Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    20-10-2024 22:00

General

  • Target

    c1ee46a3adb4334bb2bea9f6078a057f83dd2c311cf8f534621542efd890e881.apk

  • Size

    561KB

  • MD5

    f5ba95753ba8048493365616a8f507d7

  • SHA1

    0e89dd9e11ac11385ef60bd074ef95da46623c0c

  • SHA256

    c1ee46a3adb4334bb2bea9f6078a057f83dd2c311cf8f534621542efd890e881

  • SHA512

    11f9169cf89bc7c41bdd3ddf68a16f1e431fda7482539f384234abc18aed5db6c5347e003eee6825c1c39d4e33d41daa894372b9c416f353be11603dc669d3fb

  • SSDEEP

    12288:KBbCRc+UejrsAKd6/46MQ5uJUsU0BddOE+ecevNnb:KBeRc/eMAym58dbcqNnb

Malware Config

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipala4sdim522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idasaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdaayaq.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipala4sdim522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idasaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdaayaq.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.knowexample58
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4365

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.knowexample58/.qcom.knowexample58

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.knowexample58/cache/oat/qcdmwjozkogvho.cur.prof

    Filesize

    507B

    MD5

    f9e12c1f1d01e0009e4b9df62fd4f393

    SHA1

    132a93b9a69891dc4c693e550d518a7704a17ab1

    SHA256

    cf483746a023a7fb0f2f97ba6954cdce40e0bd42a389b7cd6843294bb1d0a68a

    SHA512

    1528579f61d051299903195263d76464fa67c05216c05fc1934febbc755539f52a3a228b1d58b6e3b3811911b7a38e2d573d48eb2e443f091c1c05f2e355cd9e

  • /data/data/com.knowexample58/cache/qcdmwjozkogvho

    Filesize

    449KB

    MD5

    b7473ca9007876f8e08f1dd7e57383cf

    SHA1

    9e6a058b3c3133193411c656518cdfdd87919fdf

    SHA256

    b136949c86f86892f102b1505dad74b8041dae9ed5f0a076c0a91e33e43f4619

    SHA512

    2e7215aec2e84a01054f1d738e92fe35094ae1cd8877bd18122d3bb8f3a1f8445ed62419a7ceac5c634a6397054b715738761bd6eb4e9de2dc7cd5c00e61ba8f

  • /data/data/com.knowexample58/kl.txt

    Filesize

    237B

    MD5

    35e46c82800a60ff5c9be355c00c3003

    SHA1

    417a1c409477af5b4e2ed2657ca7acf29a5245ee

    SHA256

    60ee8b4ba645d74695cd6f51b4548f9c946d6e974c0d9be1b75c5f70973af17b

    SHA512

    6b6135b606198a984ddaf3e2dc18cfbc5f2dde905e1a1bd605c6b2f5d491bbb342fc089e929f494174478f42cb746850d661e44da4f4ede080ff9bc8c88a5797

  • /data/data/com.knowexample58/kl.txt

    Filesize

    54B

    MD5

    5e05dedb0f9f3a5d54da204b10e9d1c9

    SHA1

    b15e5b4616e783795eb00266c8bf8f7810de4bfd

    SHA256

    4061a947bbccdf02f50c3110ce3c69048b34f3146b765768b1d0a5f1b3355e6c

    SHA512

    e03fad1d8bb3b0cdc2a493aa24385236a48298aad0998c0d0c465c479f6cccb68eaeff11509c520f6fbf7c21462e3f30c95d99b55cbd6142e37fca4b83f11f97

  • /data/data/com.knowexample58/kl.txt

    Filesize

    68B

    MD5

    18f944586382a1fc45fdf48eef481b71

    SHA1

    9d1ca00559a3f5063f98bc39fa0bb5322b17db58

    SHA256

    ab73849e783d6b4ea075aa8dedf58ffc790536883696135690f90b71b0c7e074

    SHA512

    418ef7ada0767b0fe8a0fc95f90de5260862407a96b117c9ddf6657dd02e6527e3a163a0a352ffb60b31d3a2d5c6157ab11f16985f05ada44763084bfd6f1a72

  • /data/data/com.knowexample58/kl.txt

    Filesize

    63B

    MD5

    a31d59d6f33492f3c8b014bca5f64025

    SHA1

    70bca0a8524d6640708e0a48022cfb2d1d84482a

    SHA256

    9bb19361fa5f89d2111c37fc96afc3347741d3dc46b76338ea6b578f76d419ce

    SHA512

    dbba06cc3cf90e25e2ffd2cc96431325b829d632d19e92f3318ae23a8f00614c3d78cda69401d7e1cb0ca8d0d60ce2c5ac75f4b92ed62c8742a1e020e6e9ac1f

  • /data/data/com.knowexample58/kl.txt

    Filesize

    437B

    MD5

    d4edf115f9843dbed179649b9f1415fa

    SHA1

    6c9c89eb604b10a6bad8c2ede479b46a09037e04

    SHA256

    7f01c77914c4a88e170509e4859b27a431eb60dd66b41e8c944294e6f35ca36e

    SHA512

    7849a372d2bc241c872f744cb2aed4785412894f0b4ecb41e825dcbd3ab5fadddd69717ca364c3ab98f7e2c3f52548701778989fa13290e22a3a2f792d7811f8