Overview

overview

10

Static

static

6

39ee977756...2f.apk

android-9-x86

10

39ee977756...2f.apk

android-11-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09-11-2024 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39ee97775644bc77df0eeec108c912c8cc47ed1e87597754e9690988b0e2c52f.apk

  • Size

    1.9MB

  • MD5

    28a07e496f2576d9dacbb13a4f32b464

  • SHA1

    af34f01611e99ad9b2b2705b3c21a6c030334e68

  • SHA256

    39ee97775644bc77df0eeec108c912c8cc47ed1e87597754e9690988b0e2c52f

  • SHA512

    6268e5ea7dae1c60177b3d288a725fbfda6decbfa958ffb1087fd58cdf5562a2be040ab39bc4de4a93658f287a073606500c3225d470109600e346a6aa34641c

  • SSDEEP

    49152:TmjYq52kaiFa9PneJd2ABtMMl+tGdtty46tXgi1eEP3K2dhh:TInaiFgfeJLjlXmTwda3v

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/
rc4.plain

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.lamp.sense
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4318
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lamp.sense/app_balance/caMcI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lamp.sense/app_balance/oat/x86/caMcI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4343

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lamp.sense/.qcom.lamp.sense
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.lamp.sense/app_balance/caMcI.json
    Filesize

    153KB

    MD5

    7b6b9f191a413230fef22b58c271c592

    SHA1

    c64a34e96734c643e7b15e5afaf8ab686a865792

    SHA256

    f07dfc3d3af6627fe019bf1669fdf6588e8a8d92db9123a017ee2cbeb378a099

    SHA512

    2ae43f2b31453fd21b896a1cd492eaea96a3f0b81eb751f46c66d142d6326047fad9c868276dfca7f19f04cdce9d0a55effe9e0f1c42e11031094b3c89c421d0

    Download Submit

  • /data/data/com.lamp.sense/app_balance/caMcI.json
    Filesize

    153KB

    MD5

    770ebe3fc3186ca094615dca51cda5eb

    SHA1

    cba0fa32a3389b4f97aee025d39e892a01fc58ae

    SHA256

    43f727fdfa7215701f0bbb1b08416d166793a99578d36963d3a01fcee3bc37b7

    SHA512

    ce0ca2744a93c0ebebf99cd4efb919eaaab730e1947454eacf0459cedfc8d130799d5baa55b0efbf68ee28d96c266fdcf9c728f6c59bcf7e2319f727e100b518

    Download Submit

  • /data/data/com.lamp.sense/kl.txt
    Filesize

    63B

    MD5

    da405d711ec0c096b4c819f7c3ba44a2

    SHA1

    5819e4cdab2630221b53bb2075e8368f5be1106a

    SHA256

    7ecafbcbad879fe5a665bd796a7c2d7ac93160c5ddfe4db72f3c65a7dc0384a7

    SHA512

    ce0522ccf07be07201a171f4f36ebbe4b6c100f306da5204cb9aa81f449e975ab77dbe6f059514376e8a8b74c68676e687143ef4d90cdc0d22ff5b1632a065be

    Download Submit

  • /data/data/com.lamp.sense/kl.txt
    Filesize

    423B

    MD5

    68a58dfca4ffe4f850b2a541b6e190ee

    SHA1

    9345022a15434db8a89f48e8fac236f736dc8dbf

    SHA256

    a50e2a1194be8679f8440d989d19c3a0e3f6b084018d832db1eaed74e73b4d45

    SHA512

    554b373e959b61c7ea4707c92b2ef075c7ef76878973ee4e0d703782bf9e3f1a21f0f6cbc360ad1d6956ace93b2680336bcaa99af76e9e95f3ffe8f64c7663d7

    Download Submit

  • /data/data/com.lamp.sense/kl.txt
    Filesize

    230B

    MD5

    384187e723ffc8ec6f1f4605ee49eda6

    SHA1

    55deb0d17af043d24da5161d833733c93ef15261

    SHA256

    ab5ef275cad542c6bc84b0bd4516d3a9ad97b285c9b0abb3dfad9f87c660b781

    SHA512

    bf4e086a1cd89f82c9fdb48236a5d2d9da5dcf8982e239b0e29d7258c1a3a9286429c2f7372894e675faae16cce0c6db3586cfd4d2271c9b46039adf155091c0

    Download Submit

  • /data/data/com.lamp.sense/kl.txt
    Filesize

    54B

    MD5

    6ad215ad3d1515e5b4cb78aa727c76bd

    SHA1

    3a24b0f2dbfe8ecae46a8db482db58067d7fb645

    SHA256

    42d81d329b12dac9f717924c4b6b9d29aff986ee686e587f3c5a6f2f0ed6760f

    SHA512

    f00272f9c1b74020c886fd6b99b258e9e6edff1d75f213b29ce2f5e349a4db5b77ddd7356e69ce731c8e5b5ae4f2b4a97055aeff80002dc8e3d468fdd6c0827d

    Download Submit

  • /data/data/com.lamp.sense/kl.txt
    Filesize

    68B

    MD5

    7e969e77d7c96768e40fe15d281f1ecb

    SHA1

    12eeec2aabf505de01b528703a09a637d3230f29

    SHA256

    f56725d1ca5c158a2a4f47c040abe77e9c7e20df2b5a3941dc1cfd997d0b5b36

    SHA512

    48f4bee4048afe7f54be558a8ebb03ca99aad89d70274bad59a632d3bf5a0d3fe9743e9210029c61fcb2c5099123e222bbd99918cf59da6166c0faf731694a74

    Download Submit

  • /data/user/0/com.lamp.sense/app_balance/caMcI.json
    Filesize

    451KB

    MD5

    8c3dbc41d2c30409d1aed92429a8a847

    SHA1

    8135ca841d1eae14349b5a7ac5bb89c68f0d55bc

    SHA256

    8117cb0e767407c33b51616d06f76bb2ec0525c1f997509502fad7cf445ebc70

    SHA512

    886ae6be5c1d8b5e3cf513511be83edba15ddaa6ef515e069ff9591b8ee34d951cb61cdff3c1c3802b4a4d8e97fe75c5b0c0f54424fb944ea65b591e170e9e57

    Download Submit

  • /data/user/0/com.lamp.sense/app_balance/caMcI.json
    Filesize

    451KB

    MD5

    c7df11a44d03d0562fbf1fbc02d087c0

    SHA1

    122b222db26b55802c35c9d92297cb4d44c62230

    SHA256

    7c4e4534cb29c2b39c765129548ff5f4856a1fc867027fd040231a645eab9f71

    SHA512

    320bc5a3332ed5c580951bb96c405cd6dafac338f41c43dfd09a76168e8739dfe15a783051ebabead3f342498fbff11d66f6d981e2b30f5553b7813e47891245

    Download Submit