Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20-11-2024 22:02

General

  • Target

    0d5528a031e45c82c12fe934c67cce5a552c412ecc4038f33184d5f7512556d1.apk

  • Size

    2.2MB

  • MD5

    555fa87429a6e2559747f82856527cb2

  • SHA1

    f059354625e29ce44f41a399d6ea10525157fe27

  • SHA256

    0d5528a031e45c82c12fe934c67cce5a552c412ecc4038f33184d5f7512556d1

  • SHA512

    0dc49e1605d561f58287eac0f7affc7548fd786b7c576dc506582e4179ca8bbc7a2a998f856076f1ce965fa1dba551d8f509d11f015222c14b84d91a9ad031b9

  • SSDEEP

    49152:E9sLJEU/ghJoNNS9jyDFqDTdCBb4Cxliup1pMlg8RKR3:HGlh2N0bkliuHpCU3

Malware Config

Extracted

Family

octo

C2

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d92146d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://694b64c9b41c17a229d92156d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://994b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://4394b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sitpeople51
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5149

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sitpeople51/.qcom.sitpeople51

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sitpeople51/cache/gsatvprzwmg

    Filesize

    2.0MB

    MD5

    d6442388113c9dda2bdf6df7f5ce2a0f

    SHA1

    7a5060a48d016cfb943369f66ad9d8dcdd558cc7

    SHA256

    b091e26234b9bc40a648f857314548e785941be4440abcffc1994691c0a7ecb8

    SHA512

    b3660074473aa6e2778083d19f823df3f7623ef5919173014c342b7ac201b5bb61e455586757377edeca83c51cf2cd71c2defd338a002046455d53bb95be6137

  • /data/data/com.sitpeople51/cache/oat/gsatvprzwmg.cur.prof

    Filesize

    1KB

    MD5

    1925c264c6870b25576ed34b7c32f26f

    SHA1

    58d578384ef5bb9ee724565db6e4db9c85b62368

    SHA256

    4efd1dc4fa8f5e22168be52ed8be89a2a2e4491fb9a430bde8716169e79515ba

    SHA512

    25d89f41b233a796c98fee6e6996f1a840af4222d97c6cd224e46d8d4a349c0b3023d60dba32cec5df9e56dd816bc1a6f52fde76289c192da9f7d47c7e4cd2e7

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    237B

    MD5

    caa8e2f06b6f12e766984ccfd88dcc7c

    SHA1

    cda309081adea97f737cc45b8c28594cf0ff3c76

    SHA256

    f61a0e5d93882519cfe6f8e81bf609df443e611da4f8e6c74d8de136fe65d577

    SHA512

    8c9880b90f4f43891417f4deeabd974ed6b190806b612f2108fa874ea0b9252b34c456e5cfda638b33200533baec9853f7a6aaa2e2f006cc34e3187f345ef2aa

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    54B

    MD5

    cbdad751bdccac4bfa97c15b97e013b8

    SHA1

    80e0f82953715b05d0912a8b779890e1d58e8495

    SHA256

    d18638b7056059d8ff78d7aea160e363371e4223f3697dba00cf907e054150a5

    SHA512

    463facb742fcf61f231d61c6182355a9d58e54da827c70205cba05bce572a4c0e9d46088f6ade94730ca830b8bb44827cf028524077b7b681762fba42e665cde

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    63B

    MD5

    c19ba4f5b4ad93e6a9a91860e85ebdd4

    SHA1

    b442cda285326b6a53759aa875fd0e2952f0841e

    SHA256

    bc6bac28484b67da8b8371e6710697c7fce8fd622b6c7a996ede0ef710db6097

    SHA512

    3c29cd6eee4ab79bbdccf7459fa04a9270318e701bc16666730c5e81c53e84eb2c7eee37fbfe20958ef8f0788367d92c37316facdd1d46931821e5063e463530

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    45B

    MD5

    5df43b4a39bb05166841c508c2d8ec53

    SHA1

    4450ef293e3a26fd2fdf94097b2e90fa5c5a04a1

    SHA256

    9fd7d9f7775db0047263ee2c43238cec8604b1c6f61f769d02d630ff954723c5

    SHA512

    9bbee4f5f56e88c0811c7f93f49ac7cd3f57c012684fd4a0c45a607003b5509aacb6320cb0e8cb4697fda1705792f99c894c0e7bff1d1c38aa4cabaf8ea7e025

  • /data/data/com.sitpeople51/kl.txt

    Filesize

    437B

    MD5

    c56f2445ab33c257cc5e7d9c734697e7

    SHA1

    4a61728f185d2f01589f01cd457981c2e466b446

    SHA256

    822ca5226d3243f18115b750f46cb175c6258903ef92dd9d23a07b29841d2321

    SHA512

    4fb9691bd8ad1da2dc8fdbfff5206ed6f065e58105b3a974d7d5664ebc24af312bcaa4e0de5bc62474ecdb3f57e22fe23f0329abe564982f00d03b4583af9c43