Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    18-11-2024 22:02

General

  • Target

    44857f1c3fdf562216ecd8d4cd675cdbb82c8c161310db069053580cf5c016b0.apk

  • Size

    2.4MB

  • MD5

    d15556eafd9b40ff18c5ae358b507e2a

  • SHA1

    5077146a0b9c438bd087e2e5582eac69c647c7bf

  • SHA256

    44857f1c3fdf562216ecd8d4cd675cdbb82c8c161310db069053580cf5c016b0

  • SHA512

    8c75ae76e6a25a2da48d666d81c99cb1bb1fcd6c8684d67a6e8bad5ec8326d3db2e5a5b864dc10233c19bbf05f4e53d949228b2f2658c3d4c7d4fa85c40a90bd

  • SSDEEP

    49152:bqzgIYFXCNkC3mY+ah3TVQE6wxtfj29cd9xsIjCVg9yG:QYFSN53mY+U3T2FMFpsyRp

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

rc4.plain

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ableevenz
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4322

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ableevenz/.qcom.ableevenz

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.ableevenz/cache/oat/rcouzhd.cur.prof

    Filesize

    512B

    MD5

    ee86447e598df4dc6e2563a6b13c0938

    SHA1

    6d80dda511fa3d373dbbd044f33c28ebf3cd9e8a

    SHA256

    a46842f2253e4a6175b7729e59541a5acdfbb7b036c874c5d502bbf49f382376

    SHA512

    b3a9d8760503004c190df17f0a413756e5875892cc86a5fcc97ec755d68b44acdc734f2ca7003e2d8a19dcdcc4257f0f838e5aa440b2a500fa5c432dd366b2fb

  • /data/data/com.ableevenz/cache/rcouzhd

    Filesize

    2.3MB

    MD5

    f940ec9dbc713d1d8f6fc6b79252aafc

    SHA1

    69070aac9586aef1b9f400cbb6979d7b5c759070

    SHA256

    aaf68c9b4dacba6caf7388a95e2418483eab520ae95352065f7404cec52dc99d

    SHA512

    c2be29aef8b6bfe8bc3e5606b6a3deff30c3b3e3ae26a5b3061ecda5cd935fc0a0e964ded06090e0d26b1bd520190a40eaa2aa5311c5ef9cf150932783d02733

  • /data/data/com.ableevenz/kl.txt

    Filesize

    237B

    MD5

    497e19d7b98f638083cc5e09bd085033

    SHA1

    381f48fbd55a2a4e63edacb9b162aae3173b4d96

    SHA256

    14e53ac890eb46fd9e76471745fb6f031c9a40a576538b5dd89ec32219000792

    SHA512

    1bd65bb8863782c401e45ad2adacb0d3f6d3b00453ccff7d920ce51c44f0112bf3a27e9130c617230b75f91bf9c9d71fa592fe3d58f6e306902cef6ebd15a340

  • /data/data/com.ableevenz/kl.txt

    Filesize

    54B

    MD5

    b4ae50f20f32d616174b680e813ee5ec

    SHA1

    0380220c28757f12397909aa7aa8990e587f999e

    SHA256

    3c1da742ca2a5ba456c18eb052efbe6ebd2e6e6ba883c7ad3849bd4bf979082b

    SHA512

    13c62fa850593d180be9887d64b33096dc58635bf5b3eb6657770a8a662a48f5d687ee635befdb15838059ee83ed5b1df46b28004a61b405c88f89fd018cbf79

  • /data/data/com.ableevenz/kl.txt

    Filesize

    63B

    MD5

    685d1d0e06fce2671b9a4574f616cb57

    SHA1

    d364168fed036c37ab4fd52052ad4600e88bc813

    SHA256

    4b041f27468603cc2193a9d23a5b109b4ffba59a87c5360c12658c5768950b99

    SHA512

    72676a882e74b97ea2f050ce6683edb6fd688e999b3e2cdd0108acede50a3265c5b46bc915ab6e2be28fb7cccc9a119fe15621f28ecca1add84d55bfbf259f4a

  • /data/data/com.ableevenz/kl.txt

    Filesize

    45B

    MD5

    f0685880afabe274e9b723a3a28eeda1

    SHA1

    45d8766f8533a98be0baae5f7a15723f4cf73c7a

    SHA256

    3ed8839189b234d26db8179e3ff32be727e3ab554f53afd24758a50feae3f94a

    SHA512

    97e5ee77f1c5fae2c49faa716f06756bd004ab4a5c952cf2d3e2d8f9c4474afb5e5e21acc50bf8489bdefe65be3640dcc8ce25c5031e42598ee364f3865ab5f7

  • /data/data/com.ableevenz/kl.txt

    Filesize

    437B

    MD5

    bd11bb1046bf0f459c4674eab77d69fb

    SHA1

    f644709b6fc3662d42f51ebce6866cfa522e2a94

    SHA256

    9e3a2e155fa20c84e36769ab6cec0fde6864f2fbabbf6e20566c089920d26398

    SHA512

    fc93937e43aff66b5565f50b6bad7d1d84235fea3cbb9085b4be3e94cf7c1fb31037ea35a3797cf381eb9e5b242b7e8bf1636f77d8fa3a78daa5a187f70e84c3