Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    11-11-2024 22:25

General

  • Target

    d90d8b1ac2f9409a597c6631c085f1f2d7b74203fff86894b1d6ecf18c27cc78.apk

  • Size

    2.4MB

  • MD5

    1f57423f11392522043026b7ed773493

  • SHA1

    430eec543d9830f795aa0b26b7f9ff4b786b512d

  • SHA256

    d90d8b1ac2f9409a597c6631c085f1f2d7b74203fff86894b1d6ecf18c27cc78

  • SHA512

    d00fa1e44089cb5a17ec8be8513a15f709a9764fb218505acc75a6db4d45056f28bf5b7d5da0abfbbc7cb90267f83cd900b5010761b6a73cba51be4cd870031e

  • SSDEEP

    49152:2HOyQmT5CkFh5vnNWDaC5MyhcWD/ThPZOpwKa6h9/egR9+zYRDpg91FyfJzIE1r:ZwnvnNu5bD/tUp9a6h1TqgpiFyfBIEp

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nearshetk
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4475

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nearshetk/.qcom.nearshetk

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nearshetk/cache/oat/xnjebtmrsaepcrk.cur.prof

    Filesize

    440B

    MD5

    b78738029b6d509919b97e4181f67ebf

    SHA1

    c438460d4c7e5939288bc9a16177769e0987181f

    SHA256

    81dcdee9183f123c6eaff8240ef35249dcd8052f2f0b833256ba2b05d2320cd9

    SHA512

    8b777d1e0b6f86be83816aa4474678b9c2a5eb945dd9a7664d413557b107e724bc2cde17ea3c489f0e2ac7a93bd1ff7c42c8e855c2b7972000caf4fb9a912d87

  • /data/data/com.nearshetk/cache/xnjebtmrsaepcrk

    Filesize

    2.3MB

    MD5

    32defed5f0267b734b4ebc737f72265a

    SHA1

    a27f10b386c5666c5454138eb141203f57b30d56

    SHA256

    77cb6887a71abda5ecd318cfc425572a92ed7743dc49156b0125f0e3d58f5865

    SHA512

    a936971998e109ba2100bff9ab045bb5e6677d9f649a79514a6f36b5387217a840cb3382a0233b97e9476262caf1ecdd025ed3df8ac25b9ea03d41638cf4d475

  • /data/data/com.nearshetk/kl.txt

    Filesize

    221B

    MD5

    18922ccd79640edf12f92ea1235e94ee

    SHA1

    b7099c455645ba2f7bbdf66837570068b973c34e

    SHA256

    a9c0c5b5993699ee4721ba62236300a1ad4d4cb9e84cb1f20a9e1428aa459c72

    SHA512

    8ff729be23e6c400b7a8c686f64039354527562cd199ce33622aeefd8a6a008e06f348fd240e3c4fb4a2c32b3bb72aa72be0c3fd86d6df87b5ff85c493a2a9b5

  • /data/data/com.nearshetk/kl.txt

    Filesize

    54B

    MD5

    a34b38f160883c799b7216d9fa8f9c7f

    SHA1

    571eee72a3d60d9d5dac9eed397ddf21516b6232

    SHA256

    c370d55fd1c3d823a16a1083fcc028262898fa65505828c5a0e07f95363bc87f

    SHA512

    aeae97f488e3eccff858ececec344d732d8634caf335c35ae7843c4605793e69e0c06f0fd0b50eb166469f14901b6f8a4f875cda36d887e6fcb703509f46a081

  • /data/data/com.nearshetk/kl.txt

    Filesize

    68B

    MD5

    a2f5480e98b5cf09cfd4f1f73a8326fc

    SHA1

    dadb48d23704c98f3fb24131f1b0f56c3c2aeea3

    SHA256

    d1b366d755be5872fa97c2a895779e685aba0ab9373388ffaf37a4ddee3912ce

    SHA512

    6620e6a2f3017c8f1f69bbfb7eddb139f99b2198e997f56cf9e7e134cffdec8f9ef54abb434524b102bfe82a29a23bf56853c51e355d3d3aa09b9b4ab83ea0e0

  • /data/data/com.nearshetk/kl.txt

    Filesize

    60B

    MD5

    69738d4261029d2e15de67ff0de6150f

    SHA1

    45545871c67a0d81d2697c70cf029dd12d6f781b

    SHA256

    e401aede8087525f23b96a0fee26e56cd07a45fd57f30ef97479a608efec80a4

    SHA512

    99a2aacee729f8d84a6c9ea84b93af7fdbeb561ec3420d4a253c99b008f31fe66e1d6992cc17f949274d5440a0ec8c9bd6c141057a8de9bae87046d6d1da5922

  • /data/data/com.nearshetk/kl.txt

    Filesize

    504B

    MD5

    202d8e422e1156e6ba3e0386627c938f

    SHA1

    79bd1b7cc1f304c46846033d0ecad688507c96b6

    SHA256

    0230cf3fe062a022d1917d34b90b45c57a3910a9925ad08c1ce0fc49c64059a0

    SHA512

    7da855e71f0c6d3f5bda57661ddbd5a957d6a933da8c4bdc45ac96f1c730c3b0722cc0908cad6f6510af7b4498840d96b1a02db18d3f1bd2f6318c3f440fdfee