Analysis

  • max time kernel
    178s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    27-08-2024 22:00

General

  • Target

    4a04b5136a5ded43c667ff9b702602b8ca90aa766413f761766113a6d8965601.apk

  • Size

    2.0MB

  • MD5

    90eaa36290d4c462c8fc100309953631

  • SHA1

    b4c0eccc1095819a583f32530a6cbeb903915935

  • SHA256

    4a04b5136a5ded43c667ff9b702602b8ca90aa766413f761766113a6d8965601

  • SHA512

    3df55b89adc0f1cedd741d0657b1d2120633ffbade6ee403e2dc2d4f2af6190f105c1255bdd98d9d2b44de18fc9aaae0d251fc4fc312286b0bc56947395def37

  • SSDEEP

    49152:HrPgV32UvAvK4uq8Q8YCDZOl4IzUg+4YTWSAVXGJPRBlckBMxLs:H7GovK4uq8Q7CoLvNKxVRBuSMxw

Malware Config

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://voranileximavor.xyz/YjdkMWRjNTllNzZi/

https://xerolimanorvix.xyz/YjdkMWRjNTllNzZi/

https://tarovinalexmon.xyz/YjdkMWRjNTllNzZi/

https://merolinavexrox.xyz/YjdkMWRjNTllNzZi/

https://zolrivanelomax.xyz/YjdkMWRjNTllNzZi/

https://karlovinarelox.xyz/YjdkMWRjNTllNzZi/

https://vernolimarevox.xyz/YjdkMWRjNTllNzZi/

https://solvinarilemax.xyz/YjdkMWRjNTllNzZi/

https://tralonivexomar.xyz/YjdkMWRjNTllNzZi/

https://norvinareloxam.xyz/YjdkMWRjNTllNzZi/

https://jerominalexvor.xyz/YjdkMWRjNTllNzZi/

https://ferolimanivrox.xyz/YjdkMWRjNTllNzZi/

https://xerolimaxonvor.xyz/YjdkMWRjNTllNzZi/

https://pelonivaremaxo.xyz/YjdkMWRjNTllNzZi/

https://tarolinaxmover.xyz/YjdkMWRjNTllNzZi/

https://lornavinarelox.xyz/YjdkMWRjNTllNzZi/

https://zarolinavexrom.xyz/YjdkMWRjNTllNzZi/

https://kolvanarexilon.xyz/YjdkMWRjNTllNzZi/

https://jarolinamovexr.xyz/YjdkMWRjNTllNzZi/

https://trevinolaromex.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.cereal.defy
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4340

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cereal.defy/.qcom.cereal.defy

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.cereal.defy/app_hungry/XQ.json

    Filesize

    153KB

    MD5

    727b31f7acbbda9a9ac683263e35b685

    SHA1

    eb14cdd376d18e9abb41a281a861dc2a83ea2939

    SHA256

    ba38a170877f1945d145c3294c37bed87e34a6b8723f7d0d401e96a08ed0ce51

    SHA512

    918b46c00443516b275ecfeb7790b689db932bcd815e5a67fd4b7c7c0ebb3ffb4aa1151c3a75c98fefb9343aa5745f160e51bbb1c7513db7dfc7159d86de43ff

  • /data/data/com.cereal.defy/app_hungry/XQ.json

    Filesize

    153KB

    MD5

    2a7aba1be2f161b465c2d08dad2da926

    SHA1

    9f51b9b51e685387a39c926f1d6415d00e59158d

    SHA256

    8bbb8df877b5c71aba15a9c640065707fbb31fe85f457876dfbe53aa5ab5127f

    SHA512

    63f434398707d2838e771aa0d528c24748aaad19e218b0e3310704f68398cde63217753bc4da562203de70d377650720a95b135b1402a42b5c9df0dc5e4c12fa

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    214B

    MD5

    a6b2dd1d8d5ef98c36390020004a755a

    SHA1

    11ff7dd55285e121cd3f5f0eb9a656fed86f3108

    SHA256

    25b74acdb0a14721e84e29e53a3398e87b9f37107baffb036f8005c59ce218b8

    SHA512

    4a291a707a93a9923954b9093ad6a5cbbdae878b9cc538a07fd9d104366f367b802368b799a31884f5c5355df3b2e2b16c25f8de4b51c76f99f5e81caaefd10d

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    52B

    MD5

    01d98405b453e31bb5612165bd2d0564

    SHA1

    f98710fcb35b373e028fe222370cfcb9f78187e9

    SHA256

    6fd280662ba3568abc0998b977a7771eb95a78a5eca8ffb3420266a267af9e92

    SHA512

    78d67594866c8b22ec7b079548a773051679ffe5b42324b525ade8a486d5c0fd3982cd0d320cf15fa0edfb67448cea47b8a54bba4c5303e3347b72bf90160452

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    70B

    MD5

    04bad08cd642d83cb2f3e288eb95a938

    SHA1

    64f9e23307422344e946ee1f1ce6dd5f2bd003fe

    SHA256

    fab7d79dcbb06d60d38ceb1c6c1610bc6d73969061498a27a74da8bd2dad4885

    SHA512

    16de3d7f53bb5425860db79f93602801fe389260ff26d7e4dfa5d86f6947afccbf78bf30f7e1963739cb190724721e50c7a09cb59de77e9f3e6d8ab9e42b2e7d

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    45B

    MD5

    45f420d74b7a377b58a2fb33a98a4a2f

    SHA1

    fa5f71c4d0bfd3976f3c4ad1c32151a15edc4d73

    SHA256

    1d5c4ef3b7e96feafb5b2c681b045f2adaa24543f584a7ddc297c9741b559937

    SHA512

    574f5951783672761d19104a6b189dd851e1c2427af38eb83c460fec354b3332be65e098c2455d9037a4c942ebca0af5985a7bf04e0fceb5990f79ef24cd2d15

  • /data/data/com.cereal.defy/kl.txt

    Filesize

    490B

    MD5

    3e3813923df766fb181435aeb21cf4ce

    SHA1

    2a614e66c43504b7d108911efbfa26b4508d8f5f

    SHA256

    b060ff285082d1ad1c18408d9ae5797c10b49f0593362361e9543db6e97b91b2

    SHA512

    fbb3c7ba19ff33aa2396ca9908f61c0327bb5ae5eab3820d4d37142b1a598e2271513973599c0148a87aada0cf8cb60908e1a16206b6245159b2d2992b1ba155

  • /data/user/0/com.cereal.defy/app_hungry/XQ.json

    Filesize

    450KB

    MD5

    ca79d21e94a2e1d8e655118c101f51ce

    SHA1

    643e3250d6bbd0c2070feb9df06abbd8de13e37a

    SHA256

    12da407a1fca931675447c4f7014f9a16522dd1b9b9eea2ae16bbba167aed969

    SHA512

    a1c3ea18075d07fdd63a1eafbbb273d62d70449d2b62044ff3b5705a7a83c9c3b7af4d70f73c793f38af16c9d51a45f07e45f4978e2790f232ec1b318e554d2c