Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    18-11-2024 22:02

General

  • Target

    44857f1c3fdf562216ecd8d4cd675cdbb82c8c161310db069053580cf5c016b0.apk

  • Size

    2.4MB

  • MD5

    d15556eafd9b40ff18c5ae358b507e2a

  • SHA1

    5077146a0b9c438bd087e2e5582eac69c647c7bf

  • SHA256

    44857f1c3fdf562216ecd8d4cd675cdbb82c8c161310db069053580cf5c016b0

  • SHA512

    8c75ae76e6a25a2da48d666d81c99cb1bb1fcd6c8684d67a6e8bad5ec8326d3db2e5a5b864dc10233c19bbf05f4e53d949228b2f2658c3d4c7d4fa85c40a90bd

  • SSDEEP

    49152:bqzgIYFXCNkC3mY+ah3TVQE6wxtfj29cd9xsIjCVg9yG:QYFSN53mY+U3T2FMFpsyRp

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

rc4.plain

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ableevenz
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5256

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ableevenz/.qcom.ableevenz

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.ableevenz/cache/oat/rcouzhd.cur.prof

    Filesize

    467B

    MD5

    fb72c37f591af10ece175ede558e956f

    SHA1

    9681a332c46547087de7df2d170e2716a50dead1

    SHA256

    f423fb34659f60d6da3ce7ff17d2ee1594febb8d035f6f288ee547739ed35d31

    SHA512

    59485a61de9a1a4b637dac999fdf329f76a647a2bd4171e4816f1ed0e809d378811d67636a7065f5f0ec577c04316b9b32ccc885600999cf659da6143b5a0993

  • /data/data/com.ableevenz/cache/rcouzhd

    Filesize

    2.3MB

    MD5

    f940ec9dbc713d1d8f6fc6b79252aafc

    SHA1

    69070aac9586aef1b9f400cbb6979d7b5c759070

    SHA256

    aaf68c9b4dacba6caf7388a95e2418483eab520ae95352065f7404cec52dc99d

    SHA512

    c2be29aef8b6bfe8bc3e5606b6a3deff30c3b3e3ae26a5b3061ecda5cd935fc0a0e964ded06090e0d26b1bd520190a40eaa2aa5311c5ef9cf150932783d02733

  • /data/data/com.ableevenz/kl.txt

    Filesize

    237B

    MD5

    cc2cf916dca22adfa011a95adb43462e

    SHA1

    29f19f04145200648903f7ce56dac759bbe47a78

    SHA256

    42d4c3fd82f97ffa7200d7945c624e79a955d79bce12a6500eb2e00884051d27

    SHA512

    a9073d10e49fa7a105542c7b806cc6c56a5c7bd452b4610901c01d083da35911342d7c62df5e5720efb8387ba14003df20a0622d85a39fb9d8a6f9d1047b6788

  • /data/data/com.ableevenz/kl.txt

    Filesize

    54B

    MD5

    d11ddd15c6010b61d2847635ed53cd75

    SHA1

    686f4ec51dd832c4124c0ffbfc85352163805fd6

    SHA256

    4d258a904b71ac534cb5632cd1cd557d5d5538922a22d10682155566110237a9

    SHA512

    4b2065809fba0030f486cf96595f2799b3a4dbd102beb96927e1b3251b4ef381048d5ecd74e024e0bc5203b2fb3825ffbc4ab5e888ef2fbd05b1a9d20268d519

  • /data/data/com.ableevenz/kl.txt

    Filesize

    63B

    MD5

    5df49842cd307f06ef8229f527bea968

    SHA1

    1bfc4b3838ea5329c6c186f132580de1067fffa3

    SHA256

    fbcb4f83c23e32fcab03f944f017052f73cb520f598ec234fb0115368904f81c

    SHA512

    02b45662adb4ca3756f6041a225282aae50c8e5b2cb644d9b7e693ea74a6ee12b22c3e34da277f36c5286f33a05b1a5ff8c67ccbf02f2d3c56c94349c5567943

  • /data/data/com.ableevenz/kl.txt

    Filesize

    45B

    MD5

    cc7267a4ccede7fdac6bd7e9426d36bf

    SHA1

    d30d8aff846f0f83f127f129d43800109cb215ce

    SHA256

    e44c29090226a742511cff7bdb084037a1b3ae6c407f08b67445b3277d6b3699

    SHA512

    3253696bcdcb47de0834014d6500e18e120c8efa84cdb260e4966f03a07a21cbdf2d39dd9c0b2adc763bffffd859778eed9b2441ef2755899b060caefd7688e0

  • /data/data/com.ableevenz/kl.txt

    Filesize

    437B

    MD5

    a65a8601904feb181c5d026139528580

    SHA1

    242299ed19a13cab8a81542e396c79d66577e865

    SHA256

    0e5a30055007ee27e8ef55f78634c98e9a828083f659ab6b63980790d8736ae8

    SHA512

    09ccb963cf145e1c521a97ca255156e9bf4836d22a02c2bc1980b70a37df9c98dc99faff75d2f5785117404f5d86d5ac496b87d9e865657136e247d64dee6570