Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    11/11/2024, 22:08

General

  • Target

    d276c47b66e3defbe84f1f469d6671929c6d82b44f047a4570890b854e877aca.apk

  • Size

    2.4MB

  • MD5

    9389c1acf226cc4adcfecc7a872bec5c

  • SHA1

    29571e14b71e8ccb1560962e00ed8238e80794e6

  • SHA256

    d276c47b66e3defbe84f1f469d6671929c6d82b44f047a4570890b854e877aca

  • SHA512

    08d84117f48b182cb7cf999bc73cb02449457b8f103d78e03ec51489705829ffafb050bb9fe01d9f67b2d6619ca7c0e7542e2244ddd832be827509b79a4bc5c5

  • SSDEEP

    49152:XwUmKXWNBm6nsf4YGjfXD6dw3mzdrOx1rBxdQjf4sQE5Uoa:gnRc6nsAYpvp61rzdQU9iUf

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.saymap3
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4498

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.saymap3/.qcom.saymap3

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.saymap3/cache/gazakxcj

    Filesize

    2.3MB

    MD5

    71f68727472f0453ad2a40ca0c87c22b

    SHA1

    559d209b03d7676be2a5948f94cb38a8613cb0a8

    SHA256

    5b024de1785285cdf218bf4ac38b690912bfb11569d72c42b1fd779f4149e36a

    SHA512

    b24cb67c6b9c8025a77dad6dc70e936d2540672476d75ac507f5a4f6823b96e5024b2d5fdc33f0b7b0a3999b8995d6e6ad401f98e547bc630e59025f2853fe6e

  • /data/data/com.saymap3/cache/oat/gazakxcj.cur.prof

    Filesize

    438B

    MD5

    ae239a13cf93ad4a91bac5a570d65e48

    SHA1

    8df2530b40e83c3d6c17d518aa647255743973a5

    SHA256

    d9096fe7352fb31baf8a5c6a0da51e41ba23580b5c5efff0288ae87280095a75

    SHA512

    f174b4ae7d1ba5bb2ec39bfc9d8be0cb4bee8dc35643579295fcac222f589126eba6872d3c28785f66a2125313f897adea6d8b287f2f0aa2e55f4dc873842c31

  • /data/data/com.saymap3/kl.txt

    Filesize

    221B

    MD5

    85320754abe9f074808748672d36170f

    SHA1

    6077cec0238402ae4a0a49340e9eff5257856fad

    SHA256

    c0034601f2db57b6e48ff50263624f9d6e819eb911eaf8de4144dbad17a81701

    SHA512

    e0e7abdfe59bed5bf75484acb136e744ef01f1a2957f8bc15b5c4b529a2920f93dd2135f9f65c72bde910e98636248e8a7e2feb5e1db13854e6e01375d4f6960

  • /data/data/com.saymap3/kl.txt

    Filesize

    54B

    MD5

    e7f95a5d485ecb6abdb069b6d22c649b

    SHA1

    444d66808a22cd03b45449ff2913c88c826cdaa5

    SHA256

    c5b954685d1d29ec9e51201587fcae79c2a275675a699c44ea03169a6b070c16

    SHA512

    d2fa49316e53b8f9af42729efb0e0bca0000b09b364accbd3b8b258efe225834ea5323580f1177cac3c91f7bff244f0b26bdf6f2dd5b9cc409bebc3086410ec2

  • /data/data/com.saymap3/kl.txt

    Filesize

    68B

    MD5

    0312fe987bec7a280929f02fc5236ab9

    SHA1

    cc51261c08dea43148ae346ef3425ba1370427b5

    SHA256

    769670e85e67d616286075ea1af710b2849c6f4b2931d17fa003a2f262f53d82

    SHA512

    b50f9f33e9db4a7591363005c6d34a71c2d360ac55cfd4c52182455eafba8992a61a9b7d7ddbfed36cd062a48d3be0616fd2f3320e2979e40a2315ccccbd7cc3

  • /data/data/com.saymap3/kl.txt

    Filesize

    60B

    MD5

    d69db42a6390e58f92ed659ca4d44319

    SHA1

    6621df89ef93cb9cf1fa79deace8c846c35db8ae

    SHA256

    8f0fac7dde44a147ab5a3d5fd1ae7568052542beacaadeb67c6621fa8a7deb12

    SHA512

    6f8c3703ab887ee9a262aeadacc22676c41e3d7c5026d7fbcb2b0e0703bad610fc6f87b842a19a3866e00adf3566b59465696a6e47fc0e52c6d6849e27c8829a

  • /data/data/com.saymap3/kl.txt

    Filesize

    504B

    MD5

    a592f03089e4e805bd2392c0618feb10

    SHA1

    89b5e754ca9fe804c12117123054a5642f5281cd

    SHA256

    741087eb8b669833fdeb81582bbde4734aaaaf6fbe7403a25a61caf1afcac783

    SHA512

    29c9a584316844cf457193c42f68ff95684d7f7d2cd114960f23e58c7f0ff26ac9f5882807f2031223fb2ffb5c514784ecef4ffaa2a8b3153fb754e8af322f61