Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    16-10-2024 22:00

General

  • Target

    0c4cb8a3ed02fc4cc6ef3ef29c55f38a775db104b1b6490a8e9936832abec777.apk

  • Size

    2.0MB

  • MD5

    ca8b01ac56ef5217619b505714884faa

  • SHA1

    e9042a98d1c600b2ae652db1f74ea12aa387cdba

  • SHA256

    0c4cb8a3ed02fc4cc6ef3ef29c55f38a775db104b1b6490a8e9936832abec777

  • SHA512

    f7c877f9cb123a958446a67c777ad94b8d67a5caea0234fea2ff0a291e6bbbe09f1c43c57964238ae192bdf6d253e5960f104d8959d44e477498d7c4296be85c

  • SSDEEP

    49152:QRCMvQJjQaKYfgiaZUdzcsYHdtnSw+QaaCE7Yhw09GPZLZjUg2TRn5mkHnvvv:QRCuQJjGvDnSwGFROntjUgkx5lnv

Malware Config

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.spin.tree
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4601

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.spin.tree/.qcom.spin.tree

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.spin.tree/app_diamond/KOBx.json

    Filesize

    153KB

    MD5

    bbcd09d5f66ba0af8b70c4bfef5a5cf2

    SHA1

    c5ac563faf96891ab217fe7060f995cd189c19e5

    SHA256

    b8e0b06210ba0b2ea6afa277884750a52bc99bf9286284652a8042f8e57f5fe8

    SHA512

    52b1e960041aad25de674e88a78609f7ea6f39a88cc23067a31472da025800815c0c7dce22a04ce371a270062944164a6830780874af9fd40b38f527293db808

  • /data/data/com.spin.tree/app_diamond/KOBx.json

    Filesize

    153KB

    MD5

    6acf1b723e66a367946100ba1a14077a

    SHA1

    fc1a8078bc3612b4d1ef52c80623aa64d53dd390

    SHA256

    a1ebffef705d08af4de70381e5790f0dd4743403fd215ab841b6f7474a759c0f

    SHA512

    5ad33060207801de8e0b2388a896779c3a9256e5576d7e7ede0f9b717573833a1499c7de7293f6203ca099e806737e85e9d877b5e488c7f56350bf763a651166

  • /data/data/com.spin.tree/kl.txt

    Filesize

    230B

    MD5

    850b4aaca10a2c41943f6f61859bfc49

    SHA1

    d6440ff6736fd84af9a1edd8e715373d380554f3

    SHA256

    2c3e460f468e56c77ed9e26678b81249e3ea5e60991fa0914423e0ebc571b42e

    SHA512

    38c528b46a119c3d11fae3621a5002c3ce98c84759af8578ff4e46f4a3c849a6fe227330339fc47084ce10fe0e412ca341ea0c2b6cb19868b81d6338d458c70f

  • /data/data/com.spin.tree/kl.txt

    Filesize

    63B

    MD5

    8e2b17672751d6ab9f82b0a464e6dc26

    SHA1

    c8085d721937d4036d7756fe431322d2dd054811

    SHA256

    3069ca570f0356ab8caaf54e45568034722c3203a23307c66104553e19bf45ab

    SHA512

    d94fad6a30768b42dd9fc22df705ed12c8087a333005f486e8f4842de63b255a2c6912995ea9d7dcdf5a75c33600572514ce9a1c9d2d6915ec9d45b7693726b7

  • /data/data/com.spin.tree/kl.txt

    Filesize

    68B

    MD5

    37bd6d989cb7b85963f7e08d3422b864

    SHA1

    91ac82b9b7afe3959873114817c53d06ff6dc188

    SHA256

    4042bad59e93f656395a21502656e47fad4f1238589f2062007fe0760e8e79ce

    SHA512

    9162789e4b701f5f99c1b42b688b205bd7ff1cf6a8d1e7597dee9eef11d9bfbb4f4456e7303f0e21e79310a58e4204a517c61c0416c9a7b4f9213c24b5bc93c2

  • /data/data/com.spin.tree/kl.txt

    Filesize

    45B

    MD5

    39f50e95913959954c79a7fd14b02b7b

    SHA1

    b72241274c0445bc1570bfe3e11cd08de21bb22c

    SHA256

    6afe3e49df13a28be5e32c33d2f28d42d4b59b45bc6af1fe7b08c19c212430a9

    SHA512

    2b24bf7dab2a755a4bf0e6206be89fa445f3a401d21ace615584e03db00d651083be84744f0cdd79735af78d7f009b1216b45b5a8699cb16717191ecbc65f145

  • /data/data/com.spin.tree/kl.txt

    Filesize

    466B

    MD5

    c7d892805d0afec7982e7748e1314260

    SHA1

    0fdb927f8ebbc6def43b7e5303006db97c2bd999

    SHA256

    35a3abef245b08fc75a950689e4661c82c1d83d6eaba2567840a9121c24ea447

    SHA512

    ad9420ef8f493810abb62ee06a42688a39db8a4ec4c983d3990e67b463d02ce9a9878bca56e00ded67b18bc3ff27d86cfc815aa4c37bca78ccbda546d65ebeac

  • /data/user/0/com.spin.tree/app_diamond/KOBx.json

    Filesize

    451KB

    MD5

    d197d07c8fb9889708e780d0fd8524ff

    SHA1

    e667e6e320648a69651a4fb155b4a9f89e31b401

    SHA256

    a5de2ecb61463eb9aec24e014580aa29d6c7622d1d542049a113d8a5bd54dc40

    SHA512

    5679f0904bf89c004d9fd8536400b462a6b7de7e45ffd29a7647c52f550205daf5b927ed6a8fade58fffb9808361b7711f120ca5c2c539903b5e940c9ac12231