Analysis

  • max time kernel
    145s
  • max time network
    139s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    15-11-2024 22:01

General

  • Target

    814d02f923bb740f064d3b92cdacbbf5cb0fd9cbfc9dbf78b5da6a8055186895.apk

  • Size

    2.4MB

  • MD5

    c60f9e300f2338fc664befcc582fd9d3

  • SHA1

    f79ffbf6e3eab458e6b119493a27a647f8cef1a2

  • SHA256

    814d02f923bb740f064d3b92cdacbbf5cb0fd9cbfc9dbf78b5da6a8055186895

  • SHA512

    d41bb2099da440751854cd6291a2f316f9999c2de93896a71ef164a18a39fbf143e898662449d4fc191d247874accaddf5911b7e3edba486a3f872d55e063954

  • SSDEEP

    49152:Yf1jewg5hRMODb6Lg1miL9kSqkIMRlz3ociPc4ZHY+qB48JrULJle5:Ujs8QOLgwiL9kSJIMnR/4ZHY+qBLULJS

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.hourstand1
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5065

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hourstand1/.qcom.hourstand1

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.hourstand1/cache/lqhlgcljfqgumcl

    Filesize

    2.3MB

    MD5

    f7870775553cae144ddec77a05f97e43

    SHA1

    c4989d426c5c05ff69073fe942790e7dae4223f1

    SHA256

    b49b1629a50a11de223f237fb8a45546b6cdc5fcd1ff8831d25a9ed8d8e2cef5

    SHA512

    216abee941ecb72024764bbade1e17b4d69e543ee32e318a4d5aa3caa5c5985366179bea7dd353f77dd512f7a158889b462bd571f751705b6bab73ee0c529eec

  • /data/data/com.hourstand1/cache/oat/lqhlgcljfqgumcl.cur.prof

    Filesize

    488B

    MD5

    f0dd96387a02a6648fdd4566cbb83812

    SHA1

    d2dabce55c12af8bfcfb98ea2a9599f8357c3eaa

    SHA256

    18215300103dcdb63055a120db4f84d8eb5eb3e2e8e07a9839676d5ab96b8c6c

    SHA512

    fc39f972202bed815b7211e0e33319025c1200ef4b21fca7129436ab3c41c52963f9c0ef77012edd62df09a05fb718d0936476cd8f6b2197301fea4533c60397

  • /data/data/com.hourstand1/kl.txt

    Filesize

    237B

    MD5

    4e190fba28e6034c1bd32034baf3d511

    SHA1

    4d4015a62368a6181993369321644125bce8338d

    SHA256

    41e21fa6d9ef55e1477a9340700da2037ae9850ac9f91afe92d7fed891bdabfe

    SHA512

    bab6d73f1a667131fca4698ee2490f46303f38489fe477495504aa20b085fd17e84127c456344be71d1a4c81c85071a6a8e408d525119db5e9735cc9bae347f2

  • /data/data/com.hourstand1/kl.txt

    Filesize

    45B

    MD5

    aeaf2ed67cd94d597504488cb8b0bf89

    SHA1

    018026e240edce0d5701b316027bb9113f9762c5

    SHA256

    95d3f72e6bee86295bc85819adf6cf569bb76c12b850848754b2039efe5ccb89

    SHA512

    ce0224937eca9503054560ba7e781ca547eeecd1785fccc8fc0b7383ec5345cf773bab5227237dd145f1681e398fab7202bde2638f3ff5606a0e11c2472198a3

  • /data/data/com.hourstand1/kl.txt

    Filesize

    63B

    MD5

    a4d943d95bb9a10c13cb8cf353223f08

    SHA1

    c6bdd2dc68521f5ca0a521619e0352b266b79a4f

    SHA256

    a2b29de375a4a6feb07d7867e2a3e887c95039e8e25b0ec47159c9da24b3515f

    SHA512

    85039a32f8da60923be93dd9da1ef1cdf8c08b293d4f1aa2018443194a6078272e037963da1bd3bc5e4fb6b73a67b0263c1883fa17af114196417a5cfca1dea4

  • /data/data/com.hourstand1/kl.txt

    Filesize

    45B

    MD5

    641f601d57330199016e7b4f8e1d2e38

    SHA1

    bd3f749901adc9fcaf1a212873bfdec2c61a1625

    SHA256

    5b28880e5546840d4bc8a9b8013ff5ccae956743b15859bccb1859e6f94097a3

    SHA512

    f52ce5e48f55580179474e83eb911ee5979936f509c1e37561896fe667bdc0f012b827d7332d59f6200515a6a267009cb6f08eb4f33852a8d3cdac41f73c00f0

  • /data/data/com.hourstand1/kl.txt

    Filesize

    437B

    MD5

    a7584ffb7e2b69279a1a66eb9d595631

    SHA1

    b810729eb9bab56dbef9169e72ce448343910643

    SHA256

    6ccc923459bb0ee96b34896701802a8779b80a67bcf5878f4e6460cbf2c368f0

    SHA512

    465f7d5ab38cefec3b097ea29ec39da248a551fc8f9c5fe32b2ee3db5f8b1ebb52d0d12b270613db1b3ea23e26622434f5fe534df3dd379023b3b1911b7248d8