Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    05-11-2024 22:14

General

  • Target

    ffb0e14fdb7ebaa1e5adcf26ecb10d2bf1bdf7102652a9e120030b95f58e443a.apk

  • Size

    2.4MB

  • MD5

    7a032e3b54127d8e7719a53a5111be2e

  • SHA1

    93a541d3fb86c3ce8c4612165320ff9783a05d49

  • SHA256

    ffb0e14fdb7ebaa1e5adcf26ecb10d2bf1bdf7102652a9e120030b95f58e443a

  • SHA512

    7605bbdab8d0c86b44656d8ccc1235037dd67a5e8075bf344ceb9ad60951e20d80100993a1ca9eb9a8389e860183c22d4c5b138a405aef26db643761e0700a6f

  • SSDEEP

    49152:bbv+5h2kw4Ts5OL4dlC5yxtbx2PzlwH6M63U85Rz3mxu8fD:/i2kwJOcxxb2hwH7s5Rz3T8

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.musttalkjh
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4336

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.musttalkjh/.qcom.musttalkjh

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.musttalkjh/cache/oat/vmqjvi.cur.prof

    Filesize

    407B

    MD5

    e78e51cc497bbdac2d34fbd8d1b610dc

    SHA1

    f433d5d6d0af4865299dec58d9b562cecbe7bf22

    SHA256

    38cc3bacebdd35ce12b34d9aed6da6af6c1e779c0f4b7c8420901f5a26859269

    SHA512

    71d5e44124dca074922f0b6d49f194f971021e44aeb9011b26f9faca280b2ffc71666f189a1342682cf02f1d7452728aa7675331c8101fb5401dbe17d1dea6bc

  • /data/data/com.musttalkjh/cache/vmqjvi

    Filesize

    2.3MB

    MD5

    f63c13d5792f3fb0416e030b12e64afd

    SHA1

    e76641c0da7bed3cf6d102e7f4c4a5d13eeb7950

    SHA256

    7748836e45e3e5311beb371928aeb131add1353fcc266f0f38b201af7c41764f

    SHA512

    24c5948e365ea52f626083ef2bba3f91d1d3dbc3e0251dc9f4a2a6506495fc5964432fe64f8f008803e44312be8ded5148a595bc2030893b6c988f4d471a388e

  • /data/data/com.musttalkjh/kl.txt

    Filesize

    237B

    MD5

    88c37054c3b68f07aaeb48564ed8915a

    SHA1

    be1841be5d8f0e0c083832fad9afbe5bda3204c1

    SHA256

    80360735351600bc44185d823bf185844cac937f6071219bf754700e2644f833

    SHA512

    b38e6abe4bd7470666fae77a0c1be2512455113914c4f77e71b8e86e9b2d1d2e23d7b03c7529ac270f99e0fc962888fa6351a91acfc03b01b26217b5c103b552

  • /data/data/com.musttalkjh/kl.txt

    Filesize

    54B

    MD5

    309ae63c03f6a6ace305d12ce48ac82d

    SHA1

    3087b3b3125bf79ae083a2f4e273b04737f932d0

    SHA256

    ea38f8ed91e00ad538c92b9dfaa5b28a0d9f185dfe855a6955e4e03f4b3250ec

    SHA512

    bc86865b869649299daf0413d7b23b06e78f41a660ab59dbddfe969e330ba565129d28beea957132a18e36d6cd929c6a1825e99472783182beba8a4c96ad9664

  • /data/data/com.musttalkjh/kl.txt

    Filesize

    63B

    MD5

    af0e2c4e639b8678bf4b661ea6420dd3

    SHA1

    879aa36280dea64398b07223dce6f8837e3c74b2

    SHA256

    28a480e14aa3a74b25b31706004bff1d91151bb755ca8b8905eea29b54ef65c5

    SHA512

    fa51a6342f1ba9eba32e5c2fbd0e97764eb406d804b73c660f3a93af95ee034971a00f5a3c8c2d983857910cb512a6be9cc1d595bb5158a6abf502c94318118a

  • /data/data/com.musttalkjh/kl.txt

    Filesize

    45B

    MD5

    b10d06ccd9bbe8eff5d24848c420fdbb

    SHA1

    5f9b3dcf3812cebd36097f53d0fa52173e72152b

    SHA256

    1a6036cb156e48c124d0eb7f86b61d838bc9a58735bec9ca81f9e2efbae33a3b

    SHA512

    f892a5388ef6a00d52f7360065a800a7f168cd722db1750b7f62fe8cff6ca93a2fb229055c9612930da834e0cca7387f11e5f2b6cca6b339004a992cdb6d7c72

  • /data/data/com.musttalkjh/kl.txt

    Filesize

    437B

    MD5

    913ca9fd360f78015507b9659a792b27

    SHA1

    94c733e3d49e8da0d2f4b9868a3cb58f74c36c87

    SHA256

    94c4c4edaac5cbab7dd0bf6b4f6f912fe58baff31330611e2fbe52a901f4a426

    SHA512

    05bc13c171e0d95bb278dbe91f7863f5c1ca8b5532d02a14b6b363c21842fcd43f1bb07758336f8b64ae5acb3d4051f2582b32afc086682e87c136acd5b50d22