Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    22-11-2024 08:04

General

  • Target

    apk004.apk

  • Size

    2.4MB

  • MD5

    e24159c21749fb072ac95b95b801ee98

  • SHA1

    e5b7f7a5bf069640c8514998ef9052dfaa32cce8

  • SHA256

    45abbb4cb83b51f908bb853ecd2377a4a9c3598b2f20bfdfc93a955cc8ad80fa

  • SHA512

    c20ad5135dbf3bc52b147d44eb8111180938a2670ab931ce87a38e14f4353a9de4d5183f793c5a0193e0fd8142644531f6b05aab84cb920835b53735b8244575

  • SSDEEP

    49152:i4pNHf+q/lsFsPtuY6F4fBgh/5yTXzqPpjDfdofX9yFzTCpEJlOyiSv:XFp+6tQ4fWgTC7dofXsVTCFyVv

Malware Config

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

rc4.plain

Extracted

Family

octo

C2

https://c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://64b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://74b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://89c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b6c9bebf541c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b641390330721556d14a4ffd4.com/MWZjODg0YjhhMWVi/

https://94b64c9b41c17a229d921556d14a4ffd4.com/MWZjODg0YjhhMWVi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.wordhappen5
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4669

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wordhappen5/.qcom.wordhappen5

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.wordhappen5/cache/oat/tbuwtpvtixa.cur.prof

    Filesize

    368B

    MD5

    6a0d72b86cf14df2f416914576c08d68

    SHA1

    d28f59a7162160ac53270aeb9c21fd1179ef84ce

    SHA256

    f1180d8b98270abf098b6d891a667423787464b1185d440acb0e36dd82cfcba6

    SHA512

    e0aa1d390bfd7a883c485da0cd1cdf18110dbca8f114888d5db06322a6a6ad0336f48644bef84a727d7514e04d5b3a599911d681fa4fadf1f4725c325068947f

  • /data/data/com.wordhappen5/cache/tbuwtpvtixa

    Filesize

    2.3MB

    MD5

    ca04e8bdc0c35835fac9e8b1a882446e

    SHA1

    9c9bb95296cac41c0558d617d8c40ce7a64132f9

    SHA256

    5c1c54a15ea2718da3f0d7c2812514c864356212c696c2cb61b926feb26da7c8

    SHA512

    b46dbc251b55088d6e90ce6f8115571bdbe902724473eb5dad84f2a02020e40175e209647c4b8930e4f6e890128168f7dc5c6057d66caa91a6828f501da9fca7

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    237B

    MD5

    90643c020a41bc6c118941496ce6cfab

    SHA1

    0b7980d96908ad30dda0d51427bdf199c7c4e081

    SHA256

    ca5714d7b86883681c31f5287e644bbecb10684725599248a967559841851314

    SHA512

    deb6c85821260af718afdfdda80e17406e17ce3d432dc3d2ddc9098bfca9a361767a5b1fd844a271e56e10985f7fea70feace480b1104d47d9d73db41fbc0c05

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    54B

    MD5

    92bbe47ff5835e8928371b59c22ab63f

    SHA1

    b437efdd72cd9bbd51efecf02f5f4974ff0bcbaa

    SHA256

    aae2d1a1469618fe0eb72481dbf7ff364ca4d0329429470abf69874bd4eec141

    SHA512

    60ed63a5255e185d1590d9258afbf339b3c258b1aea068f4f15f92a4a9f7422804eec366c086fa0241d8e8083a2a6b1c6f3c79e307e2889072ccd55b58aa2c38

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    63B

    MD5

    bc2f972fe732b79f0030465181630081

    SHA1

    28d56e30824c48dda266ab70919bbafe7d731e60

    SHA256

    3004a2e51250697b29a020cefac68ed2590287a56902db94edb2892611c15d25

    SHA512

    65c76c3b3f5179db168cffdd15776f0a54522c4650d0e14f5a97ef8dbf6a5773c7577d561c3fc311c47b187c697f9890e5f9961ca8ff27d11c0178d36963e33e

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    45B

    MD5

    8dc8935d0e8b4446aa491ae5cca8f1ab

    SHA1

    8b891b4de95fa983b505623addc777f50d92e9e3

    SHA256

    52e74826d5d5e3a20d7784f99d1f41853016b77e4d8ca5fabf9dbbab22bd750f

    SHA512

    935f6b96d95fcaef0ee2a15116437b0695d4b53ebde5df8263dbb36a10eb97d63bd8297203637e698bf4f82e8e9e9bdfbc2cbd1d0d3fecf66c05f8316f7ddeec

  • /data/data/com.wordhappen5/kl.txt

    Filesize

    480B

    MD5

    a681794a2a7a170bc176f9d80f186fc8

    SHA1

    9bebdbd1982d591b5778e3aa84f94bc9a2107afa

    SHA256

    d9dd7d2ad8ca3cb7219e6c5638e695a8c08e9de2d9ad2b9407b707397762b921

    SHA512

    887abcd2ae49a3e38d40407a94630caf16e7c1e2b1df6e84370f0ab42c3037132c3012f67a7bb77396b910ae16b60f5a56a7dbd5e1be453f8723632f041e2b6e