Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    16-11-2024 22:03

General

  • Target

    321cc12592b7b93dc1660d5d8627518baa7f8cc6dd21f1d811afa44a5bf79aaf.apk

  • Size

    2.4MB

  • MD5

    1046e6403dd00ac2d6169643fa806515

  • SHA1

    1666c68a9a555cce59b5613fc49083dc7922f477

  • SHA256

    321cc12592b7b93dc1660d5d8627518baa7f8cc6dd21f1d811afa44a5bf79aaf

  • SHA512

    2cd4310122fa047957b715d132d588390b80c5db218016f3691230c00e0b80a9ceb42ce6799433986ea91322c7600db077bccc5def6c629fe26d8176b56e7413

  • SSDEEP

    49152:VuEZAcbKCKvHQ19KTx9LHsp9CX5xM6FWXrcroGADWpxp6mg1v3xmMZy:1V5oHQ19OjsnU5xyrTGcWV6PB3xhM

Malware Config

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

rc4.plain

Extracted

Family

octo

C2

https://malkafaniskm.com/NzY2NDZkZmViYjZj/

https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/

https://malkafali222.com/NzY2NDZkZmViYjZj/

https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/

https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.howslow5
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4352

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.howslow5/.qcom.howslow5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.howslow5/cache/ddaty

    Filesize

    2.3MB

    MD5

    cefbdfb461d60a83ed14f58345971369

    SHA1

    2aac02e097504b49d1da969a06baf32ff2aaf908

    SHA256

    99d9694391957dac3bd0cb5de74f6c8c1f029abb74af55187d4dc36717be5b1b

    SHA512

    d3c6fcf2c4cc129c279cab8948c28ee9c31f75153c730488740b4f8ccdc5ae7e8ab007409d842237069221a1ddb3f81f573ddbcb1383c375704b210033e322bc

  • /data/data/com.howslow5/cache/oat/ddaty.cur.prof

    Filesize

    427B

    MD5

    b770b14db2ff3ec05d5fd7d7e5c8ac3a

    SHA1

    1fbb9d5e317024e11bbd3c7d9f99c0db65d3b8ef

    SHA256

    6bae9f416e31fb3b52ae5887e7708a1eb992f88b46b028ff41988f4d3fb2fded

    SHA512

    ea1e3f940c34f9a3ff9cc74d7a02ba3221603720227ca9286820accaeb6532f0c6c2a941d58b8e5bbfe50e0e6967b96f8e9c68264baa898464fcba81b32b053e

  • /data/data/com.howslow5/kl.txt

    Filesize

    221B

    MD5

    9920288a75ddd9f2e8cd92298e577aea

    SHA1

    ffc39c6ae1fc4396322190de296a144a60a48932

    SHA256

    9cdc81ba209e29bd5426f5caced8e1cd889021da801c37c5d1a98305613c0961

    SHA512

    6302c2c72017c951fdda8066b7ed0ad41985747e99a0ff2ed21ba1adbd5f82c254a9ea2e8c1b17aeb85530efe7bd75491ed1af41d362dec2673873ac03ee8d94

  • /data/data/com.howslow5/kl.txt

    Filesize

    52B

    MD5

    8bd4b60b74c8e48379fc6d3ea060aaa2

    SHA1

    f9943bc2ebb14f81235cba04d3576646395e9287

    SHA256

    bab9f565c8206344c4795a057c00223c67bc0b01bce9f4d64f16a7c245da70de

    SHA512

    2458a194e79badb8ed6c1a258f5e321bcb591e79dae7919ba2b8a67c2df6d5b4e2788c7b9ea2326d60d967188f1edbcd4951e6243e58a6ecb95532070cf8721c

  • /data/data/com.howslow5/kl.txt

    Filesize

    70B

    MD5

    4b2983108d83065dc4af30bd61d6baf9

    SHA1

    2212b142fa7181ef67b8cdc1b647f9c7ae7746ad

    SHA256

    b1ba057f2d1e21a74986dcdb2580b37f95d0eaccea5d58e2cb6523306cb5a921

    SHA512

    75ada7ce60a4c721dae97235a4a87c07a392a66c2d72d78049a2ff14e4de0b52159946a5e1c9900e2103b25b13b1a85c6272cd330ada7c21334bc6ea57eb4205

  • /data/data/com.howslow5/kl.txt

    Filesize

    62B

    MD5

    d408eb3d5f070966218d3f91b8abdb7b

    SHA1

    2d0a12014914ebda6dee7a23c67b20e79fbd2338

    SHA256

    f42746a145a2ea2f468399cc4ecd9bdb28a425eb02154e936fe9b5fa63353fc2

    SHA512

    973a7b8e4ae14e0c858edf9e08e3520c79cd8bfeea23829f6a9eb093b448589c66c46b50b843d0fda70532c4565a89944ad45f209c7d131949b73d822422e990

  • /data/data/com.howslow5/kl.txt

    Filesize

    504B

    MD5

    93ffa3399b9a665f5bf10125849f3af4

    SHA1

    57f0bed2ce5dfef680b88229bbc13272f42fbac4

    SHA256

    d96ed5aeccee87859c7cff950026a5a57e056dd4ade58405fc4dcaeb1e0df62d

    SHA512

    b74f51ff6f3f74d8ad5018c34d78c3a374f2e75b8f10b6cf810407f43fe3d9fb1d4ea76a3b378325e3ea2743cf09f4d043b53b011c496745195758a89941cca5