Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    08-10-2024 22:09

General

  • Target

    952c17fa57ea3646ac557df7a16fb0cd617d43d23f8a545837d1f54ebf7527c5.apk

  • Size

    2.2MB

  • MD5

    7b7b76d8a80a31dd61535202d2c0d24c

  • SHA1

    a38d3f23dd4b748d42fbbd82619f89a40eec496e

  • SHA256

    952c17fa57ea3646ac557df7a16fb0cd617d43d23f8a545837d1f54ebf7527c5

  • SHA512

    09ce51f4ac25bd931b4c71e18f3bfa4cb90c900221b56b5390d1cdb5c98936680b3e37f749c3fb41d64a7e702c5e2496913838647668adaadafdb873289be5bb

  • SSDEEP

    49152:tCjuP2QoUjGks4nnaA7kR5ep4OV+pAI7dYlfCySexivrLMj3VAnw8F:tCjg2Qozksoj7kRsp4OSAI7dYlVxisj2

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wet.thumb
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4639

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wet.thumb/.qcom.wet.thumb

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.wet.thumb/app_scene/WP.json

    Filesize

    153KB

    MD5

    0343e52fca72c42141d2dcf9101df56d

    SHA1

    cb19e4769d1d8655df2f4885f0cc42acb8ad5ca5

    SHA256

    a394128e6c9383c1173fbdd82a5a34a5d9778263d83efd6aa694864ef0b7ede6

    SHA512

    b6a2255dd210c470cc3ed19ebbf252a16fc222181ca10210e91d3b6b88d7d6d0b2c084a1a038894ea4da1a3d4c4fbb4ac49dbad7d86738864f66c42d1d1d3e84

  • /data/data/com.wet.thumb/app_scene/WP.json

    Filesize

    153KB

    MD5

    747cf382e5d805e605d2008da892ad10

    SHA1

    e6732fddf1ff508490f41ac279137001800d8f18

    SHA256

    207ab1c2b5e32b24f737cc33caf9a30de5e5a0bde901b5e3cc9231cc1fab5275

    SHA512

    c8bff13ed9a19d7d400a6c7ede6237b855b73209341e0d89cb89a3811f62773983d19fa2c69a5cfc3a47b3a944424f049f637ae6349574693802ea17b6ceaac3

  • /data/data/com.wet.thumb/kl.txt

    Filesize

    230B

    MD5

    a0b80ca2ba872e185f39f935a8ed18ed

    SHA1

    bb53866f30a5980a6b893666a69b2a1c4eacabfb

    SHA256

    33d70b809430338052c2b47d9a74b956b543c77db995d54e927da5c2db09f5b0

    SHA512

    7b4efe1d104bfe15329b8ce58cd469853bc2cb0e0635e3fb96c0822e16bc5e9f79ad0cb510e7220ff85b571690effa10cf31ba1bea3127d11e595f721f90f2b4

  • /data/data/com.wet.thumb/kl.txt

    Filesize

    54B

    MD5

    6b340a4d6ed24d018e1dd6fa08caf7ec

    SHA1

    ae5a508bd9db08a003bd07a1cb8ffbd4e4ee17bf

    SHA256

    623e7cd1c2d962f1f62b7d84c56cc670c30218745fd850b305f8837efa18c665

    SHA512

    c9e86e7244bc6dad9edd320d69e2d9e2f8bc4529ca1ed3863982de902b06bb6976e38e442a63b7c4cc815da19c3611a93dc02c86bed10b25d647d744d4adc96f

  • /data/data/com.wet.thumb/kl.txt

    Filesize

    63B

    MD5

    4b270de7d18b0b9fbc10780c62db9179

    SHA1

    6dd7a024f74283e17e7d704c296ff1b24f9b0a8e

    SHA256

    c70b4c7d0b07feac490b1fa5655fd35919be3deda41ea96773c8fa7279adb76b

    SHA512

    e09a6e7762a8032db65967ed718d41d28af31cdeb18590f94d76bd21a5b21f691618db31dd3f1c3455a555688d668fe08c2f5fd0151100686e1e1f885b40cec1

  • /data/data/com.wet.thumb/kl.txt

    Filesize

    45B

    MD5

    b76547fd57ca3ba6daa5b79788026f96

    SHA1

    559ef36865effabda9ce043fc13a675d8871d1a5

    SHA256

    17069f36b2916724baecddb5d9ac52c734d80bfb57e7daf9e1e753bd7b4160e0

    SHA512

    c85046d4a5cb189a25b5d90f0ae7c63a269a9e6e9b104229b5e45149fd926b3728367c3e54a39db066d95aee730ad6f2b60589b5b7a46f862ffd10a13f2f0a6b

  • /data/data/com.wet.thumb/kl.txt

    Filesize

    466B

    MD5

    edf6f8f10f39e15adcba992df37c16c9

    SHA1

    15e2ecc5d3858eabf48e4265277502bfd8cebb33

    SHA256

    b533cf46f7eb2e7619594cab7f4dd416f261329a9b522d9451efb034b8b2223a

    SHA512

    27236de5c0e552536e4c4a61bc81870bc6bb474b63e14c50553a73402fbea2a7d51f2c7be7d9fe1b8020826a5041819a9db9f992f3d3b624cc72e0c978da21a1

  • /data/user/0/com.wet.thumb/app_scene/WP.json

    Filesize

    451KB

    MD5

    a772cca3a2b2869b37349debb20d7328

    SHA1

    9cc1d53736464038ff66cd9ebb3ad84a4d998a02

    SHA256

    ce2827f5affb65cb3ddb8671c0dda8491d953531680d3fbd83ab1efe9c56913e

    SHA512

    e508c50d8bae0cf82183f81a90c5af72fb71bd6bec8659fb03956057cbb2b7760a1d3acbc5d5d7697712bc751f446ece037fc09be48117425dc95ed953b6cf9c