Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    18-11-2024 22:02

General

  • Target

    001c43293f68ebc6a914518f5ef2fce3ec8eccef274f42662a783f0b340a1509.apk

  • Size

    2.3MB

  • MD5

    03fe02d1c77afc416ea7b2cde11d0730

  • SHA1

    43e48ed5f674dcf241ba8b9456162b97f671f7fc

  • SHA256

    001c43293f68ebc6a914518f5ef2fce3ec8eccef274f42662a783f0b340a1509

  • SHA512

    ff6ad234ecd2f9399c647d23a67be8b325e2ba73eb6ee7e533593c6cb33039c7e5a5fcbe717d1a3e0f97ab1d6a5f1459b6f15894f0a837a44360d8a31f0734e5

  • SSDEEP

    49152:Vc1Jy5LpRQk7pb3HQFBUX+uwsN0H6jECVDPVpN94y+wy:vBpqkBwFBUX+lw0svhY

Malware Config

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://populeryabancianimaserver.xyz/MDQ2MTZjMDhlZDQy/

https://eglencelikahramanlaranimas.xyz/MDQ2MTZjMDhlZDQy/

https://cizgifilmtutkunlarianim.xyz/MDQ2MTZjMDhlZDQy/

https://renklidunyavekarakterler.xyz/MDQ2MTZjMDhlZDQy/

https://animasyonvekulturhikayeleri.xyz/MDQ2MTZjMDhlZDQy/

https://yabancisanatcizgiustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cocukvesinemaoyuncular.xyz/MDQ2MTZjMDhlZDQy/

https://cizgidunyasindakiyabanci.xyz/MDQ2MTZjMDhlZDQy/

https://animasyontavsiyeveyorumlar.xyz/MDQ2MTZjMDhlZDQy/

https://sevimlicanlilarhikarakat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancianimasinemaustalari.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatyaraticilik.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverkaliteleri.xyz/MDQ2MTZjMDhlZDQy/

https://kulturelanimasyonvesanat.xyz/MDQ2MTZjMDhlZDQy/

https://yabancicizgianimasanatyolu.xyz/MDQ2MTZjMDhlZDQy/

https://eglencevesanatcizgihikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yabanciveklasikanimasyon.xyz/MDQ2MTZjMDhlZDQy/

https://populeranimaserverdunyasi.xyz/MDQ2MTZjMDhlZDQy/

https://cizgianimasanatkonusmasi.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.satoshi.foam
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4584

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.satoshi.foam/.qcom.satoshi.foam

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.satoshi.foam/app_mass/knU.json

    Filesize

    153KB

    MD5

    53b72875d8f78e93bb46fb9f7779ed4b

    SHA1

    8b31704dba39af8f941a4c6c7dfceabd946ba45f

    SHA256

    c9db43266d862fafbb48d41f141e73195428c065c482c77f5fbdec6ceebdda81

    SHA512

    8caf154f5e99d556a64823c9d60692a65b75a24fd375a739d7fec9c859cb9c1747debe35a82ce95810c49b25be5dfe96c94ab4f413a4cda1598a01b942060b13

  • /data/data/com.satoshi.foam/app_mass/knU.json

    Filesize

    153KB

    MD5

    cc113036f66a1718c439c37129e1a5ea

    SHA1

    df0e0f78fc533ea35e42c9ec3ce892a08f8ce158

    SHA256

    3dccb2261a6d723574234c3e9c8108b489759bec88495df4d6dac7ea1cfa0ddd

    SHA512

    364e81b4530822c7bb59499957afd807e0ced93e4f1e20847b393ad4456ac36d8cb106171b5fb9d2496b7d8743dcf33765013aef28b442a62749d32758a4bda7

  • /data/data/com.satoshi.foam/kl.txt

    Filesize

    230B

    MD5

    1961f2185cb588d9c43b8d2040da7baa

    SHA1

    5c3def6f2c06c742d21546f90be5fd667da431da

    SHA256

    5dd0291b4e53df9499989464f664012248448a16e0bb84012a06a912d1257d1a

    SHA512

    b5acf700e56c1d58de7a6e2feb404ff3437204ba52d52ccaad7a1a614a6fd1c016095405e07e154d101dab36fcedc4c06225ecd3e8d4eb7b4f8d69410e1814e5

  • /data/data/com.satoshi.foam/kl.txt

    Filesize

    54B

    MD5

    a37583c87b280d34b4a5be2af0f6a0e5

    SHA1

    cee97dea8509ab98d50f3903b82e350b257d710b

    SHA256

    64805b8f41805030c241073881157f7dc81426d5bb49336606f19e21640fb3db

    SHA512

    95793cdf832a4f657491b57c79ead5dffd538292b7eeed57ed84fd93330b58fb474b3c8922b02cb8a72079663e10aa8d824587820c00fefc64e401543b80a0fc

  • /data/data/com.satoshi.foam/kl.txt

    Filesize

    63B

    MD5

    56558f54c9a09c4ae35772c8aae8bdc0

    SHA1

    b628faa15bf9c70d901e21916f22f9b1c2acba6f

    SHA256

    6ad6bccd4f1593cbf95968d1b74a79add06d103f845d251711f7106ed2c506a0

    SHA512

    040e2b922ba0e6dd4bb9c4e9db713a11f170bf0f1098df6bac45d646b8adb9e17f6127713693b9fa1a42b3600322971f1850f4b59df9275c5f252d14ba828003

  • /data/data/com.satoshi.foam/kl.txt

    Filesize

    45B

    MD5

    40dec4aa5b822fb50ff654e7f9685bc5

    SHA1

    4297fcdbe10d78e622a8a1d736fa2e69cc9ffb81

    SHA256

    6b2b144f4bb9459d7b51971bf8014c94590c6e71eecd933cb78ec47dd0864bab

    SHA512

    d61d8f394651be7dced5879c20f6582fee64bad1995f63cac88a867fdea74217becd9fefe20976735828b735b8b8b376a579f1586df6330a73e2fc63a28d28d4

  • /data/data/com.satoshi.foam/kl.txt

    Filesize

    466B

    MD5

    93be570cb5d0bf05d381726019f96821

    SHA1

    b5e81917c3c53c2b27fa2f89e9e95601d20e6c09

    SHA256

    427824ba9029403b640411b112ece7328690afa4b5082c285e3ab3f00021e6b6

    SHA512

    35ba3e2854d66d832a1699d5d402d1e62c34b23b09afe5f475b9683ed7d9b3be1586008c26869d9c9ce5d6587f7ecd6a8006a8bc6783936a93b0b7d13c7a3ab3

  • /data/user/0/com.satoshi.foam/app_mass/knU.json

    Filesize

    451KB

    MD5

    87abaa3b780e74a0a40f3b89ca1e3fa7

    SHA1

    36c2b2a365847284845d3c2740da64f9bc8879f3

    SHA256

    6b29057033fea1f90cb1124b97bbcb1614d45985b27239251855787cc89120a2

    SHA512

    e0e3dd027bae4893f32220ee69c14d209b335e5fb537820678aa450112b3e7d52ee776f799a854dd6a7f58e9ac5cd2bd0fcc23b0824510095f4984a01f98d6a7