Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    02-11-2024 22:06

General

  • Target

    d53285e74b29d35a441368da9c03b38f27b2acab52f3ce1117cce0610ba9b227.apk

  • Size

    561KB

  • MD5

    8812364136d134461a3b0eed2904b1b9

  • SHA1

    f84e2014ddf95af2079eb89a7a2c7fa82365e5d9

  • SHA256

    d53285e74b29d35a441368da9c03b38f27b2acab52f3ce1117cce0610ba9b227

  • SHA512

    0c2aa8786b7cd8b7eb25f397d88c0ac816b59309e83322ec72ae9ea1a052631299e9ea3e4c6b3bd19feb039db43e7063b893e2a4e0f573eb279799ccf67f30c4

  • SSDEEP

    12288:RD3YBW/TMd5bO4DmR3bBet3c9WiTJXUmfox95XlQ+I2hkFhMDL9ZOa2D38nu:RD3YBW/ebpIIt3c/N3f63h6hM3HOa83r

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.planactwpn
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4318

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.planactwpn/.qcom.planactwpn

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.planactwpn/cache/eozfjpwiugyyff

    Filesize

    449KB

    MD5

    aadf68b4aeecf442fcddb92e869becc7

    SHA1

    0fd7d657cafcbbdbf2fd8ca07647673a1c99f3dc

    SHA256

    7d7433067f18715d11497db44d3fe6ca9667d7473a34314b9507430322204c09

    SHA512

    b287388751a8a5504ab0eb26a6d068785cfbe8f2a6755a43e48cfd5b882a5defd87532e832ca7c69829d217c9edb864e1c261b48ae673ab7f7b1c3a6dfaef2bd

  • /data/data/com.planactwpn/cache/oat/eozfjpwiugyyff.cur.prof

    Filesize

    380B

    MD5

    d121e075d33d80735dd10297980b3b4f

    SHA1

    d6247ae10f86aeeb604bd7bea41ed9a85bdbf53f

    SHA256

    1f8b28fe3b4fa19b342d2d75e384f3d104a33f36f772733e6eaa218c3bfae75d

    SHA512

    44024e6e1d43eb3d296070a1c1dccf72a513d352759294a104b163f426ae06dfc803f5555a3a3f0c5d86255ffb35d5eb3314efe728a620ab26d4ff7d847b00cc

  • /data/data/com.planactwpn/kl.txt

    Filesize

    221B

    MD5

    17d3e0686d7ab3dc7dbf16c4927449dc

    SHA1

    817bd62ca283f8bb9a1adcfc136a5445fe9a6cff

    SHA256

    dc7625734f71925cfb34ad2414cc092d0b6cb1fb77d0630e05b5ce3346e9f687

    SHA512

    2e793bb8cb3daa031a8310ce2caf7191f6124585bded42f741e17f44de62324b4075435dc2a48cf6f7e1b4ff705bf0418100ced5e4ad3ccffeb9cb1450e6ccd3

  • /data/data/com.planactwpn/kl.txt

    Filesize

    52B

    MD5

    b55cd7438aca668ab2c39651e7d122df

    SHA1

    cb3978aa35aab6d09ea02ea9f1ed24011920f319

    SHA256

    1c4f3c8a10a453445eda44e6f23853bce11ee7e439ea63e22b2605d39d96c522

    SHA512

    5c6e416749fd791ac355e315ca0fa3538616095d309ce8481fef0341b8e0cc4620e6049070204f580561d8858ef3c44b400ab30d1a3520223a629c930e0d9312

  • /data/data/com.planactwpn/kl.txt

    Filesize

    70B

    MD5

    f7a1e3ee32274d58f4c13157db493c76

    SHA1

    8dc2a4bdf7d8f5dc9ca5e5c18135be00a724fbd8

    SHA256

    c30f93ea0c7df7c32cb7ca763f69067a15c796d16ebe0f38297691f5f141f79a

    SHA512

    57deee2e2845f08600442c538f45833138852d51c17dd37ae514af6fc0a2bfae85c2fa1ab7998382078239dcae0942bb1d5ea439f39ad8f8b675a7274cbec4a8

  • /data/data/com.planactwpn/kl.txt

    Filesize

    62B

    MD5

    a4091e8ff60b9e37658d2fe6fc9ddf72

    SHA1

    a5326fd02ab49d0394f00f833dc798f112def650

    SHA256

    c15cda5b0232f601fdc7867bef05a8f62f5978ff2c141ca07fdf378f50b1888e

    SHA512

    afb374679190b4e537ca7b48c999affbe6a1beb911d1f36ec413a067483306af447235c50e5c4f6db5f9c9c37f9917a869b5fe48f315beff409d6ddb0a3d7228

  • /data/data/com.planactwpn/kl.txt

    Filesize

    504B

    MD5

    083078cc6bccca9e21f6acd5e8b49b86

    SHA1

    ea7fef0894535a395feb0b3da96849bf40b36949

    SHA256

    60fd9e89ff3bef6c208c137fe0ca6af68e7566d42dcd19a1e437e0585b98ab44

    SHA512

    d7c5d6b2c16aa46b2b88288a667913d364a68f266269f371bfaa54b0febbedff5f145b7cf63d3416acb8fa8955ae462dd1c45cfa5e35043bcdbf2f268c12dbf7