Analysis

  • max time kernel
    178s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    27-08-2024 22:01

General

  • Target

    1c816b006c08e1c805512564c9b74fb4b02de85c49b777a7131c1b69230210d0.apk

  • Size

    1.6MB

  • MD5

    b2e845f802015dc94e7ebf6854acf14d

  • SHA1

    b040a51054864fcab09f22e1fc142373a98ce2b3

  • SHA256

    1c816b006c08e1c805512564c9b74fb4b02de85c49b777a7131c1b69230210d0

  • SHA512

    c52a452c7049cec81be37746c0cb1837ad40f0357a41ea1acc2c0edb900a3717ae1a262a2d8d9b64de3054f07ea5eed45a855ea7861a1061722fc6c97d66d00a

  • SSDEEP

    49152:7jjyb+BWR2UJRqltolsQa6JdjK7CbOk4fvLWpenmvp5:m+CJ+uyb6f28r6vLceg5

Malware Config

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.legend.urge
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4542

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.legend.urge/.qcom.legend.urge

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.legend.urge/app_sheriff/GOGLBPI.json

    Filesize

    153KB

    MD5

    172180848f8c0615548f2ce453fcd6d1

    SHA1

    cbaa92d22201c561486d37bd09ae1e50e7ea87dc

    SHA256

    538afac44aa94d36bb5627a695b4be84db375a7451b928535543bd3700ac7d57

    SHA512

    bd1ba4cb55cb595fc36ab1a5ee38df0e5f797d4bb79d2efe152673ebf52a4fbde3ce3ec4aac9758e020cf2f249e4fe6b76edc9ecb9b7e8374c6e75dc24f4b4e2

  • /data/data/com.legend.urge/app_sheriff/GOGLBPI.json

    Filesize

    153KB

    MD5

    829d0709466bd6b8548c58f83dcb2a0b

    SHA1

    2214743d38ed2f3d9db78b4181a6a659437f18f5

    SHA256

    d1e345bb7b9b3643b286b2e49dce5f3217b6c64b193639bebe2dacb6db7df8bf

    SHA512

    55a37efd04293ddd44b214d13faa31799c541501d45380e7825042245f1b66967479b6db85b15d2a38cde502678aeda68cf0da9770ed6ae49bdc79b8b40158e6

  • /data/data/com.legend.urge/kl.txt

    Filesize

    230B

    MD5

    6a99c91e5e3786e87f6772e0a7a3d683

    SHA1

    604a9c7dc1f766a767df0b3a9bf4c62592153ccb

    SHA256

    3e488f7a0f02a90e09b736e3efa08089b2be22057f165d045dc88f9e9ce78bba

    SHA512

    76823e9a64f30e95c1bda686a77a1dbcc1ba7aff4348214f208e50efa34389d164ed02462dbde3fc3209ab74a0c0b166917fb90f8d1c0a620ee62d5e19e35d86

  • /data/data/com.legend.urge/kl.txt

    Filesize

    63B

    MD5

    270d7add87dff5d385b65aa9d56494fb

    SHA1

    54967ef5e3fb91ba85faf5b5cdd66f7ed04aef92

    SHA256

    32b0c4c288329a9cfaba3ca27ee0201252163d629373f9c0b5f95a293f14ab3f

    SHA512

    e1055b98639cf617db15f9a48909b4bf51b129dbc84b67a31e1a476659672b390f07b02bf98795458215ba88a20f2e66aa9c5b9b464cd962753fecfa7f1d1d2d

  • /data/data/com.legend.urge/kl.txt

    Filesize

    68B

    MD5

    ea3721bcf446893d470be1dcc11c4b2d

    SHA1

    c33527ab08d999ecda6e3b651533cbbee752fbc2

    SHA256

    7902c9ec9a1f61572a1f0c272a0aa6ba2de10d4b0e1c34522c294103d07c4193

    SHA512

    9b8c8648f52e794d9903ea08dbfb1124f683bb067bd6b807d4a9762b821b6bb9c1a04fa784018d78a2db4c2de571c5d25aa451fbafdfd3368b582436d4c21966

  • /data/data/com.legend.urge/kl.txt

    Filesize

    45B

    MD5

    2de0ca93c25e127fa7975aec400ab1ef

    SHA1

    3f52b680bed0bf3f93103ddf3f52d62318b6ac50

    SHA256

    8d887746dc223dbc9c59eb390f1c5108fb7abe3430457c7d487ef269aa661c61

    SHA512

    2d2d555ffdc319a2f158172c43ad00b2b7a564910795f05ea8e15d7d19a99ab4ecca2dadde95b204acdd13b64d25b815a2cbc5f9ea425839e6507f2102566603

  • /data/data/com.legend.urge/kl.txt

    Filesize

    466B

    MD5

    83f14cc8244b6c591e341ebebe3fa612

    SHA1

    858e1aeac3a819c205f2857f040b105349d65df3

    SHA256

    b9c10cab2f72632c1ed5d44e87b8e3bbf5a2a30eeb4dbec3c8a8d7a6c5a817d5

    SHA512

    213da523001ef79ac7713e297c2b74bd543b0a33ca87c9e91a2fa511a5013cb5600b616ccceaa2d7e7b5e677d4c78c9b3faf2cf2f7552ce54ec8ad70c7de86b1

  • /data/user/0/com.legend.urge/app_sheriff/GOGLBPI.json

    Filesize

    450KB

    MD5

    fed017e390c950e25634e69fd63f10aa

    SHA1

    53f8f97200d1e5810d14a3559b571046d27ff9b8

    SHA256

    765c6873f27be2ac563148e27992b75361b92dee36ba25b1475d6a106a120f40

    SHA512

    d37a93c20070e6b2077d91fcbf665a15655db1220b5e64251b491c42831f5070fcdcf4119ef4bbc865853ccca6c403a608b9895464ca20161406d3258a0dfe86