Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    19-10-2024 22:02

General

  • Target

    27d70b2c8ea9c31adbd26e47421ae3f7ef25581d39199f0e50e1bec265876fb0.apk

  • Size

    561KB

  • MD5

    6931df8694671565951713c0ff026838

  • SHA1

    df8cc68670b9e3dc274af7f502ce8a59b022d986

  • SHA256

    27d70b2c8ea9c31adbd26e47421ae3f7ef25581d39199f0e50e1bec265876fb0

  • SHA512

    790540a0d6d5a1adc59841ab37ace80393fd26cbae04144ae415734a5b505a10f7177434ca6b749fb353c0001a52b4dea4c9b8ed91e7c1ce86abd1bfb39f2cac

  • SSDEEP

    12288:jteMs843U4yurvrT1zG5IiMBs0wYTfCopkxhZS3QnPHOanA:jteMs84k4vPIOnK1YTfCo+dPHfnA

Malware Config

Extracted

Family

octo

C2

https://yeyrekhospital.com/ZjUwYTMzYjliZDZk/

https://hamsiyunus342.com/ZjUwYTMzYjliZDZk/

https://mlbumlml2342r.com/ZjUwYTMzYjliZDZk/

https://cilginrtelfoncu3351.com/ZjUwYTMzYjliZDZk/

https://mlfkumal333.com/ZjUwYTMzYjliZDZk/

rc4.plain

Extracted

Family

octo

C2

https://yeyrekhospital.com/ZjUwYTMzYjliZDZk/

https://hamsiyunus342.com/ZjUwYTMzYjliZDZk/

https://mlbumlml2342r.com/ZjUwYTMzYjliZDZk/

https://cilginrtelfoncu3351.com/ZjUwYTMzYjliZDZk/

https://mlfkumal333.com/ZjUwYTMzYjliZDZk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.threefinalnpmr
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4312

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.threefinalnpmr/.qcom.threefinalnpmr

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.threefinalnpmr/.qcom.threefinalnpmr

    Filesize

    87B

    MD5

    91201e90e4ddf9d4865cd5ce92571fad

    SHA1

    90b52e70f3605b95b1dd10952673a04134ad6a60

    SHA256

    32b39f5601637c8d51d8fc63068142243bb212f842f9a214b25c45083f0a7bd3

    SHA512

    0653d6b8186cd06da206552e46abfd9641aca772777bad86e1b8d68eab0f37c6d7561f14736d8f3590e2783d32f78fac1df16d2064563b3cec6eee4fc8e60ba0

  • /data/data/com.threefinalnpmr/cache/mpgtyjwzwgr

    Filesize

    449KB

    MD5

    e4734d87f1608b34c4acfb23c17ce02f

    SHA1

    e774131574e603c65941f89fd2db13f6f7af36d0

    SHA256

    f1bf3d6747d7b186f84413cd1d8d5e562bcc5dd84933f38abf900182cd432e40

    SHA512

    3755d0fd926dbe9475bd8c01d1b12a47bd9bbe46889a873c271bafa9d311f20872a3f67c77c10b3b5d8d2ad3960c2efd1a8ff269f8dae2b7578ea29d558920ec

  • /data/data/com.threefinalnpmr/cache/oat/mpgtyjwzwgr.cur.prof

    Filesize

    394B

    MD5

    c71e4556e1a0f66ab0af0ec4d95415c3

    SHA1

    bedc95542808645d13feee6ae7bb3a57fbf0662b

    SHA256

    44215d6d59b0a35be23bccc9cb25698bd6e3cf243838b3cdfffae7099ba58ca1

    SHA512

    fd672ae3b77c54b8a797572fabf9863090249f0ba3ee6678db1b1ea0a0dc6b18bf0351d24a72a3951cd7e94fa7044b8af36fcc2f36bc8c92e51fc113766d951b

  • /data/data/com.threefinalnpmr/kl.txt

    Filesize

    504B

    MD5

    53ebfecbe21bd1f5624889363221c815

    SHA1

    1333f4724c896be813066213341d560afa87b9f6

    SHA256

    df8353d9b323cb6ea6f7fb935e19d80c5a0f91b95fefbf3e7ce993a3f535127b

    SHA512

    8e6d566e68d681b8c1c045c6af2268e6f3fd2f0d896ae11f096ef8aca8edfcb275f264c8da6ac224db64153100b7b8404ada719bd6e982467f047b5959f4e3ff

  • /data/data/com.threefinalnpmr/kl.txt

    Filesize

    221B

    MD5

    5c13aa291c39d95d66d1e3d93202ca54

    SHA1

    fc22f777a9ddb291413573888d1a3b91e34cf7f6

    SHA256

    1aee9accfa6d4b4e7caef2976fe548a5667531485fb92643cf1278bcedeec7ef

    SHA512

    5c44185aaafd3464d4764b718bf81a61365018112325c0942c4f0abbbf8686b90fbd850b4822c9200455f7eba2bdac49895903a8030aea785ad66dff8f69bba5

  • /data/data/com.threefinalnpmr/kl.txt

    Filesize

    52B

    MD5

    1be2880d461b2cd1bb9de6b5d152f817

    SHA1

    25f180df0c26df7f560a901b2234083cd0165225

    SHA256

    5f7b729dc2679f5338261addd10f163fae200bb2e765cf5ace7e8f214239d97e

    SHA512

    987f488e7cc4d9046cb9a999c7fcc9c2fc5967413352141b67dc43f5c7904d8bcebb1a7f662b6eb3b9a5895f236ad89be382c17028f9467709f51dc62a74cc00

  • /data/data/com.threefinalnpmr/kl.txt

    Filesize

    70B

    MD5

    343224548d61b46036be4efe0bdc5ab8

    SHA1

    efd1da111a307177c1ee71673ec56a733ed64869

    SHA256

    7c3adfca34cd581228c3f231206a56209b45efb145665486992ea61205c5b3ea

    SHA512

    24985a56d5742fae620b6ca34018b5b7f514dbba01012fa7c3cfbf6605a447b168418221e6c6f126ce3171c89d42982b2b9d39d266911ad02c6ea5cc4297e773

  • /data/data/com.threefinalnpmr/kl.txt

    Filesize

    62B

    MD5

    6059bfd8cd9d5a878f1c4f1fbb595d2e

    SHA1

    50d03dde72838cb4a1624950bde2d53f7a708a7a

    SHA256

    9f328ab1d1d2739afecfb5cc3f1ce7b10d969d47e6b32d6a58c8da69a5924bc7

    SHA512

    74325ce3b8de3aaa258e0f4ca16e234fca715533cc65920530defdd659bc0098de787da3eb956502ec8793a8096d31f7569c1c9d3404baf8b8fdb2c77486965c