Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    18-10-2024 22:00

General

  • Target

    4191451855d021e0f02b557f627e6be5467e90f47593eede222029de63268915.apk

  • Size

    561KB

  • MD5

    b779af4c772898ef92aed1471b48a162

  • SHA1

    45a67e109965733014172894022bcab82245b308

  • SHA256

    4191451855d021e0f02b557f627e6be5467e90f47593eede222029de63268915

  • SHA512

    562fefa793319d596710f6dac72cffe98173b70d522eebb084f529cb58d88a1d5fe7e83c2537f6fd773f71c4232a73a48ebde6527e9955fcc051c3c99ba29d74

  • SSDEEP

    12288:URcUbHeaxeV7HCn2njR9amaW1e7Unmh5X5rRuVxhiTpcO4z/AnP:URcUbHeaxQ42njLoUn68cdcOHnP

Malware Config

Extracted

Family

octo

C2

https://pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

rc4.plain

Extracted

Family

octo

C2

https://pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://2pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://3pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://4pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.samsung.android.messaging

    com.google.android.apps.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.moneysing5
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4493

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.moneysing5/.qcom.moneysing5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.moneysing5/.qcom.moneysing5

    Filesize

    87B

    MD5

    b7d6a208b2580ee030a682024c711d39

    SHA1

    27b12348a967a767860a203018be0ad73a815c61

    SHA256

    cc37f80704d6c084a3ba9f8ab6922a721e0c54b55e787cd56d5cee5fff11279e

    SHA512

    106575efd573d576cb2a162f914574895e5cdac2e916435264fc8ade10bb1ccd936263b2675fe8c29044767076a0165d6639b0d7d7158c38d9244ca352abfcb0

  • /data/data/com.moneysing5/cache/nnedmdoigujh

    Filesize

    449KB

    MD5

    12673e7b50a0158884c04113e192ee05

    SHA1

    f60dd16294dc2159c416c5beada1eac9efe0ac70

    SHA256

    031fae3e932a751ac29a54d398fc54abc28ceac829b502832bb82f57ae12249b

    SHA512

    91c1ad0ac79701221edca9abff4e6b6561a5fc30c9409319340fed0912f2a03acfbfca2b9dfc39092c7f309f4bde47a77c57e748c75f4881de3d3ea557c1c1b0

  • /data/data/com.moneysing5/cache/oat/nnedmdoigujh.cur.prof

    Filesize

    390B

    MD5

    02cbbda514aa07dd1ed1a1b230f88b8c

    SHA1

    dead2fef67f332797601112495b560fcdfd16a21

    SHA256

    2819bb8d62809458d5c80e5d9bebfb914c298e9f9129436898e8a8f6500f4b89

    SHA512

    029301610d0754cdaa6fe3d07414776be4cb0933c5b5341610cdd45d4e4173168b2fa18498c92ba398a85c36eb3b67b8303dd667f2fb4a20563a2e14c1e963d6