Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    13-11-2024 22:02

General

  • Target

    8fc1974dc696cd7552ec989b26283cedff9d4637524d7b9e753f4919b29567aa.apk

  • Size

    2.4MB

  • MD5

    ac0dbe91dac7c1d0c8388050e8f06892

  • SHA1

    21fd3f8ade5fcd5b3a5272b3e56c4259c3f3174e

  • SHA256

    8fc1974dc696cd7552ec989b26283cedff9d4637524d7b9e753f4919b29567aa

  • SHA512

    20117fa9f2caf8a2c1e85445714d1ff5b9cc5b92c69af896434266e4793cdead87cb99d572b252319db8072c8a80f5bfc558db5b968fb8cd1d8ab06bcb780760

  • SSDEEP

    49152:jlVrvYdOUln7XxLgTUmvyNXy3ycndbu51ztTzD9TtOPpEo3YcG0sfpH64Ng:7wOUlnDxLCUjU3N1OzTNcPKo3YWsBa4S

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.actpound4
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4792

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.actpound4/.qcom.actpound4

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.actpound4/cache/oat/vemzcbbh.cur.prof

    Filesize

    355B

    MD5

    c286ab8b70aba1289d6a9112a2f28585

    SHA1

    92d40305755cd4eafc5755e2607eb11caca93caa

    SHA256

    30bdf3e3aeef847ff372b2fe0d281b427d60700b80187fe200afb57d0cc0076d

    SHA512

    96d58cfc3136a3b740f3c287aead10946a4d747fb0116f88331765de6c71c6ce7fa53f816e100bd2a1b30b860a531f92032e0a014872c558020a0e3f7f6283ac

  • /data/data/com.actpound4/cache/vemzcbbh

    Filesize

    2.3MB

    MD5

    b89b67df14bd6c0d5d42b2045b46f20b

    SHA1

    4a6d8be000021f850a97de9209f237deee96df29

    SHA256

    e065279612f7cefcfc46f7fd11f77ce5e26765ecd03feda9bac74639c4d7cb48

    SHA512

    eac36b75797d41c8b6f8755d8954b75f76c36bdea6a07279978d4074a2c04a0f280bccd6597b90b1d23907d0ea662ab6443505e3d577aadee69049ff84627b4a

  • /data/data/com.actpound4/kl.txt

    Filesize

    237B

    MD5

    d6fbe642cf374cf26b5e7dc915000cd5

    SHA1

    7504f8d6518e91308550ab7e6e67937e5f0d22f3

    SHA256

    26d4dd4ba5dd00526f0c9bad1b1ac0a6347be1aadad5946e4f0317fa022031a0

    SHA512

    6856716dfbe08766036c8ed79f304a39b735493cd98bad8d8634626072c6b7bc751082356506b1c8f71a8851fe62cc8bd04924897506800f6c416538cad91e87

  • /data/data/com.actpound4/kl.txt

    Filesize

    54B

    MD5

    81f1465876c1faa48638b075e2171c89

    SHA1

    5fa8116e38c958ada8e32f026ff408e64a955742

    SHA256

    49c4a5fdc8127549d963b756552214265c90c6501f5f528c5ba15d16d21122ef

    SHA512

    f14082d7cf639e253e42bc8f40d55f3e8737fda1c53611e0786c89eeda6f6c6dc2bd7534009f45c88a4cee7f93893fc3e7f9e77af75eddd0bcf9138e8c3449e1

  • /data/data/com.actpound4/kl.txt

    Filesize

    63B

    MD5

    c39a87236b9cecfc6c4c979877284bea

    SHA1

    8106df60b0796308cf17e1316d78c0f90f91f05c

    SHA256

    63e0bc24399f0773e002a80e1a8998812f8797e774e8d26702b3ff98a0b6a64e

    SHA512

    10b8c277e262800b914e8047e97193a9ad8d95d3fd45880d78d914f1be28b81e80272db2a7bf01001794b5b462acc083ed6ad8876b6e733e55388e44580b0809

  • /data/data/com.actpound4/kl.txt

    Filesize

    45B

    MD5

    de166e9b8238c2665de4a6a4bbfc23e9

    SHA1

    555d15809f5c61e2bc7aef7bc3039fa8f0b565e1

    SHA256

    fe5a7ea57c855a1066c9674e7288ade4d9553b4444a61328bfb6750dd6d3c714

    SHA512

    6a1e81c3d26eb749e33f919e7482e18a908dcca67119a2422f3459be47211ffc3bda3824c6f1431c26a0c6adde56f3f239ce52cd2f8d4fe533fbae738dbb699e

  • /data/data/com.actpound4/kl.txt

    Filesize

    480B

    MD5

    133598c86b255f6f9c0ae990f573137d

    SHA1

    515ddd2610f996c1c0705f0695adf5e2c8b6338f

    SHA256

    a4fc2705aa1ff76fe030728ca2bad1898c99b89974c270f67dc34022410c527c

    SHA512

    9aabb3b4dc6ec64a0d6f2667acfdd0671467487239ac70871f65588acb73dd33e1589d8de0bb3efac7480b294fa869e5876763f59ca1f63ea58761f7dfafe974