Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    07-10-2024 22:01

General

  • Target

    e9394f53ff9cf91193eed0e6004d76b851a77eb02b812a0aa2283a8a41433878.apk

  • Size

    2.3MB

  • MD5

    0d027d547631be3f1fcdace49a1409b9

  • SHA1

    23f463d463d6412162e072b8a5ccfb9e8f143183

  • SHA256

    e9394f53ff9cf91193eed0e6004d76b851a77eb02b812a0aa2283a8a41433878

  • SHA512

    a3170cf291059cd992d48f1e6e7b146b98e8fee6fa17e35f0326bbb3b9d0d2f0fd3443db5a44a3a12808fc0af0785111fcf9f84761f135d42f31f18d4f49625a

  • SSDEEP

    49152:5pV93bkJ3ufEUV1GtSUn+uwiUru14TQPd4zIljDpxkvAsb1fQ6Je7bKRJMSrIT0u:33bkJ3usf9+u6rYpPd4zIljDpKA446Jw

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.junior.wife
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4946

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.junior.wife/.qcom.junior.wife

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.junior.wife/app_hour/hH.json

    Filesize

    153KB

    MD5

    e38471e973ee07731eb42f48ac2426d6

    SHA1

    6a2cf2f22d33beb9dbdc3381ee9cda9e19893690

    SHA256

    96bd6691df79e9e5d2f066e1c9ac555532c3d8bb94fe1b1971fd9e79c9589d46

    SHA512

    a802f6cd03a1e9d0d81e9d1e8f0321dea1d76525aead8b6249433baa9e90d118189231b4514958828ace53fb5ec460f2c37d5023a89b794e1f4d5915738e1112

  • /data/data/com.junior.wife/app_hour/hH.json

    Filesize

    153KB

    MD5

    c0aad3672c6ada3a760f8d3cfb5579a1

    SHA1

    6ab61e12f0800e61b25daaf30857798ee8046f97

    SHA256

    622a93f5578beba24ddda55b56012c06e5d91741d5879977b8bc61cf1cfff5d4

    SHA512

    ace8f7fa7f4408f0dd0e6b3b25013f7d41003417de5215dae448cefedfd161ddef111eb2c6b492453bf3bc9ec106a02aeb743c01bad0f7da3d1318cb2acbdcb6

  • /data/data/com.junior.wife/kl.txt

    Filesize

    230B

    MD5

    7a87e9434705351e50c19da276297570

    SHA1

    56b79210efcd7a54e03b51d932a66bf382a80008

    SHA256

    cedf675d76a8857a8aa8e31da09830d60d8b800e563f87be21b8c6a8a7ad0e6c

    SHA512

    8ea71268663ec03830e10e12f445375b25847e861e92b1496ff74614c11227cc058ef6d6ec4472e02d960bdccb6bc6bff8e7783a7abea7e5e3fbe90010a0c0fb

  • /data/data/com.junior.wife/kl.txt

    Filesize

    45B

    MD5

    1bac68aeef285aaf4cdfe57b7865cf05

    SHA1

    6c74ab28ff0f9078552c8a077edf650a55c19661

    SHA256

    51601bc2177c3d979449318ee1b5f83e22c17c430870dad4f0bda58b2c76318a

    SHA512

    798e699178a7252d5cba8faaa9202369b0733b2fb98c376e7bf7e093e567e897e12dd541ce7a397a67fe77183a24cb0110c86b772d2e77f223ce930c030fc2ea

  • /data/data/com.junior.wife/kl.txt

    Filesize

    63B

    MD5

    249efa2b68ca9ece5e0514f045e17468

    SHA1

    9118910ee101dc983b20751448496a22465b04d3

    SHA256

    91528677fd3bf3b3a0d21b292b97e5ee311f1153b48d5842a17345cd3b974712

    SHA512

    2ce56ea33adfb98eb4246bd4e11c9b07fd6199fc818d3386b466e7ecd6d383294d4f848f64b58434fcb9c352afbf965c4ac15843238e94bc98040709c3cf1985

  • /data/data/com.junior.wife/kl.txt

    Filesize

    45B

    MD5

    2c653e41a972e314d2a58c2bc6de8d13

    SHA1

    6bfa9200844553a6e40fe4fea8be8a9c6e45e3af

    SHA256

    0b297d23df5fad2ecc9f1efb702f7fe740c4000c0e17becccf173f06dfca47f3

    SHA512

    b340ec1c62952dc878632d99ac9c02dce4acfeb4fd725182b379899ad70d3f85f631891a1693b5fd3936822fe8bb4f5ad31b678a1a0e3d20fe951ded323cc869

  • /data/data/com.junior.wife/kl.txt

    Filesize

    423B

    MD5

    45d201c0338c7525e653f24d57d407ba

    SHA1

    d73171344bc9557ff046ac2d70b9281e1b9db610

    SHA256

    253ffec23abbe86e4e53d6c8415f73592fec02608e5217104bbbd90a628fbe7c

    SHA512

    ddc9cc936edec9da887ad56ebcd5d48f8c37320a4b8e4e27017fae5c7e702aad04f0efc1dfb7880707380d7b0f09c7a3822c39c8bc3c9db50351997aad1b1c05

  • /data/user/0/com.junior.wife/app_hour/hH.json

    Filesize

    451KB

    MD5

    c4b4233062dab99df49518059dcfc203

    SHA1

    9ef114e3f4c621a1cd7c8d50be4dfe25f6c44302

    SHA256

    a6ae304ce38fd16354448981b1065a0e88f4169052dbe361afecc09faba26c27

    SHA512

    7ee0578c7dace9e35eb1fa6f416551136d265cbd3ee34ea4ed439e80e426e1c22de87d6795735f25dec0006374a1731dede5f5c438c79033ebee78bba3f41db8