Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    19-10-2024 22:11

General

  • Target

    817f2fb9d867dc6516a1a413c0887a732ee0d702f73aa93be16e5c3fed2a90cc.apk

  • Size

    2.1MB

  • MD5

    9a182858cb7067f00bb56fbc4e5605e1

  • SHA1

    a1adbdc635a3ce17d0f0a8e561a791a09286bb7a

  • SHA256

    817f2fb9d867dc6516a1a413c0887a732ee0d702f73aa93be16e5c3fed2a90cc

  • SHA512

    957f952265162039e9bcfb1882ee0c50eca4781c9c068b3cfb6602c7bcf9531be5abe865c2055bc5eae914089345891354504a6501d1e7fc617f2ee36a4c163a

  • SSDEEP

    49152:dA1TTyStath4oi4HgQDySYar60Rho9RtgqB4QQV9xPQPPFW6aY:dAJNtath4zkzWqHwRdB5QFwNW6v

Malware Config

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://yapayzekaveteknologigirisimi.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimveyazilimharikasi.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimveyapayzekatavsiyesi.xyz/YjdkMWRjNTllNzZi/

https://blockchainvekriptofinansuzmani.xyz/YjdkMWRjNTllNzZi/

https://yapayzekavegelecekteknolojisi.xyz/YjdkMWRjNTllNzZi/

https://robotikteknolojilerevesimulasyon.xyz/YjdkMWRjNTllNzZi/

https://sibertezvebilisimdunyasiprojeleri.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyavebilisimyenilikleri.xyz/YjdkMWRjNTllNzZi/

https://uzayteknolojisiveyapayzekakesfi.xyz/YjdkMWRjNTllNzZi/

https://akillirobotiksistemlerveotomat.xyz/YjdkMWRjNTllNzZi/

https://dijitaldunyabilgimimariprogrami.xyz/YjdkMWRjNTllNzZi/

https://kriptoekonomivetrendbilisim.xyz/YjdkMWRjNTllNzZi/

https://dijitaldonanimvebilisimproje.xyz/YjdkMWRjNTllNzZi/

https://kapsamdijitalanalizveveriharitasi.xyz/YjdkMWRjNTllNzZi/

https://akilliveriyonetimiplatformuve.xyz/YjdkMWRjNTllNzZi/

https://yapayzekaileakillialtyapi.xyz/YjdkMWRjNTllNzZi/

https://uzakgelecekbilisimplatformuve.xyz/YjdkMWRjNTllNzZi/

https://kriptoalgoritmaozeldanisman.xyz/YjdkMWRjNTllNzZi/

https://endustri4veakillifabrikalar.xyz/YjdkMWRjNTllNzZi/

https://bulutbilisimkapsamdijitaldonanim.xyz/YjdkMWRjNTllNzZi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wear.mind
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5152

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wear.mind/.qcom.wear.mind

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.wear.mind/app_present/OXisAq.json

    Filesize

    153KB

    MD5

    10d311dc34e58d7aba1e1bcf7c47f425

    SHA1

    836262aa78163acc9a09ed816d9682e9be4439dd

    SHA256

    2a3055d244c5e18d9a22e9ec93d04d97029c1d704436756b4a62c6b91c825497

    SHA512

    036bb657d77506d5ce141b26dc397596cf67f7c96b96c9217af4abfb83006ee918862101fd72e13bd712bfbd6176ce30d0c4e18d1ca035893f121ef74ce74501

  • /data/data/com.wear.mind/app_present/OXisAq.json

    Filesize

    153KB

    MD5

    b7fda7a09a5373e7b85c8e06600387af

    SHA1

    4baea9955900a7ae84555b4438c8bfd856196db4

    SHA256

    93fe5f4fa0facdd71670c6330ba4075c9268ee1be199b13a8ce662164bc9c87b

    SHA512

    4e5dfa36171f3de4d75b49311ebaabb10aeffe5977d9fd31ec4abcbbed0b6fbd6b177e36d7a4da1c9e4148d02118fea6d4582345fcc877c4887ac0df80742baf

  • /data/data/com.wear.mind/kl.txt

    Filesize

    54B

    MD5

    8ff90ba66ce4e195298671a24fe143f3

    SHA1

    53d27eb9c354e8b03b2a6efd8f52a399c2053bbb

    SHA256

    805d71b2736587b7c7992da33cc077ba5fc2f57f26883fe3d37a20abda405835

    SHA512

    ee60e0b03818b3191b4d0f0565389078d092d906a9dc50a53bda48812021fbd25902631b95f765fa668397003c47ca127e7c6d648e511bf901e4099dede1db96

  • /data/data/com.wear.mind/kl.txt

    Filesize

    45B

    MD5

    8f16501b13f43323ab10732321695127

    SHA1

    acbe2823d34147c6cebe46111735bd72c2ba31d3

    SHA256

    2ea374f3311866fb12a2da421c8f61ba7494e45828b295f135bcb5289c00a704

    SHA512

    0fc6a38f33e62db9299aac58956b6490586da34587edb068a7221dcfc0a6c19d5c6b2e3b39f5d0df795dea26736c58ab840e38f6900aae56e8d6c9dc7ce259bf

  • /data/data/com.wear.mind/kl.txt

    Filesize

    63B

    MD5

    27e2108231c968ea166f2762e79c3813

    SHA1

    4c1e6e6b8cd72a32e8e8708d54b49410c495b9f9

    SHA256

    2eaa865c5e8376c31e8cedc89b9b99ea8f1d8e35ac566b69d6daccc7c53d97d4

    SHA512

    024049697bb13ca2dbf84a300499bca5fdd16ebdae5d31bd63e3a05f6060c2b5b3676749456f0a10520bb3c02d1f341adf31a0f7dec01965bfe88a26f86938f1

  • /data/data/com.wear.mind/kl.txt

    Filesize

    68B

    MD5

    92abd00dd7b9e8f7757192da4ae4cb52

    SHA1

    32c8eda8e05a9d58d3ac270075d76ecebcb2e310

    SHA256

    e36cfae1fc96374e6fbdc3550ca223b374fdff958897fc6737ea54ed7a5ad29b

    SHA512

    f1dab2567dba1663314596be10778c54a9f6b4961c55cf0050bdce21b20c64b7c867f196ece376156d2a902b07a8b7037fe3c044056f89aacd17a23b5c0dc7b6

  • /data/data/com.wear.mind/kl.txt

    Filesize

    84B

    MD5

    22cb285814f12e4d28834613256a25fe

    SHA1

    8f3a266ddd52a24bd9a9eabbaad73ddd55d830de

    SHA256

    bff9f183b204ef4d0deb5e47da7e49ecc523542bfe966e13182df6f4c611e4ee

    SHA512

    b842558d8d05d1a759212602c38a16d20eccdd4788d929385200aeb12d2578439c96dcfe5f2dfc961a080184a6b6260d9edcb7968f11febe2f4ea8b386266083

  • /data/user/0/com.wear.mind/app_present/OXisAq.json

    Filesize

    451KB

    MD5

    29b7f0ff248d3576aefa3ee23525d45d

    SHA1

    2abe5e2960ea960b950ac17ced05e0a0c59bc3e1

    SHA256

    6a3145b0a032433a661438af915e1217a86824940c936df286f6b86f2ee7a985

    SHA512

    c426f604e755370b54cacfcdd10b4997cd685db1e93979d487e9d0607a6d6b5c6e79494994de73c7e0005607f62bc82625e37c7cc53305271747e333214672c1