Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    08-11-2024 22:02

General

  • Target

    591d7f8ed09a5292f8ec0902b5829601044c4c5fa683ab80318ce4b9706d980d.apk

  • Size

    2.4MB

  • MD5

    e87d8c3101ca57c8cd79fca120ed8aa1

  • SHA1

    58369907d81e116fb1f51a925c6513ceda0c63e1

  • SHA256

    591d7f8ed09a5292f8ec0902b5829601044c4c5fa683ab80318ce4b9706d980d

  • SHA512

    c74c9b342252313a1ae892ff38ef9c9014b675988653789e672eae4dae451a61c8fb1a0043f1923ad1290a87951850ce8eb5fe734329d2d5c3b9198994fc3ff9

  • SSDEEP

    49152:Me3qc0PR18vfjm1mdQmKf1w5Ym/1ZiHco14LnNBMCLo5xD9Jyfl5Lbtrsx:tNjAmdQ9KaGZbyw4Go5xWfDLJrs

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.walkwarv
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4266

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.walkwarv/.qcom.walkwarv

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.walkwarv/cache/mewllqm

    Filesize

    2.3MB

    MD5

    ef2a5b1123dcd96c7db606cc33ebab93

    SHA1

    f628445b148835544cb131620dbdcbc972292c28

    SHA256

    5a82bd675e5621fdc04411dd57c2210093e5b86e6a3531d61645133a10a290a4

    SHA512

    aeffa096ad9b021cb6430f3fd70c03501c8c1cbe4a0ff9747ac8fe72bb0094d6c3944df6d87e2cb9714e7bc3e5e9fb5d5ec7be702016bf74cab0acd0ef873cde

  • /data/data/com.walkwarv/cache/oat/mewllqm.cur.prof

    Filesize

    530B

    MD5

    163e4e13a486643ac60a177f9f401b73

    SHA1

    3d2509ef5d9a2d414ae50cc583b57f483e81dc00

    SHA256

    f512c4630a39ee56b2fe02a545b38d6bebac7265f02592b9cc29d626dc558105

    SHA512

    9b0537533f97c6eb739062452dcdc1a103ba12dbb6bdbd1acf7db82b86504b0d72c351ec24ca18d01fc5015f9ac99b07517b088f3d7005d738633720547fc6cd

  • /data/data/com.walkwarv/kl.txt

    Filesize

    237B

    MD5

    a5bcb556985787f873bda3f03ba0e642

    SHA1

    9fab409f7f45684cb55d750219d77496dc693578

    SHA256

    155a2744d0542552b418bc425e91e0d0b28fd5a96a1041bd2fbc3005afd83977

    SHA512

    0c983626c468a23e5912ae5443b98f173bd122a7f0120f881204e061118e2413d9d799659ca59b3524b4d1cfa92197f7be430ddce0255ac87d6da5b99a150bf6

  • /data/data/com.walkwarv/kl.txt

    Filesize

    54B

    MD5

    3f6d70da4eb8172b1edc9433e18c765e

    SHA1

    e794608bf32b6c0c538216580f295f1860291451

    SHA256

    45d123f941df82cdf47b28e7974b456b211266f3a8a8d0eaed899ba0769892c2

    SHA512

    24b2c910cf08835416596056290f214defadba3d6ff6ac7c619ab4c6f4f21fcf92e94761636d5153e1772f3cef95e81814a282a05a468d30d33fa5f365bed5f1

  • /data/data/com.walkwarv/kl.txt

    Filesize

    63B

    MD5

    83bfb3c411f2b8d3e31b27b8e44be62a

    SHA1

    7da103b429a87e849c2d3773e9029d1ebf18b557

    SHA256

    9438ce955ff96cdf7879c85d5d92a1cd5b13a47bd17e620df7dd35ac3815357b

    SHA512

    1f676340fa7c97dfef28dc522de6627659a8423fdaabb3480738f0acd6447ced213d7e4abc6e9a8c6da1cd7acf5fdd33ecb548ec492295f5f314d638887d623f

  • /data/data/com.walkwarv/kl.txt

    Filesize

    45B

    MD5

    270074c360f53e174fa51660a4c9f1a9

    SHA1

    a1ff4d39909dd514df92dbdd7e963b19edad0b21

    SHA256

    528030f64676399c36a125682660f3166d8cf5df8b99de8e70d580aaca35a5a3

    SHA512

    f7f17d9360fda96be6fd58fe8466a9a60ead81214bd9065383925b6570e9946458cb7952252fe5e4ce0e65aa2b820c7d30c1543e3db8f6285301c1a83522f7e6

  • /data/data/com.walkwarv/kl.txt

    Filesize

    437B

    MD5

    9c7cd5ea87a894386ddd6c0024b31ccc

    SHA1

    51bc45a7da438a5617bdcf1a9d306e06b65e68a8

    SHA256

    47ebfc7e2f43ada0764df114f5bd6e3dd7419e94891529d5dd327616b4c91d7b

    SHA512

    66c33fc8da91eaa733d5f70007c77d57aed58d5e8d79514c3217232aa3d8375579da75f9252c3c5305f564ec4aa01638ba524e5e214a2ddd58b1d7219b536fcb