Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    09-11-2024 22:05

General

  • Target

    39ee97775644bc77df0eeec108c912c8cc47ed1e87597754e9690988b0e2c52f.apk

  • Size

    1.9MB

  • MD5

    28a07e496f2576d9dacbb13a4f32b464

  • SHA1

    af34f01611e99ad9b2b2705b3c21a6c030334e68

  • SHA256

    39ee97775644bc77df0eeec108c912c8cc47ed1e87597754e9690988b0e2c52f

  • SHA512

    6268e5ea7dae1c60177b3d288a725fbfda6decbfa958ffb1087fd58cdf5562a2be040ab39bc4de4a93658f287a073606500c3225d470109600e346a6aa34641c

  • SSDEEP

    49152:TmjYq52kaiFa9PneJd2ABtMMl+tGdtty46tXgi1eEP3K2dhh:TInaiFgfeJLjlXmTwda3v

Malware Config

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.lamp.sense
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4803

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lamp.sense/.qcom.lamp.sense

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.lamp.sense/app_balance/caMcI.json

    Filesize

    153KB

    MD5

    7b6b9f191a413230fef22b58c271c592

    SHA1

    c64a34e96734c643e7b15e5afaf8ab686a865792

    SHA256

    f07dfc3d3af6627fe019bf1669fdf6588e8a8d92db9123a017ee2cbeb378a099

    SHA512

    2ae43f2b31453fd21b896a1cd492eaea96a3f0b81eb751f46c66d142d6326047fad9c868276dfca7f19f04cdce9d0a55effe9e0f1c42e11031094b3c89c421d0

  • /data/data/com.lamp.sense/app_balance/caMcI.json

    Filesize

    153KB

    MD5

    770ebe3fc3186ca094615dca51cda5eb

    SHA1

    cba0fa32a3389b4f97aee025d39e892a01fc58ae

    SHA256

    43f727fdfa7215701f0bbb1b08416d166793a99578d36963d3a01fcee3bc37b7

    SHA512

    ce0ca2744a93c0ebebf99cd4efb919eaaab730e1947454eacf0459cedfc8d130799d5baa55b0efbf68ee28d96c266fdcf9c728f6c59bcf7e2319f727e100b518

  • /data/data/com.lamp.sense/kl.txt

    Filesize

    68B

    MD5

    bbe39269e84e4778a41ec8371b4ab857

    SHA1

    5df1064a01e0a3f97b35e9fb49fa762f0556a6bd

    SHA256

    2116fbe4956f2a7eff00d768bba27360c57061c8c625b78779be983ab69175e0

    SHA512

    8fc43002e97198d86338449f80e92fa9f54ca510bd2c71ea27c0bf2e99e3d680c73183736a75085e084b332722dde7e94090bf77b3a9442e23c42355c59d4911

  • /data/data/com.lamp.sense/kl.txt

    Filesize

    230B

    MD5

    8d9bfbda0fe447ce511fb64cbbb9f42f

    SHA1

    61919b90e15b7bd6d70b7aad3bc0167ace21d37a

    SHA256

    5ac007f10811d90743baddf5dc4d71a176e5831be8543a396e6d3be20e3da059

    SHA512

    ab25327165e836318aa6aea44bd89f281fdeb1ecbf920b355537f5287a06c25bc1f912a9b805ed9a535b7ca63ab0446fbfa55671215624d643f0815c9abbdbb2

  • /data/data/com.lamp.sense/kl.txt

    Filesize

    54B

    MD5

    c34a7f8afd18d982882d96ec8c72f4bb

    SHA1

    a1d3612b1c9e0f71fe9a9ffc52fb2dc16c29fd01

    SHA256

    88eafc859f7cb4073b93e7a77a91fb66ebcae9bd484a699849b7001a6a3eed52

    SHA512

    a09f9fe741a21bfd33f046bf12cee6dc92ea0837ecde0c1af447554d3600d9e73e181badd991ad200c752135435572bf6b75cce6cc95ed608862cb90e76925eb

  • /data/data/com.lamp.sense/kl.txt

    Filesize

    63B

    MD5

    c9bd2f2e24dbdb1928eb2768b4cc5a02

    SHA1

    07daa8c0b73a95e30d86a68fc1d712c8b0988371

    SHA256

    592c55e2f0395da599af908d11f378acf5210cee2e090b0983f1a906f3e4ab21

    SHA512

    aab7885f3fefe4cdb2d381288df8347439cbc859268ab1667cd41866d34176daf7247c3658537eb1411a0eb3876cf082fd837c7c6993bcbda3934f9edf30ccfd

  • /data/data/com.lamp.sense/kl.txt

    Filesize

    466B

    MD5

    da30388d789052be67cc073cf4445b79

    SHA1

    decea2d1793fcb06467f2047d0600ca0f2fd6e0a

    SHA256

    fd602cb222c09f26dd6d49dc643ed63742f9f47a4f1fbf4e8e4a9249365aa0ea

    SHA512

    a51123aa524cbb6a8f35066b66dbcd569501de19afdbc2f67c4f61f215ffaf4ecbb734a31f361d635b5fd47943f1f686ca8af8cfe783a4e791b31dcc5460d9f4

  • /data/user/0/com.lamp.sense/app_balance/caMcI.json

    Filesize

    451KB

    MD5

    c7df11a44d03d0562fbf1fbc02d087c0

    SHA1

    122b222db26b55802c35c9d92297cb4d44c62230

    SHA256

    7c4e4534cb29c2b39c765129548ff5f4856a1fc867027fd040231a645eab9f71

    SHA512

    320bc5a3332ed5c580951bb96c405cd6dafac338f41c43dfd09a76168e8739dfe15a783051ebabead3f342498fbff11d66f6d981e2b30f5553b7813e47891245