Analysis

  • max time kernel
    140s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    14-11-2024 22:02

General

  • Target

    1b7be83cfe2313c0d303927a0b874b90f419f6963a59bc381a0d4e57726b7684.apk

  • Size

    2.4MB

  • MD5

    351592d2a3bfec9c510ba541df962217

  • SHA1

    71dd43b443351e678a4464ba89c15463567b3004

  • SHA256

    1b7be83cfe2313c0d303927a0b874b90f419f6963a59bc381a0d4e57726b7684

  • SHA512

    feaa1f6a90cf0209a3d6396c9f59a2d18032924283d4ee885af5fa6d9575f2c086c926e2c796137d1268fc4f02136f23894f63efba65ee58d0c36daad69187f5

  • SSDEEP

    49152:4wre8JMr/gD345NNmPnnJIsgWrhLsL/Qpa1GL7xZxM+1LvubpG8ut04FKN:5K8HGN0nJIsdFCwamrdLvV8u+4cN

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.needopeneog
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4221

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.needopeneog/.qcom.needopeneog

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.needopeneog/cache/oat/wborwfmwzttbbm.cur.prof

    Filesize

    531B

    MD5

    3b7ef370fd68697f696a50090a05f6df

    SHA1

    515395f9b6fb01b4f6334fd0141e87ee1519c2e1

    SHA256

    41c6783d7cda362066dcb83b10de53524e7faaab7791b6e107ffdcc09df268c1

    SHA512

    24c8c97ab8bfee27053fd8920e32ff23954b58218a196082b700c91725c6b9f9a0c700dfedb797b02c86fded6965919c4a13de35bcb2069432756f2cf7d07f25

  • /data/data/com.needopeneog/cache/wborwfmwzttbbm

    Filesize

    2.3MB

    MD5

    36e6ecacbd050119838b091ac6a9e8dd

    SHA1

    03ae79cd5cc44fa01f8dfa30a787594f39320f02

    SHA256

    200f820aa29486af99d15e65f4e6876a9d185249dbae9057a7c7cfad530b7035

    SHA512

    2d71180acc1627fdca896bfee8b6bc6e6bc1692394f06406a7d66aa76cee6b25803f60ea6ab336c57ae33088f15fc7c1c221839af600a33ef026f012a316c402

  • /data/data/com.needopeneog/kl.txt

    Filesize

    237B

    MD5

    0c57a62557afe67a9149ccde8b71f462

    SHA1

    6356ee447abf081bbfa885a28febc9c9bc32e8b0

    SHA256

    166aa6723affed850972511a8eb768eea17c6e09002823d1d1b7f3780105a0cb

    SHA512

    395c77bbe204ee1f8a77e6ab4dabdb3cf8dd512071fd2cc47eea21f4eec536de3b5886a865835fc4d68bf325732b2704fda85ee3c37e423bda58bc7259362bc7

  • /data/data/com.needopeneog/kl.txt

    Filesize

    54B

    MD5

    2e5afbb43ac80ecadb2d62398cd60ef9

    SHA1

    1e1f10a169434894e52a8c9228fc0084e4328571

    SHA256

    3b3d484469d9e35fe4d5ba22fa70ffc1ae43c02575d354e24da642bd4c0c11f6

    SHA512

    5d45b6064fa0f286783180d77abcd88fd2fa794ecab497059bc14c3ba65ba7d19f427f978a2d351ceab1d0b8db98a8ede1c38f85b426282ec38d3c794d52f1f5

  • /data/data/com.needopeneog/kl.txt

    Filesize

    68B

    MD5

    226da6002f54f540eabd19b04d0bb4aa

    SHA1

    18f9167d1da442aff645b2ac10338743a9842bcb

    SHA256

    a5f607a847380d2cab72016dbdd8b83cf5ff598c8ff57d86453d0b7bbd8b38f5

    SHA512

    55f36d05223acbe897b85b32aad1131254f5388a148d78078961c6e86871e08578bfd7f127ffe5c200c87f566c494412635f7ff63e89dfdd18d0010f91acf517

  • /data/data/com.needopeneog/kl.txt

    Filesize

    63B

    MD5

    9d4160b3d1ac61989b6a98a46c5ac110

    SHA1

    05237789d5570ce338d0e1888dbaf898bbdf9214

    SHA256

    46a5c80cb11d30784d84f3258057ee6a1601b6c4e414151b513b846b1e41c5e4

    SHA512

    91ecc0b8fd4492e4ec86f33988563ac3d2329383dc99996d19f896f8d8e228c31f5d29e38b716f32c9757321ef6edcdafbc0e058a0778bcb0c74fc2fe70fc10f

  • /data/data/com.needopeneog/kl.txt

    Filesize

    437B

    MD5

    33360e6a743d0c5b4926f6f8ed6a3f88

    SHA1

    363f7b50c156ee3efa25b8aeb9b4bb70c8957616

    SHA256

    74e31d2c158b37f4c1a295f6d2c154b1575dd822a2bd9d6c391785ac3485d40a

    SHA512

    dd457020ce75dbb9d6710cff40281de89c105315b428f6f5a589cb092fd16b8773048b16f8dfd6c187f179ca116d3ec923d918f2860adb641e183066ab8580a3