Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    18-11-2024 22:04

General

  • Target

    d34fd1c7b52a17eb7404e97cdbd98ac6509397ab145e77b3c5061997e87fad8d.apk

  • Size

    1.2MB

  • MD5

    8c878984eab9438dc921f511fb2c7015

  • SHA1

    c9140dc737856659e1c3dfeb6c1b0078a3847545

  • SHA256

    d34fd1c7b52a17eb7404e97cdbd98ac6509397ab145e77b3c5061997e87fad8d

  • SHA512

    ffef74608ef4d758928570609eb31b511316021616012e388fea082426e681ef1e42f3d6e120e9843671bb9593ef6b763616da74ad4d1245b01f08c3d9aef4e1

  • SSDEEP

    24576:czhTsImdvEStzB80f0zeWKRO29M7j/y5UEQGiGn/Fx6hGzy1LFrd:czBsIAvEStzBbfqexRtuu5S/UwGSFrd

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.assurface3
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4501

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.assurface3/.qcom.assurface3

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.assurface3/cache/oat/rbqvt.cur.prof

    Filesize

    1KB

    MD5

    ad1cf28517bd94c057dd4e67b3953f46

    SHA1

    f614e68f83f1a71592a338348c9a002b203b2c83

    SHA256

    0ac1848deca821bcbac424bde289b1abb27e36e1d3bf52574b52c1190ecaa885

    SHA512

    4a55ccace7890c35a8956b42ef290b617661260de8e1ea73e586f8ecaa972b1bc7fed55fe5f4e1926e3c2e3422793ac34efc71f999cb6125935ac200678b1a70

  • /data/data/com.assurface3/cache/rbqvt

    Filesize

    1.1MB

    MD5

    61999ff52ba0bf93b8d6a80cbbcd8826

    SHA1

    4a7a97077f1bacfb97b24051cbd3e0f6feb3dd1f

    SHA256

    1c5bfaf07acbe645ec7e7dba953293631575332ce62dc192b7a0721f6a649132

    SHA512

    77229f58ce9aaa1da2aebca20193a961c8608085484f794a857107ef66f678c1c91ff0374ba6023ea680d2e4425799ccc5856f683b702aae1aee605cfef5c797

  • /data/data/com.assurface3/kl.txt

    Filesize

    235B

    MD5

    76e75c1eb92ecbf3a7409639801fd44d

    SHA1

    df4cfab211c998502aa32ce6e61f4d9e97c8ec5f

    SHA256

    9e9bef226d65f19d0a333fc60fa07d0601f85e894e860c578768b84ca6b4bbe9

    SHA512

    2d84b9b1f537053713cda78ddcce9f83a63e79554d0ed39a59a4b226cffbbafbd448bc353f166b2104ba0b13a8701d46ee84c332a6453f350064963f9cb2c50d

  • /data/data/com.assurface3/kl.txt

    Filesize

    45B

    MD5

    4f47e51b98e36311fa8f7cc4003ca4f9

    SHA1

    3bd23b259591c06e3fccd4ea443297f9d69717e7

    SHA256

    77e7258491c2149a3f2a21ee134504418e42d177b452860c6228fed79b2d866a

    SHA512

    bb7500a63cfc12f387e1f7d2fbfcdcfc0b1d6c9d61cf262f1c445812dd64d332a6d7d6da21cf9e1eeea9cbe3714e785e05ed3d324f7589d9dd5282e541b62a5d

  • /data/data/com.assurface3/kl.txt

    Filesize

    63B

    MD5

    918d29b654cf7e9b8293cc6c33eed1dd

    SHA1

    87f856ea5e0b2c8105f2d3cf01b0eda0aee51de0

    SHA256

    e0a2124bc00865924792e1f596bf1c21f65ed4d487d5cbb9f206f6985bd013b1

    SHA512

    c5a86eff3069eeeb49f834a90b05442ba6fe079c4830d2330b215b1d199b59fca9f240bb70014e8214bfc21c47a7d78c9ed677e1a1c23a6f3def3b53bbd5b29b

  • /data/data/com.assurface3/kl.txt

    Filesize

    45B

    MD5

    16725fa4f17032151b255db06d15c63d

    SHA1

    1d1ac84ae5cb01d70783471801ebbaa06403dea8

    SHA256

    90bf0739d3fe18c07d5f4feeaf2c962d1c9f12b557f2122e4ed21fe5fbb43db4

    SHA512

    ecf43cc83139e28816519a74be2195c5297753fc06f7498f40bb04e2d4b670c341c39cb91bb8aaa8b5a643d6946547ebf98384070a42b9ae73c0be767e72b568

  • /data/data/com.assurface3/kl.txt

    Filesize

    476B

    MD5

    37e0af6eea4e391e16b6f080e0bf395c

    SHA1

    4cc92dfae7d83c962c6cb76ea8dcac288807d324

    SHA256

    3622e295ff2769b4b7623b73a9ab417235600c8a011f63ad13d1083eb6fdd34c

    SHA512

    fc0ace907bb6e4b2a12589bf808fb8f0432f074e33fb71c3593015c938f020b9d41e75dfd0067c87fb3ff167409f75301d89852253395fd568384879a178caa6