Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    18-11-2024 22:01

General

  • Target

    9ad71eba89aea1fc2ade02b3098e19db3157d23aabd90915b8f2c493e0d03cfd.apk

  • Size

    2.4MB

  • MD5

    9fdb3b71255f21ed016da0b6c3519db6

  • SHA1

    3b74cc55bbda904bf25d0d302724d17f8ed56d3e

  • SHA256

    9ad71eba89aea1fc2ade02b3098e19db3157d23aabd90915b8f2c493e0d03cfd

  • SHA512

    e5221449a2594aa2be92ce7e61761749c77fdff553f1bb87b940e19f9381dbc12389d399871ac65d25f1ddf3dd7bf51d08dfa9ab678de386ff2f0d7a73b00ed9

  • SSDEEP

    49152:8/sm4EWH1hqGiMmi1rfbrXd7ptHubriPaIP7Y69dboKl5Hzkt4gSZW0+MzsT:ZbhViPi1LHdph4riPNL9dtTGGRwT

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

rc4.plain

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.fourusual97
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4211

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fourusual97/.qcom.fourusual97

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.fourusual97/cache/hayqtwcpnughm

    Filesize

    2.3MB

    MD5

    6af7bc18d535dd306107e3fe4455f0eb

    SHA1

    633bde3dcc49fe881b22c2dbf78012829064bc28

    SHA256

    88e6125493031df2d95fccdbb8fe9d01b924a12deb34f279d01bcf00ef56ce74

    SHA512

    758de66ab5c782ad4094263b2dab12fb949422cb75f49ca206eccc349bded5fc9ab313e14bd7c243c3fefc1e1ba416283c615e3ac4a85a3a5020b5b694f3fabf

  • /data/data/com.fourusual97/cache/oat/hayqtwcpnughm.cur.prof

    Filesize

    538B

    MD5

    9d22e7412f7481c6a7f69e8d8f3ba154

    SHA1

    f86dbeda3fdfd65299d1055e2a804644d3a0beb3

    SHA256

    05e422b75a612964adf617bdce102dc56d53971d4447150464536eb7777f6009

    SHA512

    4e0bfcc9f0057e985cb109b07cb818bdd1b877882587ba1135413ea52e06008669172e1dd732c4ae16d6aa8cb7df47419f910b32cafd799254f9981070b3bec7

  • /data/data/com.fourusual97/kl.txt

    Filesize

    237B

    MD5

    90afe9f0878bde1c2a730db76b0d79b4

    SHA1

    1e2e23899f13e621a1d731fb48d29da0dcf760b3

    SHA256

    995ec1826b7b86a912a156f28582c22700de3b6c68456e8ea738ca7642ee8664

    SHA512

    be8a67d7680311e4da646423b4a8ddf39371dbb15b448592307c050e4b559647792561286f41d81a71747a064cebf6e7f0c680e96ab5188c11392537a37cf4b5

  • /data/data/com.fourusual97/kl.txt

    Filesize

    54B

    MD5

    f3057af12f4f27af5e7910723e6a9b5b

    SHA1

    9f326280fdf0583d47cbd77ebad44e2d2bb4d03f

    SHA256

    719ee4fa1c28d7efb3bb58e109b5bcb45ab4d8f0f32f437b89d7981ab61fe659

    SHA512

    3a2ccacac1e3f6e30e6bc890e5fcf580a0bee6673e9e87cc4373fc485fa95e1fae70d1420f1387576d4382a98f23fe2f28e5b13c2fb05b86d831cb67d13c6512

  • /data/data/com.fourusual97/kl.txt

    Filesize

    68B

    MD5

    6989c3d157cded0b712e205578453abd

    SHA1

    967f834bd9e6bc01231d92c2d957fbfc34f4f4ec

    SHA256

    3e35052f2d849f3aaff3f4c0a6febb4b0d9fd6f1b0af181eec4aeda8314ea4c1

    SHA512

    cee3fed2d05042b72009af6d39ba46019085bf4820d6a77d3d5170f387f57c6ea82bedafd3064c4c8893fca3758d37aa7df2dbf63440c1255665919a9c14eae9

  • /data/data/com.fourusual97/kl.txt

    Filesize

    63B

    MD5

    5227ef8517995e0373bf0718e02e0a6f

    SHA1

    0c2b2b84f7397cd8c6faaae0947e5cced996dda1

    SHA256

    ca74729ffc81342ee3d83f297bd058213c4955bdd1a7582602dc0fa1ae5eae96

    SHA512

    3dcc60a98367e417d8a5d648c91e82bf112b51530118aa6b911e976bbe4d44adfb2f2136ec700bae309f4f2b048162afff3827d3e9c57acc518baf02fe4fc98b

  • /data/data/com.fourusual97/kl.txt

    Filesize

    437B

    MD5

    03b548630e4c2f52f4ac66c33923145e

    SHA1

    9413dbe2a9f505bfd930888fe0bd6682a3c67a71

    SHA256

    332d243277ffc9bc289de1e4aae3939eebe06dec046c287be6dad78fbb35b683

    SHA512

    c27a6a637acbe8ee3121b0af0eb6318bd9e2f53d3d532fa06b82b44b93eef8aee10f897530d81e0009567de0b5815de1396dd9d038f4868b4c5f324476c9c17d