Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    09-11-2024 22:05

General

  • Target

    3a8aca86890e9d6da081020226cf8f06e61d48025c09d39534d2c31f4dd9b933.apk

  • Size

    2.0MB

  • MD5

    e4828a3f25bda4729c55891a2b4a46c6

  • SHA1

    62fcbeb2151bfdefbfaf47365b17e4184021b453

  • SHA256

    3a8aca86890e9d6da081020226cf8f06e61d48025c09d39534d2c31f4dd9b933

  • SHA512

    04b7155f1cb0eeab6118acef5c6fa5db67b78a3bdbd3c69b870733131133eaf0f4e262be2bd826e8fc249d1f30b9063af1719872c2dbb380d609bda4ad0b7303

  • SSDEEP

    49152:bHmeRPnj4tN71Sl18dbWwvwkfkJdhW/15IZXTukyfzTYZ/BGd8+dznz1/6qmy/E:bXfuSl18Vflfb3vr0Z/Bh+df1/6qmys

Malware Config

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://cizgifilmlervekarakterhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://cocukanimasyonvesinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://masalvecizgifilmkahramanlari.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlikarakterlervesahneefektleri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmsanatvesinemaevreni.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelihikayelervecizgidunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonyapimcilariveoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://renklihayalguclerianimasyonlar.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmklassikleriyenidonem.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelianimasyonprojelerlistesi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasyonvedijitalhikayeler.xyz/MDQ2MTZjMDhlZDQy/

https://kahramanvetuhafcanlilarhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevedostcancizgifilmler.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyenikarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvegorselsanatgezileri.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmvedegisimkulturler.xyz/MDQ2MTZjMDhlZDQy/

https://renklianimasyonvesanateserleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturvecizgihikayegirisimi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtasarimvesanatyonetimi.xyz/MDQ2MTZjMDhlZDQy/

https://yeniyetisimlerveanimasyoncalismasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.negative.addict
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4948

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.negative.addict/.qcom.negative.addict

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.negative.addict/app_cigar/Njmja.json

    Filesize

    153KB

    MD5

    ce4200e768608c737d92e69438710b1e

    SHA1

    bb0201528f33509ff6610cc10d46f5403a7351a0

    SHA256

    39dc35d9a60725607b50c6f052fb621faf2242d4d03a20b0c6bd6133a9f39ae5

    SHA512

    82d4153399f0e5eeeb4fe1333f89e19b164c5ccedfd2aaf8e55e152fd8dd9069c970c5d966f696d0bc750e87cdf102cd941177d06952c7a09454d5aa7187ba25

  • /data/data/com.negative.addict/app_cigar/Njmja.json

    Filesize

    153KB

    MD5

    7a5f66449fcc9c5817e33d6d1767cff1

    SHA1

    2d6b05a081c10979a1cd7bd19cc0fea3a91010c5

    SHA256

    a847cc6681c27ddcedfd45c25c6a726e61f5c834c581c20c6ceed9fb326a1626

    SHA512

    de33a0065e6c506247c24eaf14a1e4b16f22ef95174ef7a1ea1d1db7251bdf4d567825c5f9f54cee2d225be1ce54804857859ff91eb8dd32f8a0042bb2a75179

  • /data/data/com.negative.addict/kl.txt

    Filesize

    230B

    MD5

    eb250431f3f8e64adc6867154e119596

    SHA1

    91a440addad08d7756591001eceb8e10029d88d3

    SHA256

    a1d660314b4b10c7876444ad4609a5acc8b1f4423987b68f816554f1b9f7e976

    SHA512

    b190bb4bd6f1fda122c60bf635e046f9ea791827a1de59c5b966338e6684cf5f4897a735015792da6e042118a5176acd3a5333d14eca5525c50a6edc7951252a

  • /data/data/com.negative.addict/kl.txt

    Filesize

    45B

    MD5

    3e331b0438c862b9476b843ce4c31918

    SHA1

    c84060dadc57fa272d994aec4d537d54613f2371

    SHA256

    70e24994fb0cdf378211c89da8bc31d6f2c5967b31c75945f6cb1bd39d81d1a7

    SHA512

    aa7d6494e56e521f88d389f095c890ec2c6a4acc293ba4bac5dca3f0dbc27f6e910c88f0b5f36707753c1dfb697805e65b6871148849c427317cd280e8276245

  • /data/data/com.negative.addict/kl.txt

    Filesize

    63B

    MD5

    2fff7be2a040006eb58acbf7f63429eb

    SHA1

    00b6a33e6e542c3afd098a52abae87595ac8f89d

    SHA256

    1b543c43ecc2c786a4e8911f425b185089705237724b6177de2b8731c786a853

    SHA512

    fdad042c5cb497d3991a824b392e86fe84e32acf39c24e9ac4ecaa52946b0237ee15a70d5aef53193bb1453487c69287dee855b8b075ef35db59fdbf37adbfbd

  • /data/data/com.negative.addict/kl.txt

    Filesize

    45B

    MD5

    d6ae3c914637150eb9a5a8972eb7ce11

    SHA1

    d39192bf6b607669eeac9e89b1a5593314b4e2ca

    SHA256

    bb1024c91890ed02fe291ecb61ec766d858009d95a82c73d4a43f7557e6028e9

    SHA512

    9fc158054dcaac9054876bba86534c262347b212d19c0e01659a7cc68538daf43ec07429a7612b0ff3da8db7482ce80614610c8b90b7b3dc3c18f234413b085a

  • /data/data/com.negative.addict/kl.txt

    Filesize

    423B

    MD5

    017b8d319cdff8f7a4bebd5427c57b13

    SHA1

    d15600c8da56957b0e430e117e2ff1015afd5fd8

    SHA256

    664d5a2343700ee8a381c8bfd441a45b930acc8a62286a5387bd846f371cd0d6

    SHA512

    b077ca4980cac7f9cb341cc380dca33a2be8d827725aba757832d1f6876856bd259c0c9e050f4375deb5b2b4215328715bd9be894c11f09c5dde43ce5d5ef96c

  • /data/user/0/com.negative.addict/app_cigar/Njmja.json

    Filesize

    451KB

    MD5

    b63162f740f9b8aae12518d071c7fccf

    SHA1

    073a04a2c6bd9f5efa85a307acb0f1b8b78b2f4a

    SHA256

    e35736fcaa7669caf92b211c7489d1ee1020909df36a82d7a6376567436b4034

    SHA512

    99c658b2a4876f739baa28989c7d9c26e473082123a482bf39f763200b82bbc2a98634fe39b6757e34233bf3fe8dae2f5612a2b4166e6925239d7f888fda3039