Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    15/10/2024, 22:06

General

  • Target

    fcaa1137103c8938829fede7d1a12faaf5c47252a6a05fd51996af0bb2253bf7.apk

  • Size

    557KB

  • MD5

    97cbc725974e038782ce2c336c57ff10

  • SHA1

    efd56c9d5cf21439b375b17156b1097ad6f444b7

  • SHA256

    fcaa1137103c8938829fede7d1a12faaf5c47252a6a05fd51996af0bb2253bf7

  • SHA512

    f1b4bb480f7ad4717acee436cdce431514461fdd7156bb3c32b284abfc3de2da9f88fbbedea55d2d0e18479bf97d80c7ef6ef7a9321284b03192a2925661193b

  • SSDEEP

    12288:P4GOWAU+XINlrkZMLZFDfqONIJcp2AJEsE4LzLWKYnWJOmX1Efwo4:P4GxAU+XcrkkZFDiOQAesE6XW4JOKIS

Malware Config

Extracted

Family

octo

C2

https://guvenilirislemlershop.com.tr/ZGFiNTEyMzU5Njlj/

https://hizliveguvenilirshop.com.tr/ZGFiNTEyMzU5Njlj/

https://guvenilirshopislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://2guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://3guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://4guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://5guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

rc4.plain

Extracted

Family

octo

C2

https://guvenilirislemlershop.com.tr/ZGFiNTEyMzU5Njlj/

https://hizliveguvenilirshop.com.tr/ZGFiNTEyMzU5Njlj/

https://guvenilirshopislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://2guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://3guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://4guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

https://5guvenilirislemler.com.tr/ZGFiNTEyMzU5Njlj/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.waitbigubk
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5121

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.waitbigubk/cache/itnkou

          Filesize

          449KB

          MD5

          9079bd7f9f6a6ea34c2f5cb31a6abc66

          SHA1

          f7b39b0fa6be618e26f039d00a7d1eb3fcd03d14

          SHA256

          2b813b42d35f2bc575ad767deb25dc382a6e6dcf835ce13cf47a6cf4fe4ba030

          SHA512

          55f0d2b11e3a1662144c741d0f2e2538908605fa255652a0059412fa9a43c5be78b59d574e15201dc70a3460efd55842f958f8b2bb3402cec362994ee49b1d9f

        • /data/data/com.waitbigubk/cache/oat/itnkou.cur.prof

          Filesize

          448B

          MD5

          9ca3c942c83d0478fddad4ee092660e9

          SHA1

          c927011964842d82f631b008aa35ba39ab0929af

          SHA256

          e508199e5f189a65242285a7d78d0ff8757a65cbe49660d9937f2be100432552

          SHA512

          62df7ad9b47aa52e17ad560847b1555c7a00ac76cf5145a6a0f24bb67ae5d1abb49380731fb48ff347cfd182ba15dc351aca0e499e58d815f83132a6c5876670