Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    20-10-2024 22:00

General

  • Target

    c1ee46a3adb4334bb2bea9f6078a057f83dd2c311cf8f534621542efd890e881.apk

  • Size

    561KB

  • MD5

    f5ba95753ba8048493365616a8f507d7

  • SHA1

    0e89dd9e11ac11385ef60bd074ef95da46623c0c

  • SHA256

    c1ee46a3adb4334bb2bea9f6078a057f83dd2c311cf8f534621542efd890e881

  • SHA512

    11f9169cf89bc7c41bdd3ddf68a16f1e431fda7482539f384234abc18aed5db6c5347e003eee6825c1c39d4e33d41daa894372b9c416f353be11603dc669d3fb

  • SSDEEP

    12288:KBbCRc+UejrsAKd6/46MQ5uJUsU0BddOE+ecevNnb:KBeRc/eMAym58dbcqNnb

Malware Config

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipala4sdim522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idasaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdaayaq.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://hepsinidoe01malltim21.com/YzM1YThkNDFkNmQ0/

https://hepsinezipala4sdim522.com/YzM1YThkNDFkNmQ0/

https://hersenbo67saaaldai548.com/YzM1YThkNDFkNmQ0/

https://alayinag45idasaesr5454.com/YzM1YThkNDFkNmQ0/

https://neadamsin45mdaayaq.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.knowexample58
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5053

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.knowexample58/.qcom.knowexample58

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.knowexample58/cache/oat/qcdmwjozkogvho.cur.prof

    Filesize

    454B

    MD5

    374f85d45c02d910eaefa168c855e77f

    SHA1

    46d9ae9a5f14ca92e1f5c775ef4d3595b8f98fc9

    SHA256

    3bae93b2b31d2e2aeae6881fd676fb9af00132ffeebfdacdfd7070940aa18c85

    SHA512

    633117e84f8a2bd88952dac849b5aadcc9f610b050b1db508fd4d7d6633ce85ee56c26b702e53d183b3b4c7fd4edb4567e4af368ee78b61ae3e94379a05d9ca3

  • /data/data/com.knowexample58/cache/qcdmwjozkogvho

    Filesize

    449KB

    MD5

    b7473ca9007876f8e08f1dd7e57383cf

    SHA1

    9e6a058b3c3133193411c656518cdfdd87919fdf

    SHA256

    b136949c86f86892f102b1505dad74b8041dae9ed5f0a076c0a91e33e43f4619

    SHA512

    2e7215aec2e84a01054f1d738e92fe35094ae1cd8877bd18122d3bb8f3a1f8445ed62419a7ceac5c634a6397054b715738761bd6eb4e9de2dc7cd5c00e61ba8f

  • /data/data/com.knowexample58/kl.txt

    Filesize

    237B

    MD5

    17dffd883147b73bda8a307868a1d03b

    SHA1

    7f90739f1b84a1d479e95dfa408f4c68ad15183b

    SHA256

    19248bd54b1d75fbe51c3e48825fe2883d04953ae36cdacb5dee4b44892bb3e1

    SHA512

    f10fc7fe8430ccad6006d1de62227d9d5c133e55f06e4656494ac3cf9da06219251fa4da7fa515a67b12e203275fb98375ec930015bcb4213adf1b5c397dfada

  • /data/data/com.knowexample58/kl.txt

    Filesize

    54B

    MD5

    55f7c719e7d8667d583c51b7b38833b1

    SHA1

    69bca20af5d3789fb3316c6d2aa56ffe3758b276

    SHA256

    d9deb0f14b2c527503094ade4dae3a0b6ee4cad2da16ca01e6e39d58a3fe52e3

    SHA512

    763fd09dc5aaf52a35acd4cb2a0617fd70a1433edb2dff34d66e00da03a269c352229542c4330fb3010bdbce895a37fe00bf343f42b47bb60b46c79d90d45cb2

  • /data/data/com.knowexample58/kl.txt

    Filesize

    68B

    MD5

    6647f66e67edd1078b7ff98dbe7340fd

    SHA1

    1a1002da27f4b0caf8712e679b7ab4a272e15d72

    SHA256

    c691ffb8f645bfc4b566f9cee0d1ded562d718fab034c543e5db91680bc1e425

    SHA512

    24aa2336accc6e14f14134b465a7eda6caa213418593131c6fc306481ad109de67f04f615c48811e57d2b9bb4ba77b381387307d6eb4283be583d942c487db11

  • /data/data/com.knowexample58/kl.txt

    Filesize

    63B

    MD5

    fce2017f209fdcc79676c7ce480bae04

    SHA1

    806ca4637a83f8ad86005fd1592bcd18891c526a

    SHA256

    23747dca8395822740795fb4f0294e83d286bac83e51ade9b9112a34b457beec

    SHA512

    1081430abaf0bffbeacc9c287f42676b1e635e39a227f35df41cc4727807476554e88ea91221541a8eaa1026f1b8c4931f05bf3155ae7c129edb6b57c530a151

  • /data/data/com.knowexample58/kl.txt

    Filesize

    437B

    MD5

    ff77529314751f13eccf2141a260b7bb

    SHA1

    9f6f6912df6148e827de06a13741b915a37a9309

    SHA256

    255dd562026bef7526cbb9e1ba95fe21a41b5d816781168dd2e601521a1defee

    SHA512

    d59e03f3e420e61f77e7d1a7dc9241990f7dd17bc086bb7562d96e01704976e6198e1f620f73e1bc6272e4fe3af2c52b75e2203d46d3482d96a1a890c0420f73