Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    07-10-2024 22:05

General

  • Target

    1068c7efb604e989a325befb199c8d68352d2b93b0afc09baae75a91985b75b2.apk

  • Size

    1.7MB

  • MD5

    149005fa43eb993b024ac56307511276

  • SHA1

    2e8cf2467233eab22cf3e9db3a24874f8c358651

  • SHA256

    1068c7efb604e989a325befb199c8d68352d2b93b0afc09baae75a91985b75b2

  • SHA512

    f97ef62461469e01fc1d174f4aa5345ebee1e42312d4ae0f18922b65d7c3c2e7da99ee94b64890f951ca02fd5cd0e668adf745a1a49d0266c6d2d697493c3af6

  • SSDEEP

    49152:1Zmcl1Jvm0wSD63sDuPfPauoWOjXxVWfIaQwjbExxZWQRI:1sclTOTSD63sDuXiu6jXjWfIahPE0Qq

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.collect.off
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5058

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.collect.off/.qcom.collect.off

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.collect.off/app_couple/qj.json

    Filesize

    153KB

    MD5

    dd56e341d168704f0d2ea4e8de259fde

    SHA1

    d2e1f0735ac9c0aaf02422b9f77dc63998cc2057

    SHA256

    75c03fdb64da7fe9548ca1fe33917c8821ff5ceb90de5e6165832ae3de7e7ba6

    SHA512

    9940cd1c2d84ac23b9e9b63bdb36623312e8244c151cbfeb92ea359b94d71c770fa661b3d8c62a9950b8dbef277f341deedc19c15ebc9fc65452e331f491223f

  • /data/data/com.collect.off/app_couple/qj.json

    Filesize

    153KB

    MD5

    8ad3cdf2a2b9cedf03af63ff5f903a92

    SHA1

    76338a36ec135c0188d5dfd2b0888ab28ee59205

    SHA256

    2671296d881d45528bfec5ce590bdb08a11d8435c899d5f1141fbb0f6e9ae8c4

    SHA512

    eabf55f357f8ea5aff2ed17ebb79dc393a8449b57272eb1b45384b2ead28f291fcf4c3ffad34d0629b5a8d72531f09b9e7f04219571d775b0af11bd637f88b86

  • /data/data/com.collect.off/kl.txt

    Filesize

    230B

    MD5

    5515760c341ced0b43771d994ad2cef9

    SHA1

    ccd4cd49b9ead78c630a43fb359c76195476ba5f

    SHA256

    823b48526ed58b89d39c3d6b62fb88c8a24fc83c2db029c3ff57f9626df44866

    SHA512

    e8bff6cf2e8bb134f8401dcc20019f05673848f2eaecbf900814eae995d8eb8e2f49ff5a5f433e20ee752bb9d59125035b267da1758b1e700630c07d0f525fb0

  • /data/data/com.collect.off/kl.txt

    Filesize

    54B

    MD5

    20ee6bf1845442748a5149b627f4a6d7

    SHA1

    5791e82bdc2794b1e0c6c6370db15d2d4dbdeb71

    SHA256

    349814432ba0d1fbad443672230c7c1a091139588fe2e7bb26ba721b4e76af75

    SHA512

    3138db73c04244f42ae1e62745361c952b78aacf6da3ff2d0e9fc95e491a1b48b68c1b943ce188f381c2352ee70b1146c7bc5fd9e765a441b0d99081cbf182e2

  • /data/data/com.collect.off/kl.txt

    Filesize

    63B

    MD5

    5ed5e03973ff71068358979da147edae

    SHA1

    deb734c6502ac662136a73440e67d7ee9af40682

    SHA256

    e57c1d4ca915ab01047a23bb9be4ab31782785cd7fb77f282589bead053d25ba

    SHA512

    de300bc89ce4efcf1a1a30e82e85a629710ff994aecb46f7fe46c56ef3838361a6fe44ea9891bc80c143d63eb96e91c3d3b9d77ebfc21acb1f45b7149f16296d

  • /data/data/com.collect.off/kl.txt

    Filesize

    45B

    MD5

    301b14930d9b900ff6fcf7d5e5254856

    SHA1

    709471d27646c45aba4dbae537459cbd03bdbdb3

    SHA256

    590d377708cad143433cebb9fb770baaae41b638a3d341a5f723f9d37f523326

    SHA512

    03cf7157638c5d6c8586605531dacbe70f2f950335df06b25f6365da31ba4ad6fd81cd2ac3f3bfbbb2b32fa7757f44222aeff9ad2835163a86934d00f97752e0

  • /data/data/com.collect.off/kl.txt

    Filesize

    423B

    MD5

    9db50f883bb6e5c2a6c5e1bc228f5b87

    SHA1

    63c4c9a2effd6c14da552dedb51b049543d1b188

    SHA256

    f745d205fefa75d20d5d6c1a912f2d9925157a56ec0fb0e9151b9779d2deaa28

    SHA512

    7018357b4a7e367b8003e311de2fd2c027c4a98f0c0596c5a1de5f76facc552c0c7b1ec039e17face31aeeb3a975eaf3a3437e5b3181958128239100af82a7ae

  • /data/user/0/com.collect.off/app_couple/qj.json

    Filesize

    451KB

    MD5

    0752e9a551c1119e5e45ec40465220d5

    SHA1

    46608a3e846f02bf0043c400ba35d1a0e9152bde

    SHA256

    a58ea1bc6273a2dedc67308f7c1c1a29a2a14411684856324bc21f599151fbcc

    SHA512

    b8409d7e613c95f245dced4b8fd0f4c8e25a6a61ed319b8fa9121598600833dbb4e04a3025722353c32f34fb6fc9e2a980118b6640fe25a60cd517a653ece340