Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    19-11-2024 22:04

General

  • Target

    45abbb4cb83b51f908bb853ecd2377a4a9c3598b2f20bfdfc93a955cc8ad80fa.apk

  • Size

    2.4MB

  • MD5

    e24159c21749fb072ac95b95b801ee98

  • SHA1

    e5b7f7a5bf069640c8514998ef9052dfaa32cce8

  • SHA256

    45abbb4cb83b51f908bb853ecd2377a4a9c3598b2f20bfdfc93a955cc8ad80fa

  • SHA512

    c20ad5135dbf3bc52b147d44eb8111180938a2670ab931ce87a38e14f4353a9de4d5183f793c5a0193e0fd8142644531f6b05aab84cb920835b53735b8244575

  • SSDEEP

    49152:i4pNHf+q/lsFsPtuY6F4fBgh/5yTXzqPpjDfdofX9yFzTCpEJlOyiSv:XFp+6tQ4fWgTC7dofXsVTCFyVv

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

rc4.plain

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wordhappen5
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4737

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wordhappen5/.qcom.wordhappen5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.wordhappen5/cache/oat/tbuwtpvtixa.cur.prof

    Filesize

    367B

    MD5

    5ebc401207b7200e5fff391164c5fe83

    SHA1

    1bc7b2dfcee225530a7d14b536ec9cd9925a2430

    SHA256

    38a97e89dfe3830d85f41de23fcf515b9cf7071a39b359fb392ef06b5a9dc88d

    SHA512

    700c788ddd5ef7639f2771bf2acf35b4a5b77b5dd74b89db066ace6693b0464d7224fbc71a67630f25a8dd99fef332244c444a85e85d1a2f70e3ace4fd9e6a13

  • /data/data/com.wordhappen5/cache/tbuwtpvtixa

    Filesize

    2.3MB

    MD5

    ca04e8bdc0c35835fac9e8b1a882446e

    SHA1

    9c9bb95296cac41c0558d617d8c40ce7a64132f9

    SHA256

    5c1c54a15ea2718da3f0d7c2812514c864356212c696c2cb61b926feb26da7c8

    SHA512

    b46dbc251b55088d6e90ce6f8115571bdbe902724473eb5dad84f2a02020e40175e209647c4b8930e4f6e890128168f7dc5c6057d66caa91a6828f501da9fca7

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    237B

    MD5

    0c07474c74c2e8a123081c0d3368f040

    SHA1

    9e3d01944649d3ecb9ad7fa88aa09f4c1f88b8e1

    SHA256

    d0f89e724058abca756060251cf651d53535adab340f76eff19862dd3851ba28

    SHA512

    563c51c474632d8647bdaa142605945ec41157a0b557191beab76b123cfbefbebd718fce9e041aca34c4bf2fed4fd14440f90b819ebee9cd9d162c168650967d

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    54B

    MD5

    721b4dd0831443956538edb0abdde6a0

    SHA1

    5413898c7084b759c5945491a3dcae1c2bdcced7

    SHA256

    3afb2a769c484f6b090c2ace4d8611184dd7a16b8ca54bc7d54b2f6170028ffe

    SHA512

    6241b6dba90598e42a8c3b6134be24986d9ada77acfb34e253a709ea40710f0d69e8f4f841d437ddbd993cbd00ad09cd7f664b5e913f70fdcede9ead30716b1b

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    63B

    MD5

    2f91eb90ab8eaace1e2b87099780a99d

    SHA1

    757dafb06abe1805f7f41f74f1e713088b6b811d

    SHA256

    d685288a37e1159166dc65ded0f0c18c992ff99940cd78af4fab412e5787436a

    SHA512

    9b2b74561fe0a1935d9e339246121cf28b4c9163978f99db5f29de9b9a02af78c86a2bb2c88ed72b44c009cfda24ebc6e6d8a0e1ff5ad2b5c4eb41df8080c722

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    45B

    MD5

    12e21e63d0149483a27031b425c40e45

    SHA1

    ccc09c4325207e961ea4b3f66e774ddf34df5592

    SHA256

    840749291cfa7c22f8002ce03bc9ab56056479f4797e936659ea31132ebba627

    SHA512

    19d4731c95866f82db6d530cf2e87cb35b2cac342b75e12484afb7dc61c591c7fa2fcb31eb9be50fe8a789e938e88ab18f2953406c080bb2faa9620350d8599e

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    480B

    MD5

    23bde4708d33bd405fe0e38657a427ac

    SHA1

    7237a74c5af88efe7e70a8bd478e0ce0890fc3ea

    SHA256

    e9560274f01678872d6e5e3fa931e1a305940d9fd1d2a7322835c73f52ea936c

    SHA512

    d169e11e669d30e74024c0cc34902746b55457658abb4a66c05f86bfbaa6de89f337c903aadfe548f3d2ca421927fd3871e9b96a8f60d739a202c926cfc44340