Analysis

  • max time kernel
    179s
  • max time network
    138s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    25-08-2024 22:03

General

  • Target

    945643c6b12904539e620a2854b741ec611ba068a5d1286a2b5b052c2006560f.apk

  • Size

    509KB

  • MD5

    ced472940afc208bcbf9bfbf19b86603

  • SHA1

    830df0196f8a8f3bb62cdf288477ea01765ab844

  • SHA256

    945643c6b12904539e620a2854b741ec611ba068a5d1286a2b5b052c2006560f

  • SHA512

    3d10cde3dbc1f00f13b949653ec0fff50d1caa7ea8601b3a1b56e597a4f19bb4379a14bede80441e58138c41f724d5710f1be828b02d9c2183cd45be80a80e15

  • SSDEEP

    12288:gnO89ZmO4vEp8wg6L1E1XlZdN4E/iYeE/ydyjsGp6na:gn1hp8wX1OlXeE/yHC6na

Malware Config

Extracted

Family

octo

C2

https://selamcanoonaber.site/ZDljMGYyZTQ3YWRi/

https://hava540derece.com/ZDljMGYyZTQ3YWRi/

https://cehennemdirloo34.com/ZDljMGYyZTQ3YWRi/

https://sicaktanbayilcam52.com/ZDljMGYyZTQ3YWRi/

https://otururkenterliyorum42.com/ZDljMGYyZTQ3YWRi/

https://sicakdanbeynimyandii2.com/ZDljMGYyZTQ3YWRi/

https://slmla6242nbr.com/ZDljMGYyZTQ3YWRi/

https://havacerinlii34.com/ZDljMGYyZTQ3YWRi/

https://havasarinliyorla234.com/ZDljMGYyZTQ3YWRi/

https://sicaklarbittikurtldk6215.com/ZDljMGYyZTQ3YWRi/

https://pikniktupu2534.com/ZDljMGYyZTQ3YWRi/

https://robetcotraslros5234.com/ZDljMGYyZTQ3YWRi/

rc4.plain

Extracted

Family

octo

C2

https://selamcanoonaber.site/ZDljMGYyZTQ3YWRi/

https://hava540derece.com/ZDljMGYyZTQ3YWRi/

https://cehennemdirloo34.com/ZDljMGYyZTQ3YWRi/

https://sicaktanbayilcam52.com/ZDljMGYyZTQ3YWRi/

https://otururkenterliyorum42.com/ZDljMGYyZTQ3YWRi/

https://sicakdanbeynimyandii2.com/ZDljMGYyZTQ3YWRi/

https://slmla6242nbr.com/ZDljMGYyZTQ3YWRi/

https://havacerinlii34.com/ZDljMGYyZTQ3YWRi/

https://havasarinliyorla234.com/ZDljMGYyZTQ3YWRi/

https://sicaklarbittikurtldk6215.com/ZDljMGYyZTQ3YWRi/

https://pikniktupu2534.com/ZDljMGYyZTQ3YWRi/

https://robetcotraslros5234.com/ZDljMGYyZTQ3YWRi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.farmrememberp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4364

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.farmrememberp/.qcom.farmrememberp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.farmrememberp/cache/oat/ynglzthhmq.cur.prof

    Filesize

    371B

    MD5

    664e10a75cec6487d9b847640fe2b043

    SHA1

    3c3eb6c6f15e8aea7e2ef1efe7541a63a31a7b27

    SHA256

    acd387260753007f223a542557321ee706988635a0860eae63a0a1e34842d074

    SHA512

    413beb183f3e5dd0d97e0e0abf0fdd782e3f99ae997bc287e63baf802dc71eb0a4827fff2b5152ea1ad9837d2da81579ad8571ca59a9908beebed441fd54d804

  • /data/data/com.farmrememberp/cache/ynglzthhmq

    Filesize

    449KB

    MD5

    0215b3971dd5eee24cc0c08021a3c2d8

    SHA1

    951dcf2303c4735ae112e6dc4b0c84159acf11ad

    SHA256

    735cc8f4340dcb2321fa337aa20cfc4c178eb499f9801bb56377902a6d455683

    SHA512

    4ec4c37bd9878a2adb70e30bc18adbc60f997c74eca3c37640653499a779169caf6482c9334af89961b054e522645fb0dc2c129104b7324ddaab757b22eb3d8a

  • /data/data/com.farmrememberp/kl.txt

    Filesize

    221B

    MD5

    adf640eeab64516d4b9ce1c442993fcd

    SHA1

    232a8549a6a180c498715a0cc0b6c21fe6bc43c5

    SHA256

    6ea8957db8bc9e9520afce7568731ef601ee24a6375aea6aef3444c8a899579e

    SHA512

    38445513adea5c4af2aadce6c5ef11dbd5ca87ded34a6bd05bea6a420e0ecf4f097df1ac6edf261c012fc016b1a28b0bacf2db56546333e1232fe586b40fa795

  • /data/data/com.farmrememberp/kl.txt

    Filesize

    52B

    MD5

    7a6c9a775a0f7a27cfdd238d33c30ac4

    SHA1

    a8f7756147813af6764b268e236dcc1adabbb2c5

    SHA256

    f87ddc326b0b5b875a725ae924c3b22899010ef4b3641fd46257bb324b8ea4ab

    SHA512

    78d4da6d8c6d8aa8ca894cc85a017f29057a8743b338e696c07f5a0f8db4f67a40b4c06632d07fe4e1ab75568de6960e3088436e5e93af5d1a65832ab2afe2fc

  • /data/data/com.farmrememberp/kl.txt

    Filesize

    70B

    MD5

    87211b16a716e905cc263362bf757569

    SHA1

    8617ddd474d9bd43c67585321a59add018b8c5c5

    SHA256

    74f43dfa841baa1a7b713c6da0187282dd76d88cb2606c9eeaf40d2721bb2b80

    SHA512

    f2caa47f6024c17b0c37930c48b8f5bb74ebc778a41f5b3760c5380f33db2bd62dce3b7210478aafeaebad6f904e70a3997f04ba427841f37a2470f306c9129b

  • /data/data/com.farmrememberp/kl.txt

    Filesize

    62B

    MD5

    d470fda4521bc8483c10c77deb72a6c1

    SHA1

    c77b035a272c7bf1a866d91834c200471b9e032c

    SHA256

    2ee37994171b2692abd74823b547dce93b7f6236bd8c16cf6860b27a8cc90d8c

    SHA512

    2f200806a7e3f91984a3a733b09d3661a68fb1d01f09a3865cd159b7ba5c8f824058eacb96af4557a4caf7206a741fcddd1961cf771991e1d1ad8dd7a51f3e1c

  • /data/data/com.farmrememberp/kl.txt

    Filesize

    504B

    MD5

    d5a2f00da39d2758f9a8b647fbe20374

    SHA1

    2f5c5e0162e75836c69c1a4127bc22b9d0e7413b

    SHA256

    21ed9b39d138b6a02a8d7117671f0edf7fe44ca207ac471a6ed0de9fe3127f15

    SHA512

    f18b534252dd1cb2d5e00aa5be88c3fd47741049b1a57f66f5d39fed8da15f99d6d4f105451531b0a27d07d6c37f21372d97ecf1c5793380256a9e03a78d43af