Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    20-10-2024 22:01

General

  • Target

    f489d38d9e54e6abcc154b8a2b6f1b5a132b06a2a01173b48610d514d92bf79c.apk

  • Size

    561KB

  • MD5

    9d3d57f28fc9ccff34e4745dedc7e8dd

  • SHA1

    e2a219a9dfaa10a62f241a59610c4431bbb28111

  • SHA256

    f489d38d9e54e6abcc154b8a2b6f1b5a132b06a2a01173b48610d514d92bf79c

  • SHA512

    b6981ad580c54ae2875e0abfb531f98cea155fbc89567bbfe255c64109e73d33e77f3977f13da88a4ff1e2255892b452601c211d395d3ee25b02097f1cf1201e

  • SSDEEP

    12288:rbOvp0trgVeWOuOMuUtuX/JrL3zoxEMTp+WJJAbnV6:rbOvp0trGe0OM5uXJL3zyQisnM

Malware Config

Extracted

Family

octo

C2

https://yeyrekhospital.com/ZjUwYTMzYjliZDZk/

https://hamsiyunus342.com/ZjUwYTMzYjliZDZk/

https://mlbumlml2342r.com/ZjUwYTMzYjliZDZk/

https://cilginrtelfoncu3351.com/ZjUwYTMzYjliZDZk/

https://mlfkumal333.com/ZjUwYTMzYjliZDZk/

rc4.plain

Extracted

Family

octo

C2

https://yeyrekhospital.com/ZjUwYTMzYjliZDZk/

https://hamsiyunus342.com/ZjUwYTMzYjliZDZk/

https://mlbumlml2342r.com/ZjUwYTMzYjliZDZk/

https://cilginrtelfoncu3351.com/ZjUwYTMzYjliZDZk/

https://mlfkumal333.com/ZjUwYTMzYjliZDZk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.butstood6
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4475

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.butstood6/.qcom.butstood6

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.butstood6/.qcom.butstood6

    Filesize

    87B

    MD5

    b54880df396b43d1894a92c063e36e96

    SHA1

    398c4b72f84dc964a1b1c8e49388f558825da996

    SHA256

    5d456ab9770158c3bf6b07ace0b46fa8b73147cebb069d2d4bbcba93ad8144ea

    SHA512

    3a401074532018adcb1e9b62da838d86569cc762841995df248d1e7c61f2129589201eb89c600d4a7b58aabae9ed6c05c5912ed88d97cf89efae5a17a52e2548

  • /data/data/com.butstood6/cache/gypdlraftyr

    Filesize

    449KB

    MD5

    82bf904b9cbb4ca3bc05b668450bf745

    SHA1

    dd2b6c5f5b9a104827dcda2a9a6b37b31c6d325f

    SHA256

    66daaf47a3568ef04a5a5bbf621b60c5d0cf5771f0856908e59e6ae69c58fd80

    SHA512

    0bdf7daf127051e5112692a0f0f231b3d72f54b0fb7b8e25b797f913841487df5e485d3d288f9b876f3fa68ac92da8bd972aa627aac0cf826b65eeb16a9d84be

  • /data/data/com.butstood6/cache/oat/gypdlraftyr.cur.prof

    Filesize

    387B

    MD5

    2d1158fd3f6a3ff9acdc2e8e74d94b59

    SHA1

    9c4fce3448082e5f2da04ef04efb270965fef0dd

    SHA256

    2b5ac8d90b8be2df6726feaa1f4640b2adb4057a29ba89f7120b31a9be9d0f7a

    SHA512

    787a0aaa7cd8f00f72d549aa6cd64df4e7d2e08cae59eaebcd5764df5b73340456909617f6b6b7dc274cd506f5499a2aec85c4eb372d97947ba9ebe2b75e143a

  • /data/data/com.butstood6/kl.txt

    Filesize

    504B

    MD5

    ddc1090753b42e96c032921f45ee24e7

    SHA1

    9804c16b3c5b6917f7f0f253645585e32d179ea3

    SHA256

    6a96a4a1e7470943e44845068d9f0f8b407d12e631a5e339734ab9ba7dcf5f04

    SHA512

    34da86c2ea7c0fb918d08675a0f8c79def0ed731f03ebcc2141cc34e6979b87ce0deb3961e69ab33a5875de1e7ef1aab1aca9c553d35896475ba0b572d712b8e

  • /data/data/com.butstood6/kl.txt

    Filesize

    221B

    MD5

    cf61c92776a1109e0e2f9dbed8e9aa08

    SHA1

    b13a30208fb2fff3072b42f158ceddca417eac88

    SHA256

    a6c62888c0b94bfd989e32379698ba7f704e566ce82a1d93e23f1d35eb50ba48

    SHA512

    1e1b48f30d067aa855a40decc61c889f7327cb720495c40c969c7e84740b6103c3b45e39186608ba49954f5eda8f5d889ca6a07c80af8b3d422a6b11e6ce52a8

  • /data/data/com.butstood6/kl.txt

    Filesize

    54B

    MD5

    b2bdc0a80a180fd90dfbcfed5b88ea17

    SHA1

    d39a5607ee66750155e1558545440980bf40b330

    SHA256

    70301fc4dbbbd0e266447876b601fcb91e3f188ce33f1c44f0745711ce4547cb

    SHA512

    1151701fe509cccd2ac3324c70262c96d507f423cff3fb635a6553e88aa1e9c8e16e242a1df10aca74d1877910b2fb9a4eb835160904246aad88b369fd15dfb6

  • /data/data/com.butstood6/kl.txt

    Filesize

    68B

    MD5

    0944cf7b7e158f24a41e96e97abe31f4

    SHA1

    7d2947e63cdaeb8c25dec07164776679351c8646

    SHA256

    86780171be49828bc6264fa3c0f8a0261696df3e44b85b401c0d9f6a0371ee58

    SHA512

    e2de5fed65d88da9b6553f6d9459d407101708c3e28ee9f5a4ee1b026e24231484b151cadf76dd9d728c2898fefccdacad48de79b4249cd4bf9d7506b7b64bed

  • /data/data/com.butstood6/kl.txt

    Filesize

    60B

    MD5

    8a379051857a92afafd7c01b87a8d656

    SHA1

    516d08b60d1aa81c754aa119f6bc109a0cedaac9

    SHA256

    1465a443ff7b524197d773c72419a83d6ee09508b5f8d632f8717006fa7eeaac

    SHA512

    237f67ed33461a01c6c7d51e8e73906a07e1cdd04d45390ce2a709402304b02ec4e343a33249245684629befd7ee344ea60df9d70565d271a826bb769803738c