Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    06-11-2024 22:09

General

  • Target

    3c48e9a2b2364978a253dd3ca9a8fdc9d08a312a5312fb4d4558f7ca2fdb692a.apk

  • Size

    2.4MB

  • MD5

    f9337ee134b5efe47966745502aadc2f

  • SHA1

    b666d6512d0e458a146a923dbef00c3c7c4d0f14

  • SHA256

    3c48e9a2b2364978a253dd3ca9a8fdc9d08a312a5312fb4d4558f7ca2fdb692a

  • SHA512

    3a89439600913251f5d459c8d5fc0d54a99ced5b59544853c98d508849250765ceb357609c4dc8406eadd68750607cc152d18e9f7474ff583634d732112af918

  • SSDEEP

    49152:HwNEMXDGTtVytSCyJb0N6VWwEHFMH+mikYVsTaQ94Vi:IfGxItSF9sdWHfikAka0

Malware Config

Extracted

Family

octo

C2

https://mutebabacankarac1231.com/YzM1YThkNDFkNmQ0/

https://vercankaraca2213.com/YzM1YThkNDFkNmQ0/

https://verkaracesfercam121.com/YzM1YThkNDFkNmQ0/

https://muteelercen22.com/YzM1YThkNDFkNmQ0/

https://vercancankara231231.com/YzM1YThkNDFkNmQ0/

rc4.plain

Extracted

Family

octo

C2

https://mutebabacankarac1231.com/YzM1YThkNDFkNmQ0/

https://vercankaraca2213.com/YzM1YThkNDFkNmQ0/

https://verkaracesfercam121.com/YzM1YThkNDFkNmQ0/

https://muteelercen22.com/YzM1YThkNDFkNmQ0/

https://vercancankara231231.com/YzM1YThkNDFkNmQ0/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.takeport6
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4514

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.takeport6/.qcom.takeport6

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.takeport6/cache/oat/tqtnqybcqg.cur.prof

    Filesize

    305B

    MD5

    76d904a8fb5d2d2fa0e95c6cd499a54e

    SHA1

    dcd1bc7af0b15f0758945707dd870ff6b13bc98b

    SHA256

    d58955b5a04b40284c8e08cbe766be630c761aa0d21d83fccbe9a015abc951ed

    SHA512

    fd3189477e989c9f079250285ab7a88b588be70cce352401db435621f5ae863a6b1b0a5513a0fabbf3d1a5b083a92affe6a1908a5ae0a5b6be41b9f8dc3545ad

  • /data/data/com.takeport6/cache/tqtnqybcqg

    Filesize

    2.3MB

    MD5

    88303d60d366a42377cab3aa1c840917

    SHA1

    2cee5d2f5bf420f8e5c85ff034c0d2ef38fab0fe

    SHA256

    0caad25c83b3c15a453072a999b79b7ed6179ffb93b8a73033875d328e290f20

    SHA512

    0c75aadda7846eea5416823b95b7ecf28146b519925b667cd065cda06b967e7ea66cf9cf542a9380dc3bfc89a99a82eedb5e1443fe0f2823e6846c54aeef8363

  • /data/data/com.takeport6/kl.txt

    Filesize

    221B

    MD5

    6139601c15dcf0568fa9a6d8dde75dac

    SHA1

    840df47dfd26d6deb4065a6151ec71fb6648a222

    SHA256

    db6c98b2e57040f72a080aed78b74841d752503e9a11c258cac4e3cbeb4f56fe

    SHA512

    5ea461a18fdc901cddda28ae21aca1f8655ed047524b4609808244073df0afdf8bdac9b013f4e5e5856f2402fbaafa32601c17b032ab22255fcc6f44d9477edc

  • /data/data/com.takeport6/kl.txt

    Filesize

    70B

    MD5

    78f585452e628d25cd53dde074f483b5

    SHA1

    de656c6357c5e99d4e735aaa4d66795c080341c7

    SHA256

    f6c7539a99c81811b46b3c1b8de86ebb8cb824d1ebfacebd49a457fe44adeaae

    SHA512

    d50801bef4c59e5b081e7486c77701b29b1c8fd938443b42c70f72b8e709a97f54c19ecee8eaab098902abd3e68235a4a6d589062001011d2b92170e43dd949d

  • /data/data/com.takeport6/kl.txt

    Filesize

    62B

    MD5

    007074baca2fc8e2f28314c2ab240725

    SHA1

    9c4055bafe1664776501d3f9ed17241dc7099c6c

    SHA256

    630f6fabd7f37e8260d894971662491601f77a8fe3262d2e4da841c79b7f40e0

    SHA512

    770a3d305755b0baca352126259831dcf0879a38915f036ee0a81adde15647742dfd21b66f1d7f04ae8b53801e4fd198d155d5b3ed753674c5de69a69560829f

  • /data/data/com.takeport6/kl.txt

    Filesize

    45B

    MD5

    c0a4982ab7fbebf2bb8a605874c48172

    SHA1

    42cc7a98df76e4d0f31817a653336fe734f3aeec

    SHA256

    d77efd99dfbb025a53c7d61554c53df79f6b19f4bc5f1981bb697c73541811f0

    SHA512

    f33604d038b3c6fe7443270007762a7d78ee4d649d819081f9b937e86ce52f6718516cdf6a02b5607d03abd9eb9e85d1a45d5d2512492f27ed7ca1732c01369e

  • /data/data/com.takeport6/kl.txt

    Filesize

    504B

    MD5

    72f8b2c18f74df701d1e417f3efe821e

    SHA1

    54090373b5873ad02123a7a77072c8b955c8023c

    SHA256

    0a39ee1e0d6f466204e862faf2b74128d4ea8d0067acc9a0e6a70cf1b06a615f

    SHA512

    c9eba53d4ebeda0527fee11cbad857e25afd82a3a7a83c4511d2a4474a181fec1411fa765e156cabc168261ca1155d58f47464bc3a64f28c20d96940efe08a2f