Analysis

  • max time kernel
    146s
  • max time network
    136s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    05-11-2024 22:15

General

  • Target

    525b4f9bbb5f275e4d15ccc7be8720b60e0170822ee0777b8e47971cb6dfdec9.apk

  • Size

    2.4MB

  • MD5

    8b2f0576d9c5646478cb3789894906cd

  • SHA1

    f742f6d543343993ae95d9b5fc278c352339250b

  • SHA256

    525b4f9bbb5f275e4d15ccc7be8720b60e0170822ee0777b8e47971cb6dfdec9

  • SHA512

    6873e18f99eb41f7f3535969babc98d07f4a836f52f372f78ccd6824a60e57a81814fb9efba4274246c59d6303c0666d4a059a43b28706c08e176b79c29803b8

  • SSDEEP

    49152:ZqHDnWoUzYveF7I8EpAyGCX0THCYKdFcU69l+ZvQuhqjsrwd0N4O304Qc3+TM4RN:W3Uzn7TEmyGCYZcO3uhqwUd0SQGc3+w0

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.familyweightaju
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5115

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.familyweightaju/.qcom.familyweightaju

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.familyweightaju/cache/oat/qutamuqlaz.cur.prof

    Filesize

    402B

    MD5

    e54a9adb86d5eb90b3f376898ed9092d

    SHA1

    c450a881da71fef7f31d0d03045c44a07f5575fe

    SHA256

    f0e70fe4709b4096d701c3029b5c0ed92eed0f087663b46b9a71b08a62bd293c

    SHA512

    4cf74e836c03d1ccd37a5be907788e12650fc7e9aa335e8f6e2495a297537488503b332409be323e21cfc1fd6cff1166d75375280cce34db4afff867a6db6a83

  • /data/data/com.familyweightaju/cache/qutamuqlaz

    Filesize

    2.3MB

    MD5

    6f571ab8956fd3a758b5669960af024a

    SHA1

    a905494b0e74008616a9671d1e1105796f5bed80

    SHA256

    a4f3f77220eeda4c3d48b4b40c2a8392f81ca3ca42c9740ae4e4a24ab0af3ec5

    SHA512

    ad3ac015ee22b8ec53cf182ac5fff0a08bad761d87b40b48513af3289a0aa6b5c3df07da7c85b7c05f7814f5615114910c3c3831f2255f27ec06774b4330a100

  • /data/data/com.familyweightaju/kl.txt

    Filesize

    63B

    MD5

    1a23b479201145597332fd443fa226cb

    SHA1

    0526a66d27cca553320393d25fd4914f97c01b1d

    SHA256

    4dd40971053abea697c9ddbcaac6d69a905a21b70ebb14e87a0a63210cf74641

    SHA512

    315a4217e4cdb206c21f8535c18067eb7218e29efe6ef9449520a1b31607f8571726e7b33a9387b3c2d9e01810ad9b48ba878e42364d6f5055be4504fbcb6485

  • /data/data/com.familyweightaju/kl.txt

    Filesize

    45B

    MD5

    b7592a2d11172e631d393fc7058bb068

    SHA1

    99a3a47e195414cc9337e1f5798da9936effa557

    SHA256

    2e2b4c23356be5c77bb40e2f2b15be97aa69e62ac759b38fcc6556bd8ec9df85

    SHA512

    9b88539c4d53429cc624316439c8fca6595cd83ff34f4e7a95144f58ffa4389aaf63844106cc669234975e8699791cf4211b0aef044fbea493655bb30fb2c12c

  • /data/data/com.familyweightaju/kl.txt

    Filesize

    67B

    MD5

    3b8722c7e1246f2a711d37c6c91f8533

    SHA1

    998dd16ce23c2dc759feccd4e8eaa5a8174d8023

    SHA256

    34291295d6641f97f6f796c37ada1668a40efc396d7418a3379354bde40359be

    SHA512

    3c7b11a7454e5b370c995773eb8322c25dceff42b691c61aa7ab57ea9441ded07b902e4025414f2038f20de3dafebd87b9ad42384f28b28f6c65fda2b58913b0

  • /data/data/com.familyweightaju/kl.txt

    Filesize

    437B

    MD5

    3ab0fc90e7dc1f16920073e3befb0f94

    SHA1

    3020aa17ec85557fab8de3c9f8abcfad2f05462e

    SHA256

    143b864ee0f50d1f6565e68f158635403d29a183b5668345a29c9790670f6771

    SHA512

    71be5eb9cfa86ef442d83a14db31e70ef2d9419a096c665a6118d566212cfbe9eed947e06e136525cea9b1f3ce2513502b8933a6736ceb5aeeea5c98ce00be66

  • /data/data/com.familyweightaju/kl.txt

    Filesize

    84B

    MD5

    505b4085e5bf740d463659cee91f8dc3

    SHA1

    3d4f53177aba73b02d79e062c7f7d1c9b4a7673a

    SHA256

    9f41ca5e77d5815ba95997b4c44195793426de843f9c21ab3bbe1d62a95ff804

    SHA512

    98d8173d739adc182cce99216d4c039a319e9391d498f6a2001668024861b0008aee2cd9d11f01983d01b72904311501afc44bb192d2e8d2664325cde3f1747f