Analysis

  • max time kernel
    178s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    27-08-2024 22:00

General

  • Target

    4a04b5136a5ded43c667ff9b702602b8ca90aa766413f761766113a6d8965601.apk

  • Size

    2.0MB

  • MD5

    90eaa36290d4c462c8fc100309953631

  • SHA1

    b4c0eccc1095819a583f32530a6cbeb903915935

  • SHA256

    4a04b5136a5ded43c667ff9b702602b8ca90aa766413f761766113a6d8965601

  • SHA512

    3df55b89adc0f1cedd741d0657b1d2120633ffbade6ee403e2dc2d4f2af6190f105c1255bdd98d9d2b44de18fc9aaae0d251fc4fc312286b0bc56947395def37

  • SSDEEP

    49152:HrPgV32UvAvK4uq8Q8YCDZOl4IzUg+4YTWSAVXGJPRBlckBMxLs:H7GovK4uq8Q7CoLvNKxVRBuSMxw

Malware Config

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.cereal.defy
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4307
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cereal.defy/app_hungry/XQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cereal.defy/app_hungry/oat/x86/XQ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4335

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cereal.defy/.qcom.cereal.defy

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.cereal.defy/app_hungry/XQ.json

    Filesize

    153KB

    MD5

    727b31f7acbbda9a9ac683263e35b685

    SHA1

    eb14cdd376d18e9abb41a281a861dc2a83ea2939

    SHA256

    ba38a170877f1945d145c3294c37bed87e34a6b8723f7d0d401e96a08ed0ce51

    SHA512

    918b46c00443516b275ecfeb7790b689db932bcd815e5a67fd4b7c7c0ebb3ffb4aa1151c3a75c98fefb9343aa5745f160e51bbb1c7513db7dfc7159d86de43ff

  • /data/data/com.cereal.defy/app_hungry/XQ.json

    Filesize

    153KB

    MD5

    2a7aba1be2f161b465c2d08dad2da926

    SHA1

    9f51b9b51e685387a39c926f1d6415d00e59158d

    SHA256

    8bbb8df877b5c71aba15a9c640065707fbb31fe85f457876dfbe53aa5ab5127f

    SHA512

    63f434398707d2838e771aa0d528c24748aaad19e218b0e3310704f68398cde63217753bc4da562203de70d377650720a95b135b1402a42b5c9df0dc5e4c12fa

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    63B

    MD5

    8ad964a620d93598d140e78b39190b0d

    SHA1

    0abd86a0f5df92a72fdc89fb06bf4592dc0d62a0

    SHA256

    9c4cd96ee80860eda85a1a2d55917991e8f8f750cf401525274db8bd59dbfec2

    SHA512

    383afbdeac8d98665bf429cc9b4b878146659b33f3512fc0683b23c422d26e9900834c9cdaa60d255374301d8a16d3e9766cc2e06707400aebb2862130f10852

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    423B

    MD5

    3e558d20c64dcb1e03a8fe14822f71ef

    SHA1

    599d790a8232b5f314c6944fa36ce10a2314cb22

    SHA256

    4f1878f7859cde38cb667374bbec8bd2927e12d5a0c818beefa8ac6d84b27af4

    SHA512

    d0ec1e899a18690deb25b2a7dedbdf0e53654cc5a8ae9a36d64a7c101c8854d9e15ec851f02aaad651e2cedb8a74e576f9808f5862d3f021791c0c5041f7710f

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    230B

    MD5

    1bd30ad9d00ee39137bdc3d3a0383fc0

    SHA1

    56cf548e546eac4a8fce776ab3013a2c84dcaada

    SHA256

    c2ddf6dc75d64b9b53eb061e27c8417a1a9573feb6dc5811e95b6731754f18b8

    SHA512

    a72bc55d8447c8822ebf84027834b08589e0e57f7c37a9757932117e3cc935dcb075cdf68b3e9e857d1056592967dbbadfb950f0ad00d8eb889a1ca12827c198

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    54B

    MD5

    4a7395608c804e4c9987501377087b21

    SHA1

    bce20d9c19bd1aae4902b4f8e0ba7ede8f07fae3

    SHA256

    7b10deba85a98a6a79aeaccfbc9bce17fd342560dd4060fc4778b3e2bd3cd8f7

    SHA512

    f83a7a86a1f1212a0da3fbaaba338f0f594379103bee6ead4a2f0f0d8af47532a6dad48e8ac8dd05749201044a16df59ecb263910c88c8952250cb78d598bc7e

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    68B

    MD5

    bd890ea5b15349802008b1f6b38d8c14

    SHA1

    3b2da09d7102934da4d77c6ba413e7792014f9c3

    SHA256

    aa3bc64e5f5330c75704eb474faa07a9d413b1c1d9a2605ee52de6a8526cdc8a

    SHA512

    83f66187352f0adecfff77b0ef9ceb2990dcea3c8d51c98d1b6accb5ea22d9e3f552f0dc573690d9dbe4a26ad7e58e7bf52ec09a28130e74eff7f49a461a02c9

  • /data/user/0/com.cereal.defy/app_hungry/XQ.json

    Filesize

    450KB

    MD5

    eb3d46a51966ba607d3e3038272df46e

    SHA1

    2ff376cfd82d8fcb10287cc9e5788b3931adae95

    SHA256

    0d6253b0b51cf7417313c1c1cd809e2e527926de71a57456a59d9d44b4417c11

    SHA512

    bab7bb6776ce70530c0aa5d69c65ff139bf4315f0319249b0c30152cb976c48effb7819cf053bf3ec0a698e025035ae843101d7c99031408f0306569da6fdd31

  • /data/user/0/com.cereal.defy/app_hungry/XQ.json

    Filesize

    450KB

    MD5

    ca79d21e94a2e1d8e655118c101f51ce

    SHA1

    643e3250d6bbd0c2070feb9df06abbd8de13e37a

    SHA256

    12da407a1fca931675447c4f7014f9a16522dd1b9b9eea2ae16bbba167aed969

    SHA512

    a1c3ea18075d07fdd63a1eafbbb273d62d70449d2b62044ff3b5705a7a83c9c3b7af4d70f73c793f38af16c9d51a45f07e45f4978e2790f232ec1b318e554d2c