Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    08-10-2024 22:01

General

  • Target

    1472c28ac04339cb83531b129018b1d671e488187da4e88485873fce5788d842.apk

  • Size

    1.9MB

  • MD5

    74374a09a8256897f9c780182700248c

  • SHA1

    2348ec10bc5f8ef9b64ee141755cd3ddc025567c

  • SHA256

    1472c28ac04339cb83531b129018b1d671e488187da4e88485873fce5788d842

  • SHA512

    332eee2c62f145350297c6ef739a3f9a9dd1d2d8f9ebe347e397071dc0213006aaef36607562e00fbd45b7715f8be5d94abb5c7c83a3cd6a0a8b1a4856505c70

  • SSDEEP

    49152:J6iFhSjgRgxBBqfjqKBSRJ7gtkl6K9mQ1k+aSjL2sSU:nBRgrmjqKYrOvKIQ1kGX5

Malware Config

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://teknolojideyeniliklervesontrendler.xyz/YjdkMWRjNTllNzZi/

https://dogalyasamvetatilonerileriniz.xyz/YjdkMWRjNTllNzZi/

https://sanatkulturvesosyalyasantavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gezginlerinyenikesifvedeneyimleri.xyz/YjdkMWRjNTllNzZi/

https://oyunvedijitaldunyayakesfet.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalbeslenme.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojiprojelerehberi.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatcilaryolculugu.xyz/YjdkMWRjNTllNzZi/

https://modavesanatdunyasindakiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://egitimvesosyalgelisimklavuzu.xyz/YjdkMWRjNTllNzZi/

https://yogavesporkocluguprogramlari.xyz/YjdkMWRjNTllNzZi/

https://bilgisayarveoyunseverlertavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://fotografvegezisoylesileriplatformu.xyz/YjdkMWRjNTllNzZi/

https://yarisvedigitalgelisimprojeleri.xyz/YjdkMWRjNTllNzZi/

https://yenifikirlervegirisimcilikplatformu.xyz/YjdkMWRjNTllNzZi/

https://sosyalmedyayonetimivegirisim.xyz/YjdkMWRjNTllNzZi/

https://sanatvetasarimdunyasiyenilikler.xyz/YjdkMWRjNTllNzZi/

https://bilimvegirisimcilikrotasinda.xyz/YjdkMWRjNTllNzZi/

https://dogadoganlaricinyasamtavsiyeleri.xyz/YjdkMWRjNTllNzZi/

https://gencgirisimcilericevirimdunyasi.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.denizbank.mobildeniz

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.transfer.act
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4628

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.transfer.act/.qcom.transfer.act

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.transfer.act/app_coral/qTmP.json

    Filesize

    153KB

    MD5

    c2c40a0c5640e6462236aa36745902d5

    SHA1

    41a9995ab271d01d3f75cfe7eee8455605c1471b

    SHA256

    cc2a80521a86b19c7b8e6a3b363b2bb123006d203f9631df21a84a619ec5cfb5

    SHA512

    763b1b764bfe14816873cb9ea285ab92d0fd10c6bf24e6738fed606afe6d6a6d9b0eb879feee1c6be05f74618f2ccad484f3670ac1cbd72ed5815f8f187c4932

  • /data/data/com.transfer.act/app_coral/qTmP.json

    Filesize

    153KB

    MD5

    0ed023ed13d3e5d9a044a2cf6c43bb58

    SHA1

    145e87e209ee2405c92cd891ef4aa45bd9f0151f

    SHA256

    b2b2e5ae9c25c465738791e9943ee1bbf050348386841457b8fba91e0821e5fb

    SHA512

    afa3787c2a02249e992fedd05016e2b7790df22354f2f2f9bcf784501ea294a3c8d81f7372edd89f29732f004926a67b442211a1bacc1cac5f2a85ff8a9fdcd7

  • /data/data/com.transfer.act/kl.txt

    Filesize

    230B

    MD5

    4f848ffe37f2dfb1d8bda3ddbd976d94

    SHA1

    ceb79bb0c73d1892a53352e759427bbf4fb03ef1

    SHA256

    e400760a89df168516d70052fe71bfb6a2fa9b13c90bc2685dfb927d8e2c050d

    SHA512

    9e94e97980031e4853bac7cbc11642f78c0911079c100d0a283e061beeda3ee3df10f82b1b6bb64ac8737656f668314ac217647a5ff36193fc92001d823b22e0

  • /data/data/com.transfer.act/kl.txt

    Filesize

    63B

    MD5

    a45d50ebded22d5e02ec9d4dc7851b3b

    SHA1

    779612cba6873e027c65a2d906b699e5fa469f9a

    SHA256

    d45091e4e421848e326339cf62c8440fc2b1497ff2a9a14040dd0a155622c37b

    SHA512

    4a9f430b3b18b64dc857393b4583efb568dddc047e90a482f055fa62cc67114b3f7a9a49e872959d03ca34e892054304e1874f4f81cc55fb4536ff6fd6859a05

  • /data/data/com.transfer.act/kl.txt

    Filesize

    68B

    MD5

    bf633da7f0a01dfe3337f6dc26edb72d

    SHA1

    1ac11b7e6ff543140f7f51b2c13d4845e81fb7cf

    SHA256

    7738dcb2fa3fe8b4a6e31a1e1f036d08269cb8dc6d4f3693e4d6b0a1b9ef7af4

    SHA512

    321d314c64bc22b8b5b5924378ca87590e73ce717ddf5fa56ef3aa4be44fd86a1c8e2fbfeea11fa04966ae4ba7d1da3c25f4b85164092760e232f26b3b8e14f3

  • /data/data/com.transfer.act/kl.txt

    Filesize

    63B

    MD5

    2fa2d02ae237e045c3c5f0870387f0c8

    SHA1

    34203928d3b7e27ff227dc212cd1fd6a255ed115

    SHA256

    cdbdf3ec64c95eaf44609a6c24e5b712f5d348e0fd41e02456b4b94ff6d3e0bd

    SHA512

    8ea6b3a5a345f2fe3f0a07fb5c1246dfb1dee4c32b2853799c8190a2f7d023df1218b7759ee6450c962f8f97f9a11c4310ed73767338483f77044ff8ade55102

  • /data/data/com.transfer.act/kl.txt

    Filesize

    466B

    MD5

    b1fadbd2899666564aab0926487519cc

    SHA1

    e517ed3bcc96f417095c7d5e8c124d6573600c21

    SHA256

    b97b4168817e3c198f9090ec0b6979fb6744f10bd3198b284406d3a3297c6e47

    SHA512

    a8296563f75e182adcccd601a6f836f40bc7b7cdf678e1482c2d1a93e677113875e98e41292b3dc9bdc00ea518e5bd87876a5b6ed2d7bc65783474992caa8cdf

  • /data/user/0/com.transfer.act/app_coral/qTmP.json

    Filesize

    451KB

    MD5

    67267c5f9994429e24df53a39266f5b0

    SHA1

    1379075c5b44db4743deccd5807bd20c1bf381ca

    SHA256

    be2a3155576bafcf6513de1ea442b47048ef2cc14232848e94250d309421f32a

    SHA512

    d438765924dc95d094cd218b65a2f218a1a922d4e0943475d14a1f79e9401117b641bec4d5c8bab2ab02a292d937a4307feff113e6d47add74b688a642678687