Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    27-10-2024 22:00

General

  • Target

    4ca15aab73477aab1ff7bcf96bbd31e8ad85b09047190982ddab0b7bd121a555.apk

  • Size

    561KB

  • MD5

    036e657ca5dc6ec9e0d7483dc3f9655c

  • SHA1

    e5d9bd3455bf44d0b9827efd99c61813a2edfeaf

  • SHA256

    4ca15aab73477aab1ff7bcf96bbd31e8ad85b09047190982ddab0b7bd121a555

  • SHA512

    c4c03321468ef248b1e7e73c892b95466b8d98aad0efa50f8e4007376cf665e43e92d23bb116649464cc8a833e3081e138db4d7ef3d083fb84bfd2935bc34545

  • SSDEEP

    12288:7qyKUCI99vROLDtq7b9L9O3aCm7Flpi5Cjrfr9649xH5SvziLaDU7c:7tKUCILvROLJCt9O3ZmJlUGrT9TxoiLq

Malware Config

Extracted

Family

octo

C2

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://22pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://32pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://52pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

rc4.plain

Extracted

Family

octo

C2

https://5pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://6pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://22pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://32pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://52pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://66pethsop332.com/MzQ1Yzk1ZGQ4ODY3/

https://3bb139030bc7238b33981d0595033c23.com/MzQ1Yzk1ZGQ4ODY3/

https://6bb1390306788b33981d0595033c23.com/MzQ1Yzk1ZGQ4ODY3/

https://4bb139030b74564533981d0595033c23.com/MzQ1Yzk1ZGQ4ODY3/

https://4bb1332453233981d0595033c23.com/MzQ1Yzk1ZGQ4ODY3/

https://4bb13903074567453981d0595033c23.com/MzQ1Yzk1ZGQ4ODY3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.samsung.android.messaging

    com.avast.android.mobilesecurity

    com.google.android.apps.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.streetclassmng
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4336

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.streetclassmng/.qcom.streetclassmng

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.streetclassmng/.qcom.streetclassmng

    Filesize

    86B

    MD5

    472503e48f16e654d9975d419110131a

    SHA1

    ed6aee6ef8a6ead4121e7098a27b486d04457174

    SHA256

    16b5a302b2c1af5bcd7cacebda1c00ed5c2887ce16c4e9173e6e1127e81a9f1f

    SHA512

    28f7beff7b0d10411bd112ed82473afe655b9f01a6b9a177f304f660d3852dff20f0acc74e04d5671bab8fbca6a83e6a0531d12fcf9c39f3a8682f445fe32fdd

  • /data/data/com.streetclassmng/cache/goahquq

    Filesize

    449KB

    MD5

    3e8451397c2ecb666469738513ea3f63

    SHA1

    891a448cdb6e0c2d629ae282f64567ab89d146aa

    SHA256

    95ee27f6721e1a1d7133545bcdfe8a6a03d79ed66feab3f0588f6c76e440fcaa

    SHA512

    7c027d710308584104fbb71dddd23f4b77e05764da63a1c7ef85e1e2ebb2b35fac1a1964f6f8275d1600b49901ef7780480ec8e1831c132f57a34277707b610e

  • /data/data/com.streetclassmng/cache/oat/goahquq.cur.prof

    Filesize

    374B

    MD5

    deb0299276779d57ac81d99768569fd9

    SHA1

    7eea22a8bd8c35e04b195ead3aacd8890c87f76d

    SHA256

    bdca641a113becfa8a4147c9debe72ee5344e79af277752ac4bf3a598b73ae23

    SHA512

    22451f4b8517ed79d663a3fca0da365815c219c9490f69e4428f78f2a6d6c2b3d2546bce720ba0c31e1ecb009bfb9b4dbab4f210fad6f26e7c8c8bab8be84d8d

  • /data/data/com.streetclassmng/kl.txt

    Filesize

    84B

    MD5

    f58fa65c35e0a5eeb476f8cb53a1f561

    SHA1

    1e757e8492f1e0389ae70fe325238327319fcd64

    SHA256

    61301a17c87d526ed911c0ff15389c5040643140121b98208208797fef6899e8

    SHA512

    4ad27d85b4b1a0fa11200d2e8023b3a7e0fab09153b6046ecee1fd3ee0c18797eebed825aa060a1f7a11c6dc3cb8167bbd94b48f35ac77dc21ab5ade5f6d6f01

  • /data/data/com.streetclassmng/kl.txt

    Filesize

    60B

    MD5

    82f0c3671486a02e01bd7f90dbf0f77c

    SHA1

    276f17b12d72fa5119808506e144d217af97274d

    SHA256

    25edf50d2093627f58b8d5169e97c143b0397ae029904e4a8678849fbf1b040f

    SHA512

    ac94f68652d4ee4e2328beda1ac3019872e32dfebb0ede88898f6f9a7df156bed3b1ebbd61734f4b1fa61dd35290ea91cb62236ee991e8ce6c7771e1ca086636

  • /data/data/com.streetclassmng/kl.txt

    Filesize

    68B

    MD5

    c4fd274b09c2868e8268230dcd3f72ad

    SHA1

    641cb88b678c0de8d9a458f9fa7f0050da525799

    SHA256

    a1b9b72a1b152dda43b3b29b214889724ceee3f05843bcc8880e9abf84f0521c

    SHA512

    4d6eb89745fc2e38cbffdac28e37c906cd9d1af90bf51841dec084fb8a59b8b7647184f03a70ca7768137738236016ad4180cf5649b3ab73f0b6a8b3269a4904

  • /data/data/com.streetclassmng/kl.txt

    Filesize

    219B

    MD5

    4b3f714ddb148cf4b1753cbc26ee86f1

    SHA1

    f6b95dcc85cd25ecabee721bc358a3311ee06dc5

    SHA256

    38616f3ef7ea646b35f3050320586e2ee42939daadfbf39cfc791cea301b9f19

    SHA512

    1948646295376d988646e33d8e76ec2b8a2d682173d5e7b8f1c39cfdc6d9ef3efdd62a3e2dc5616d077e2169c8bf034643c5be6a87844f625e450984abd6b4be

  • /data/data/com.streetclassmng/kl.txt

    Filesize

    54B

    MD5

    f75d4e8017d28ea669e40221400df0e6

    SHA1

    ebb35a834e6aecd16545c38bd6ba5ab513a6fe12

    SHA256

    ac94afdce0a2923ef64eec9fe6ca9c47e56b8f890bf5d6cc968b46731f692835

    SHA512

    40f1b36856ecdbd4411772103a5494054f916e57e1d19d64b8fb42508782536a7eb13860023cc1b5d82faba99c48d919a3d57914281c0734085a0a9b171551b5