Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    06-10-2024 22:00

General

  • Target

    c4a79920699132ef386a6f32ee87b61767b0fa6f888a76869f9f6d730363827a.apk

  • Size

    2.2MB

  • MD5

    f09c37c2859f600ece925087a9eff353

  • SHA1

    0e4712289998da078909ae68673e7bd4cb337350

  • SHA256

    c4a79920699132ef386a6f32ee87b61767b0fa6f888a76869f9f6d730363827a

  • SHA512

    83d4f978a6b698b6b92b1eb734d73ae159de9b7641f749dee089737b468610fe345c401a04295b5cdc9b3a9a9f35da1a83d1674015d5701a0c244e0cf708147f

  • SSDEEP

    49152:y5EE+aSjL2SrCe4405YHTz/Y9YwVt+c1a9oKjiN2QAEvxZWHRL:y5EEGXjCe4bQTTkYm71O6DAEOHJ

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.today.true
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4315

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.today.true/.qcom.today.true

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.today.true/app_such/qk.json

    Filesize

    153KB

    MD5

    d1288e7df1432ea6cdee66f23523b600

    SHA1

    7003dfcff60259289ef13f5df21e807b31b9213e

    SHA256

    304056e7578b82fbc2336405d61bca1e9580acd8152f2f461b9aa94bf088c8a7

    SHA512

    30d30a667973688210700aefaad2833ae3137941f57ab303fb028e9515e0db99997f54ae63577b211426b6e5eb24c7bbaea04c3eb8a8ebff26c010f52eeb2837

  • /data/data/com.today.true/app_such/qk.json

    Filesize

    153KB

    MD5

    df2c1c5ed2a474623074722f97f522db

    SHA1

    ca6dcd38e6a8590b1dcf0e08ff5068bc951b502c

    SHA256

    7e30ab6f515c269c9a5ba15ce7a74d6a8ffb3c7b34741205a466890c7fb2e2e4

    SHA512

    c9fe634a998f265b77a4d05524c9b38d4bc8431270123d2ed7049990f42e2e28609ac97f0e50a58240f6638620f3aefabfdd3f021347ee104eb1d56bf8a8f8a1

  • /data/data/com.today.true/kl.txt

    Filesize

    214B

    MD5

    3c2dd61194519b61585cf5affce05087

    SHA1

    e662717af78d3cab3c825f3e624717e2aff76649

    SHA256

    2776e6b8a9d07b4d1a1d54c5d8b8c15e3b80c9a8641a9f809b137ee911bac777

    SHA512

    8f7149778bc87e78447102c6eba0682330bb2a631e897075dbe2f6200a4db799c30e5dc2dfb69abc90559496cd7c87759654a7023deb1d265cfcaf390f009f95

  • /data/data/com.today.true/kl.txt

    Filesize

    52B

    MD5

    33cff00d7d808dd47e3af996c2e212ed

    SHA1

    69eeca127a8f4885497864237ede63d01d71eae2

    SHA256

    fdd1f605cd53b8cbd9d8e1b371d3140f84bf0e139690377ced72b0e8d8966c49

    SHA512

    6c0fe0eb9924f8bf2982b65db4694bfc40653a653f9adf11364a4fa48c60a30a080a65826fe49940ebf120a20fde0151b25fd7c0ca1508ec3d0b0585e02b6cca

  • /data/data/com.today.true/kl.txt

    Filesize

    70B

    MD5

    ac356ffe1f82983104c076d02c2a96fd

    SHA1

    9bf535ca882d5f52c406b88a14a2e8782ce6f2aa

    SHA256

    40e2a6de662027cf50c83e4db6e7dd0755609442774f9f50422830b77b7ae74c

    SHA512

    672fbb69366438da6c9e906f75ec3358c0a79e605ac5015c1411682b8018c409195ad2ea9fb9fa309c9070f8b19b1c52fb71e36920527908ff57f72373f0a4a6

  • /data/data/com.today.true/kl.txt

    Filesize

    55B

    MD5

    46f41b57c18151bd7e065dfb627728f9

    SHA1

    9dcd179406c7d7768ab510bc62e9b702f6fb4dfe

    SHA256

    127e1b918729e2ea72f78cae6f208ed178394a9d4e4830cd81c5386d71bc8703

    SHA512

    7bd26263ccfc3eeb920b114def73227138712291d739eb648c54aab2d5ec9ce15c30807efd1ad2caf7975969bb644f1d7f266a329fa71d0525d5b49f78b526c6

  • /data/data/com.today.true/kl.txt

    Filesize

    490B

    MD5

    45673984c6c3c6f020f74f5b249b7daa

    SHA1

    a5934941bd3c97c0274bc5d3a3c0840345006e6e

    SHA256

    7c8ec2fa5766fb3c82f038f4ebb222bbd8cfddf3cfdee4aa76447cae3edd1f76

    SHA512

    9f6186ff69182530bdddc59331329b0f618d428df4e2bfacc4c3778d0a74738c195e994865ae4979297bd2b1ffa80fc1f37119ef41d6c08e1f8ccd792e870d69

  • /data/user/0/com.today.true/app_such/qk.json

    Filesize

    451KB

    MD5

    d5f1b90b98d99e59ed6575f3671d664a

    SHA1

    ea338b86a897d05c4258fc1854964e017405caa7

    SHA256

    fad53e666b81acd3cefa0672489fe060091221a83316fa01e79f1553d8237e05

    SHA512

    217c17c27f81ad8ed4e692808815af2cae89c2a7cfa643ad6ef6610d0fa26447d15c41c9831fbd078fd679a5149ff0f4fdd967f2c75f8216a918db0c7f637fa4