQ3YWRi/

https://hava540derece.com/ZDljMGYyZTQ3YWRi/

https://cehennemdirloo34.com/ZDljMGYyZTQ3YWRi/

https://sicaktanbayilcam52.com/ZDljMGYyZTQ3YWRi/

https://otururkenterliyorum42.com/ZDljMGYyZTQ3YWRi/

https://sicakdanbeynimyandii2.com/ZDljMGYyZTQ3YWRi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.overoneoyx
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4957

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.overoneoyx/.qcom.overoneoyx

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.overoneoyx/cache/cpatleppudple

    Filesize

    448KB

    MD5

    ba08e5cf0f7dbb46ee2c7ea143a39271

    SHA1

    9707321a03f1c64fb60fdfa1d524b009cdcbd153

    SHA256

    26e5c13379780572824641f2aecccea4ae2d901a0eed4eee34d39b9be302fe9c

    SHA512

    c6fff686a8a572bbc7936d0f63a38da80dbcbfffe8c5744b5caad1a480c93be6ab28c6556f8cc82ac5a96f234888c84b77aaa4b15cd9ef65e6c3c5416c7bdcec

  • /data/data/com.overoneoyx/cache/oat/cpatleppudple.cur.prof

    Filesize

    448B

    MD5

    4b07f5e4ad899b46b68a526540b5b3d7

    SHA1

    ae8314271a2fc17c1a2b1f78b786e70fa3b18f24

    SHA256

    eee079dc81f903214086d36d5c2586328aa999837435ca9453ea2d09c761639b

    SHA512

    3cb5422c6ec45aa92fd36f2d878c8aeb7986e1cfa67857199b9d30e46b4e476f0a2561e8e98768df4cf11a3768db3953b51cecb440bd39e218d6380b85a6d74f

  • /data/data/com.overoneoyx/kl.txt

    Filesize

    68B

    MD5

    1c90990a3a8cf34fa096d0f4969262d1

    SHA1

    6cf035bc90d2aec7b3a84561f3e9edef0bed886b

    SHA256

    ac8d47202f1ef12175197519fd2e52a4681d435c61152216f199c02f8c253a5a

    SHA512

    01808712beb67bcce15197c1cb4185720539b25cf52333b7e28f720b4589292a1c673f0025886e357dd027794474fcfc87ac3cccb5c289a47675cbf4baa5b070

  • /data/data/com.overoneoyx/kl.txt

    Filesize

    237B

    MD5

    05d9f632948edcd0b41bad6ad2e505ad

    SHA1

    d3290e06a935067259eed1535fe15af759c85cb6

    SHA256

    7f596daf2d683bed776100dfcc2c744c807dbbe994733576b5bc026ed45eef13

    SHA512

    7a869a52c9a814759dd33748de5f94efe2ff4efa5af9aa5006af573acdaf99e68ccb3cecb736a507db162f48aa693961f850143f2ad36ce4bae7d7f3b559eced

  • /data/data/com.overoneoyx/kl.txt

    Filesize

    63B

    MD5

    7eedf9c3e4f024d8fc2e69924e1029a5

    SHA1

    b3b32bd4e88dbd5a4b4277316debfc881dfe479d

    SHA256

    c58d0efd383f7dc4d0fb7a46ac02810c0655ab5037675d24f1e463e1a8a75ce2

    SHA512

    4cce1c5a2073233235cb4f012e86c55c6286d2b5f6bec5a9e5e8b1ee1136116e558e6a776cf2f2779e771308066d4c9126af4d7ac534f16dec23984e9c1e3b75

  • /data/data/com.overoneoyx/kl.txt

    Filesize

    67B

    MD5

    8597da611a7dfadc770bc6a4900daf54

    SHA1

    416f5e56d3d5137fc56b4335a5bb4c8e6cab1c93

    SHA256

    1686dbe70e58937eb506ce0786daf749049fbdc62004c1a4209d7c29983edb65

    SHA512

    d90afd4418682a3308dac30ab8c120d5c8eace4eec304e1076f84324c01b5d5c70e75e9318cb9bafcb3bc18f92b6535433d8d077e879ef70b750df6efc364d1f

  • /data/data/com.overoneoyx/kl.txt

    Filesize

    437B

    MD5

    069e73064f61acf6702efee665296869

    SHA1

    0c66a5016703f2ff20a20b39d3687a2517330324

    SHA256

    9eddd8d50c2e813196b1027337f777e1428c990a4f1d23da2b9254a1e2a11575

    SHA512

    36dc1adc27914ccf9c2bde3fb693f4a8bf80dd935939dddef9dd2619ca92dd02e1ddf2e08ef3d720d00566595d1367764da8f74836c4e98bf84c9933e819d8c3