Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    08-10-2024 22:10

General

  • Target

    847d9eca3b69a4da317f77ce976c204087dd1aac0f38be1a228795853144ddd4.apk

  • Size

    2.2MB

  • MD5

    a8a5d6c6f3ceb85fac9ee2e3db7fcd14

  • SHA1

    b6685e922ff529a1000f1296a8a0b64aaa3a0ede

  • SHA256

    847d9eca3b69a4da317f77ce976c204087dd1aac0f38be1a228795853144ddd4

  • SHA512

    4941d0a9e8ad281f79b90e68ebd1508bc27615ec9602b5f526065188eaf8dca1d4eefbf9c781c33c1ce86e60a10b6065fd4531f994862e10ff3cb3d65fe93914

  • SSDEEP

    49152:u8KXksvM0SlZ64Ghf6OK2zXUTAtRFCF85WkhuO9oK1aQBX+aSjL2OJe:u8MJM0ImSTm3FCWWeu3pQBXGX3Y

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.achieve.sun
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4790

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.achieve.sun/.qcom.achieve.sun

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.achieve.sun/app_satisfy/Bw.json

    Filesize

    153KB

    MD5

    e5a5835a1bf24071e62d1cc2c27a1d2e

    SHA1

    343bea01e7bff25c4aebee242f8a069a034f8c6d

    SHA256

    2dbd1804a632bc1a14f1abcd1dc03cfa1d445500ce238c9f9a6bd5d8fc35b659

    SHA512

    a11dcb050d83a345409af005e6bd109fe4345379f248dea3a0f500316cb83c679c8f4e050524d81e5d763ab5ba6fd38a12d896ecbafa5a575df821914632aa80

  • /data/data/com.achieve.sun/app_satisfy/Bw.json

    Filesize

    153KB

    MD5

    ba3a0f57f291ef2a96348e9c025a6d8c

    SHA1

    e13514dc73f29a31f747919eb67c0a67efe5ebe7

    SHA256

    016432dbd25ed897ce19db1594bc86dde51d5cad8cd91bfcd6809d56bc21cfed

    SHA512

    d3c47b595492db2d26eaba4d6ab7e2f8fc4ea40d5a11524db92e6bdca9ea5066a9de9abc0246903573de4f7515b64305b166ce258bea137a32db92e306938856

  • /data/data/com.achieve.sun/kl.txt

    Filesize

    230B

    MD5

    4fd611f883c02afbb867042a4e3c108c

    SHA1

    fbc15dca784de2f0cb65b5cf4ada1a9804d20a31

    SHA256

    f84f6fca4c9652432b110b8c558fe3f83ae11c787bf4465b2a5280a4915638d5

    SHA512

    9197cd70c2902fde70345d28b798263800b4ebd9571b5b8a54273dd8437f18e434d808f1f0570371018dc66c90a909a21a018fd4e25fe645e8d1c69d186afffe

  • /data/data/com.achieve.sun/kl.txt

    Filesize

    54B

    MD5

    3af1ecd35d7a197db8a5f7e14da5d722

    SHA1

    355b85bdd79ab032b6247eafaccd9537ee0a5788

    SHA256

    a6415072315a5ae53b742c3aeaabb1aa7077dcbde13aff6af3c617b3a0995e30

    SHA512

    52ad42f9165e8329e1caabe953dfd1d63f574542afe64cf6d904859e6eee8f21ab5afe5022e8706bbb2b1c72a833547ead6620d8a6c254a3ab2ceface3df813a

  • /data/data/com.achieve.sun/kl.txt

    Filesize

    63B

    MD5

    8e32d298c44fc2645f2cda9d12bd45e9

    SHA1

    00cb2fb9a717d9e62d50b60493a77a70e76d676f

    SHA256

    1b30323fccb2401c3ffb177088d5a3882ebc9d9935d973132872de7131e21731

    SHA512

    161f13927ff32f21584caf86c9c2051d6bb2fa44248e42ce7377b6c76f3b98497330461836d8cbb014d951354bafe21c5fcd4049fdf2aab95961db119b15b246

  • /data/data/com.achieve.sun/kl.txt

    Filesize

    45B

    MD5

    e158181e93c023f1f773e8527fc1e46b

    SHA1

    a4316b6517264e89ecb457cdba522bbbe809ffaa

    SHA256

    3751077a94d62f5088e52bfd16739ebaf929418a79b5b7b4565a189c1047b15b

    SHA512

    0c6ac7750123de40104e93294c0062d293cf51a54d0270615df4e41ceb5ca6552c64c377609be00bad15f9b2ee6d93c9cb98c2b4d040ba98d53b11345e26043c

  • /data/data/com.achieve.sun/kl.txt

    Filesize

    466B

    MD5

    052aa84c7aaeb1778d9d88dbd1e15c5c

    SHA1

    1b8e29823be8e2f8a3d03568eaaa6d8fd363685f

    SHA256

    21cc87fa93f5ea3726da80a6bc96c573a889cd8a9b274bbec1d5fe3fc72fa005

    SHA512

    8d23c6fb8c7f4572d8cfc0cb1bd636ff4d12677d060321235000f5d1c679a1d341ff2171ef68a58f37b3eec7d5d4e04b309651f7d5e77e970fd8f126c8ade974

  • /data/user/0/com.achieve.sun/app_satisfy/Bw.json

    Filesize

    451KB

    MD5

    b8aea39fdd4ae22a68ab500c5dbe8fc7

    SHA1

    6dd0dee9ccb9dd180ed85f5bae91500d18981551

    SHA256

    d877416bc66e9f2e824f8c7c432d87f4e413707b7b3e6a80fb4eb3fd004e1360

    SHA512

    d1802448135f78d01d2bf136db695a01ca8c5168bea2468ca2bec460c7a80fda782d404d9c8e2c29bd0b9e4c9c9a4d23668cd58fa916a4febf227ce8a244183b