Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    20-11-2024 22:02

General

  • Target

    0d5528a031e45c82c12fe934c67cce5a552c412ecc4038f33184d5f7512556d1.apk

  • Size

    2.2MB

  • MD5

    555fa87429a6e2559747f82856527cb2

  • SHA1

    f059354625e29ce44f41a399d6ea10525157fe27

  • SHA256

    0d5528a031e45c82c12fe934c67cce5a552c412ecc4038f33184d5f7512556d1

  • SHA512

    0dc49e1605d561f58287eac0f7affc7548fd786b7c576dc506582e4179ca8bbc7a2a998f856076f1ce965fa1dba551d8f509d11f015222c14b84d91a9ad031b9

  • SSDEEP

    49152:E9sLJEU/ghJoNNS9jyDFqDTdCBb4Cxliup1pMlg8RKR3:HGlh2N0bkliuHpCU3

Malware Config

Extracted

Family

octo

C2

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d92146d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d92156d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://994b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://4394b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sitpeople51
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4277

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sitpeople51/.qcom.sitpeople51

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sitpeople51/cache/gsatvprzwmg

    Filesize

    2.0MB

    MD5

    d6442388113c9dda2bdf6df7f5ce2a0f

    SHA1

    7a5060a48d016cfb943369f66ad9d8dcdd558cc7

    SHA256

    b091e26234b9bc40a648f857314548e785941be4440abcffc1994691c0a7ecb8

    SHA512

    b3660074473aa6e2778083d19f823df3f7623ef5919173014c342b7ac201b5bb61e455586757377edeca83c51cf2cd71c2defd338a002046455d53bb95be6137

  • /data/data/com.sitpeople51/cache/oat/gsatvprzwmg.cur.prof

    Filesize

    1KB

    MD5

    ec302836984390a720f4b4490a5f9ffc

    SHA1

    ec77d73ffd84861deb86de68c127a4454e121555

    SHA256

    43c75d240523a298a043e7085892e78db15e500cd25ac4f9d7124dcfa50701ae

    SHA512

    008d17ab310981da81e9091e7d66423112a829b9e56e073cce5d9988aa291dc94d6b35a73eaf0260ec5da8fd6079fb46aed8b0a69bbe729ad522af47fd725a48

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    237B

    MD5

    7e442a96bbffc1ce7cd1d2f363b278b7

    SHA1

    130b8b430c16cd44fa0dccf317e1fc332e4d0032

    SHA256

    0e3b31cdf4ccb942b8dd21e20b96eb77287d6650d33403e21fc7b33a46a8c59f

    SHA512

    cbccfae8c5d2ab8b53adbaa51c33383667d4902d0552c9470041f2df6a79b657b4ebb5d52f9f1627c2b3b95cf1ccf0629faa89c996a3a5a494637d548a401293

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    54B

    MD5

    adc0db1ba83f9db691d365b3889eec7c

    SHA1

    fe774c5e28b63fcd73d0dd5233cf944fe835a788

    SHA256

    8d88bafe08d6bb9374668bb8752fb625fe6fc7c0cf6a29e8d7199bdd8e92b309

    SHA512

    1dc07872106a00a172cc94b2fab2d0bad605823be9310e61a6fe08b33ab83b865112db4ac69250002b7ae013140abe20da8c52f892c33b8b05c4b9152fd10565

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    63B

    MD5

    04ce517023c133e08263ed01215b5a2f

    SHA1

    33d12b7b1278071f08abb3686d9b11664a80b5bd

    SHA256

    fb8c437064f5b6e9a4c85524177d277770d3ea0654df523abf7ad06d0a71d1cb

    SHA512

    eda0251adaa033f762cedf5ec6553f7ccd41501558367db2d6c2cfa162368e22af1bb7c13553ec543f6a4029de3f8fe005da7dbefdbd7b2de053ca8667fdc00d

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    45B

    MD5

    5df43b4a39bb05166841c508c2d8ec53

    SHA1

    4450ef293e3a26fd2fdf94097b2e90fa5c5a04a1

    SHA256

    9fd7d9f7775db0047263ee2c43238cec8604b1c6f61f769d02d630ff954723c5

    SHA512

    9bbee4f5f56e88c0811c7f93f49ac7cd3f57c012684fd4a0c45a607003b5509aacb6320cb0e8cb4697fda1705792f99c894c0e7bff1d1c38aa4cabaf8ea7e025

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    437B

    MD5

    4e994d00a241f1e2763e4c762020585b

    SHA1

    3d3017b1e491176d3c2a0130623cb9ee55f4a277

    SHA256

    febc6409bc4a93e782f1fe613c683d3e5f84143b335acb3ab6c2dd48ffa2f413

    SHA512

    9a37f648a792bba71c24a6ee5c5bf56a0ce25e9e89e3358a198649d4282f944fc461067396d379c6afbd23e0d972a3447c64816d5f4936241604fdfd735bfdd0