Overview

overview

10

Static

static

6

1cdaa20148...63.apk

android-9-x86

10

1cdaa20148...63.apk

android-11-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    140s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    13-11-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1cdaa20148555965e09491bf5dd9fd617487ab08e2823dd54eac8d60c693cb63.apk

  • Size

    3.7MB

  • MD5

    06f4239168474d9bb0dca65531653b44

  • SHA1

    5e09f9eb33beb79271e5fe865fc2e0986ba5cbc1

  • SHA256

    1cdaa20148555965e09491bf5dd9fd617487ab08e2823dd54eac8d60c693cb63

  • SHA512

    e45a262beec24a9a09e9166955599eb7755c684bbb84ac4a2d51920b88f6d9c421ee28dec0258f4fcd759890b9de4bb3a72b5127052a91b7a4783fb5e8db9679

  • SSDEEP

    98304:bDXpkk0rBh9WU2H9wSjXT62aHPjEiAt65KVv6uCIB:HXpk1heHuSjXT6FHPAiAt65K94IB

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/
rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

DES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.easemusicuysf
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4264
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.easemusicuysf/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.easemusicuysf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4290

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.easemusicuysf/app_dex/classes.dex
    Filesize

    3KB

    MD5

    7d89551c35e05a53293717643d08be34

    SHA1

    5c3723a4bf467760e7ed24018f4e062f188e0c02

    SHA256

    69a63119363b6e22a36273da7328b0f0e2c051aa8857105ddcc7d896de6028ee

    SHA512

    6c0fae655b69a292f67d490e845d858d5e6a6ffbeb6de202c5349f1c5068971cada480cdb7bfb6715994c0e873a56a3151dc6e7249d83900956e1e7f3dca88b9

    Download Submit

  • /data/data/com.easemusicuysf/cache/classes.dex
    Filesize

    1KB

    MD5

    6bf135988a1d01faf73f33b53842c6d6

    SHA1

    fcfcb9bb2244334b372fd27ff5cbb4bb7f1e1343

    SHA256

    c9c3fb39b7a8a2c06647e2eb82cf2e458b570c14579916c8dbcfec7e167152f7

    SHA512

    4948bb01303e89a9e343ed9a04c294bbd3c7ad7ecdd99566c369a4c10f8a58909652358be7e6b1d415db4e1906e57f1ce19facc03a032338c23c8f8048bab535

    Download Submit

  • /data/data/com.easemusicuysf/cache/classes.zip
    Filesize

    1KB

    MD5

    e2369010a3d536676e7b35af6d594d88

    SHA1

    111b52af7ee61d20175c6c63008002f74753e2d1

    SHA256

    a81af1d17982bc6d71aff264eda2d19720b62679cd5fea7fc5e3d9582ea893de

    SHA512

    ce6f9f8d3edb068021ca70362b1117263201737599c9f76c1b480896050e94ab4aa2fc3fe2acb881956a52ecf9cccb25d04806dddd5de7199de60e19738ce976

    Download Submit

  • /data/data/com.easemusicuysf/cache/oat/zypje.cur.prof
    Filesize

    465B

    MD5

    19daecdb60b0d2996bd6673dedfc680b

    SHA1

    9516976bddaa13e644d458025ec31522ed36e9d0

    SHA256

    5a246cb7f83a99be95492168599c802411fc861631ee49d4f619ba7ff5baf8a1

    SHA512

    25c606d34a2816f2be760f6891ae67f5b80591551d54853f17763021a95a1baf045766fa001f96c8317ac822ae51d239472069b76ff5f56d275c92120757a30c

    Download Submit

  • /data/data/com.easemusicuysf/cache/zypje
    Filesize

    449KB

    MD5

    0524093ee449af099d4ec320c3d89719

    SHA1

    749505996e6e27dce27df6544c9150354d227557

    SHA256

    8175abcf8a344d1f237356b46f62731f72bbb1827f060ffefc387642d322cf9d

    SHA512

    5a3a3f097934fb6108337060f1928f2e35fb40ead7c4706481214d15d742b5c8e61ced5b17888bd1d0090e88bcb23b7ddc5b6bf00548bc97a32f8e425b9dd72c

    Download Submit

  • /data/data/com.easemusicuysf/kl.txt
    Filesize

    237B

    MD5

    daa53313d1f630631029cdcefdb37f6a

    SHA1

    bfe77c500ac39faf106edf6f61025671f12b2406

    SHA256

    33858a2cc7e77ea21d7bc2ed4164ad1d4b24b48a6f3a3536cdcdfdd0cdd414cd

    SHA512

    759fbb19d7a23da013cee917064b2d862c22c1f7f6a13ebbab4730aff0000bc74632ea222985200229e79795f24a00d7b0f1157173dc0cc95f6bd2db718323e5

    Download Submit

  • /data/data/com.easemusicuysf/kl.txt
    Filesize

    54B

    MD5

    dfb722b8a33334fbcf7399b5bbc046db

    SHA1

    814ed61e98dddf5b3d2e8803694eb10cd486e5d1

    SHA256

    809cb66c4ef71fd20c851be6fe156b2bda54c1b1c009458429875f09b989e427

    SHA512

    bf411de92164b579988b90e30aa7c2f9d255c444d23216793e7b558134c1d5b1378e586c9603341fe28c0ecd99f4826c4042f16e6c5058646d40aeaf6adc3ca7

    Download Submit

  • /data/data/com.easemusicuysf/kl.txt
    Filesize

    63B

    MD5

    8f01db03841f4d9f22d13d4abff485ce

    SHA1

    da9a83bdbd038f0f28c33073a0662608e0a70123

    SHA256

    59621762777cebd0a46402a5be28f2b378bbb63b0a691e90c1dbd3de2d4a9a03

    SHA512

    9b5508bc5d5d15c6553034ed8025def09b430ba3093702e64ca345bcc006bc81b40bdb9a1420950e3f0f128389a227e656527c3470f3b2b1aa36d5fdc52d170e

    Download Submit

  • /data/data/com.easemusicuysf/kl.txt
    Filesize

    79B

    MD5

    d8787c4dedf8d1ffbfe185024ce476a5

    SHA1

    c6a3eeb40a80ac9a98ee30cfa24b8e826718c93b

    SHA256

    a8850aab2c52d5f816c09d25e7a6e7fe8d16ea1e552842d9430425f9279a81c1

    SHA512

    70d53e7b45c7c20b65123a1a166b946d1b84e505342e404766ca44a55cd9907e48c4b4d76143657b86200d93c3e8f2faa8fccafe70ffcce23feed1905ccc6e07

    Download Submit

  • /data/data/com.easemusicuysf/kl.txt
    Filesize

    437B

    MD5

    555814483f55b4164cdf3440a3de975b

    SHA1

    d529739b09f8e99851e41c551307ba1643843699

    SHA256

    371af5c8031f540881f3c030dfefc81d54c114ccda4adc2b5cc9fc54bc7cc4de

    SHA512

    402f341c2b63f3747e25cec4fd349426fbc2eec96c88e4b52aca61bdfa0ec85368cbc4b35074fbb50943a70b6a99ea57d8719591b35cfa5b803620bd09e6c90c

    Download Submit

  • /data/user/0/com.easemusicuysf/app_dex/classes.dex
    Filesize

    3KB

    MD5

    a06dda04c2de78779a5377f89e2814f7

    SHA1

    4bd49737667173405b25ce2e1142654c4072d745

    SHA256

    64f38de36f60af819960f38947a084ea5183305a0025ea0e4fd5adc048a4f24e

    SHA512

    0b5a7af82cb38f49aae96dbfba2ddc2c7d41ba1aca5c40328ddaf0701f7b40eae8e31c2e2d5cec4dbf846b94b6d2fface3d473e1cfef18599fd9982d93092014

    Download Submit