Analysis

  • max time kernel
    149s
  • max time network
    161s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    08-11-2024 22:06

General

  • Target

    19cfab0250807cb460aac6cdc53f82ca0914ee50514a13b7b05630376b4c95d8.apk

  • Size

    2.2MB

  • MD5

    c253c9781fd4362f9ac5586782bd0391

  • SHA1

    e55fbf0e4e27bf416d71ff9f192cdb0fdae3f1a3

  • SHA256

    19cfab0250807cb460aac6cdc53f82ca0914ee50514a13b7b05630376b4c95d8

  • SHA512

    dd285a32dd4f405d31ad9512c4cd0f187a385ce77d70829d201228a163ac6cc6745dfc65e5ecf763cda9755bbd7e8927e9efd9363b4463ff1a9c820af0e47691

  • SSDEEP

    49152:cFRZNKxOeuPTS24zMJy3h7eNf8a/l6jE/Wn51Cw0Ipd2c:yRZNKIXkzMJyS6jJn5YHIpIc

Malware Config

Extracted

Family

octo

C2

https://uzaykesifveteknolojigelecegimizinharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yapayzekailegezegentasimaprojesi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlararasihikayelerveuzaygemileri.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurgukesifvedonusumharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://paralelgezegenlerveyapaysavaslar.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiseyahatsanatyolculugu.xyz/MDQ2MTZjMDhlZDQy/

https://sibernetikveevrenselakilliyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://gelecektekiuzaykolonilerindeyasam.xyz/MDQ2MTZjMDhlZDQy/

https://robotveinsanbirlesmesimacerasi.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvetoplananveridunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiiletisimveanliksistemler.xyz/MDQ2MTZjMDhlZDQy/

https://gelecekuzaygemisifantezivegercek.xyz/MDQ2MTZjMDhlZDQy/

https://uzayzamankapsamivedonusumkalkani.xyz/MDQ2MTZjMDhlZDQy/

https://zamanmakinesivemultievrenselgeziler.xyz/MDQ2MTZjMDhlZDQy/

https://paralelboyutlarvedijitalruhtasarimi.xyz/MDQ2MTZjMDhlZDQy/

https://galaktikekonomiuzaycagelecekyolu.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvedonusumolasilikharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlarveteknolojikmedeniyetler.xyz/MDQ2MTZjMDhlZDQy/

https://karadeliksiralariuzayarastirmalari.xyz/MDQ2MTZjMDhlZDQy/

https://galaksikarasivakumbilgeliksistemi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://uzaykesifveteknolojigelecegimizinharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yapayzekailegezegentasimaprojesi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlararasihikayelerveuzaygemileri.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurgukesifvedonusumharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://paralelgezegenlerveyapaysavaslar.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiseyahatsanatyolculugu.xyz/MDQ2MTZjMDhlZDQy/

https://sibernetikveevrenselakilliyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://gelecektekiuzaykolonilerindeyasam.xyz/MDQ2MTZjMDhlZDQy/

https://robotveinsanbirlesmesimacerasi.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvetoplananveridunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://galaksilerarasiiletisimveanliksistemler.xyz/MDQ2MTZjMDhlZDQy/

https://gelecekuzaygemisifantezivegercek.xyz/MDQ2MTZjMDhlZDQy/

https://uzayzamankapsamivedonusumkalkani.xyz/MDQ2MTZjMDhlZDQy/

https://zamanmakinesivemultievrenselgeziler.xyz/MDQ2MTZjMDhlZDQy/

https://paralelboyutlarvedijitalruhtasarimi.xyz/MDQ2MTZjMDhlZDQy/

https://galaktikekonomiuzaycagelecekyolu.xyz/MDQ2MTZjMDhlZDQy/

https://bilimkurguvedonusumolasilikharitasi.xyz/MDQ2MTZjMDhlZDQy/

https://yildizlarveteknolojikmedeniyetler.xyz/MDQ2MTZjMDhlZDQy/

https://karadeliksiralariuzayarastirmalari.xyz/MDQ2MTZjMDhlZDQy/

https://galaksikarasivakumbilgeliksistemi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.fit.town
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5119

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fit.town/.qcom.fit.town

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.fit.town/app_depend/wosX.json

    Filesize

    153KB

    MD5

    c0ea95b5f71cb3b0f9b8ecbb0768b422

    SHA1

    e9612fd21c9ca4d8f6ac47ef2d9ec76fdfdb6e41

    SHA256

    4a876fab29fc819c4410c9c88684f06800278ac36cd9c30c5a78ec4d68288d31

    SHA512

    7974afa82f2037ec370a52490d6aefb1c6a0c86e306f60ec28eb37fb36e47ce7214d612a264cb76409c17c89a687e56ad549d5153e6a6d98999735a4c1316923

  • /data/data/com.fit.town/app_depend/wosX.json

    Filesize

    153KB

    MD5

    14b4c85552cbe90b9e0154b1b953b5c1

    SHA1

    1bf38e6064cb4eeefeaac817ca246b441494d4e0

    SHA256

    043f0819454c96a11e247c0234add9cb612912c9d35842483b11769c51e19c80

    SHA512

    d48b79f03d89955e629161f7aacdc3ce752e1ac3f8c63453257545466affe693e592268d74d451ab4c6a7bac17deaa41fad72833aba27d0c80c1c2095dbf0672

  • /data/data/com.fit.town/kl.txt

    Filesize

    230B

    MD5

    f1af1ee9ccda8c1c654a58af9414b725

    SHA1

    70aca1904e34b5d6f734dd38cbd8afbe16e00e15

    SHA256

    52600c1149e8e8b36e5713063fb662836fb1a897ec687683e868255a840c63b1

    SHA512

    7daba25f4fee34d2654472731ea258d765029d36c772f63f2a643a28fe58b4dcc4f5cebc0abcc0843075aded9767eb87966c8ebb41ffb236d2ec97868ddf3816

  • /data/data/com.fit.town/kl.txt

    Filesize

    54B

    MD5

    6441e615e714d34388e2c40cba564db9

    SHA1

    6c4ba54d18c92ff974c67dbd1d4d166ad39edf4f

    SHA256

    0e0def47634a9e76d0be3a7d6d3768ff9f02858b55e765476fa5f6c4c5011387

    SHA512

    6ad21ae8e80ab716fd8ae50baf39c9ce613af584336088a6c5aad1bbcfd8a84c60b9fe9f4b273b0bd5d510885116e549f0a6a77f4f6a54efa37b063ae2b6352c

  • /data/data/com.fit.town/kl.txt

    Filesize

    63B

    MD5

    23411ec6983c0db3862175ad5981e4af

    SHA1

    5d5f2cc0e3988ab63830df24135447fced6163c1

    SHA256

    a3e569ffdee573998ed279085496c5f351dff5ba181430787534c539d7a09607

    SHA512

    85b304fe8ce480660d3ab05580b9ec554bd2ccf38c6553fd2b6534d17f816b53b31b6fef8f60aa0efff91a07c20780ca92cdeada5f41b66acf4923f15f898ab9

  • /data/data/com.fit.town/kl.txt

    Filesize

    45B

    MD5

    6a29934553bff710b3834d8b988e01a3

    SHA1

    7081a102f9e8f9696ae241338ba9e10843e96a38

    SHA256

    92a92a073ab5c91801b39ec755db31f689149ca16ac3b71156d9bd68a575b068

    SHA512

    7974c52bccfe9e20b2791b8f7f538acfa440710680be510a7cca7431366c6b827b3f902df0b741b17c9f1a3690fe680268d4867c759cf2e73d12535c481c486a

  • /data/data/com.fit.town/kl.txt

    Filesize

    423B

    MD5

    103e2d738fb59cabc2cd417bee948f6f

    SHA1

    0d4e5c4520d4f30b82b54d7c294ae5d4c5bfa086

    SHA256

    7f7841b2b7488467c36d1ab42d2ec8e2610007ba2fa161252ef5a1fa53928015

    SHA512

    d98cc97e02c374d472cf7a328dd34ef95c97475ecc6992e199a0e0d4b8386bb8219425d142512f58f5d2ca03259477a548684ed667b0facd2b4f160a02cc0196

  • /data/user/0/com.fit.town/app_depend/wosX.json

    Filesize

    451KB

    MD5

    67add7c1276e4c52c9030f0424617512

    SHA1

    40d062122f4ba5e5b06566faa3d593bdc8f6211c

    SHA256

    52b45a99cdd95969d4d319d931d22a3094670cb3806529d675c6b22e5fd97301

    SHA512

    d2b577e74b78c6b0cec9b9316086c7134a471576a0ed90df2509e9b53a9a37ab3161116941ec8624f79f2a4f59ea4d193ba4afa755d1c9202ef09c7e33c4d7e1