Overview

overview

10

Static

static

6

bf1f06b336...55.apk

android-9-x86

10

bf1f06b336...55.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    23-11-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf1f06b33682c07853b0fafb6ea17389a72794880a2973a76a7e60f0fe4da055.apk

  • Size

    2.8MB

  • MD5

    05aa3d4d693f96f669bdfd8f7eeea9c8

  • SHA1

    12deca90054e8af0777f34733475b4567ac20d83

  • SHA256

    bf1f06b33682c07853b0fafb6ea17389a72794880a2973a76a7e60f0fe4da055

  • SHA512

    99eb0b488a9a2cff5c6b7571fbd9d2c6d78bc324ed850ecfb342e1a2a502a201ce9353cc57a5121c64230669923f004fa407cb25146122ee5d79731928eeb525

  • SSDEEP

    49152:8EMH88ZHtvEbuc9w24fkktEffrIo7W+Uhll088ZtWnagiIGxOTX0mJn5TwaCpvsC:8EMc8vO8suXyB59zO44z1vZowD0/v4EN

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.hidden.butter
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4264
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hidden.butter/app_cargo/CtWIT.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hidden.butter/app_cargo/oat/x86/CtWIT.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4289

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hidden.butter/.qcom.hidden.butter
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.hidden.butter/app_cargo/CtWIT.json
    Filesize

    153KB

    MD5

    994d525020d7aec53f40646cfccb580b

    SHA1

    bd30f37065c8e64e543f7ca65c5fde941fa246ea

    SHA256

    72668ecc9a21e2a8a577736832e47f42a655874415aa4ece2d8538284040d6d5

    SHA512

    e18c507479691af0debf6e80a6834ef2a1f914dbe725ceac5f3779a90f8e121d956193450f6961eb9343579d82916107298f24995526b6bbd6518c498f1277dd

    Download Submit

  • /data/data/com.hidden.butter/app_cargo/CtWIT.json
    Filesize

    153KB

    MD5

    f77578f172eecb7e07cb6b6b21ba3f6a

    SHA1

    d36df2f70e178f5fa89fba8ad844ff0fda24d43c

    SHA256

    38a752a0fe773a569ed8e3a8d690fca7fbbc7914d7da5ca8b68f6a68426a4361

    SHA512

    14a682ff8d28296edf200600189f372cd02de6e1c3675d9bebeed325a482066979bf60fb0f8ce77cd49d6607e712dcd9f65f00b591d9e90a6fed9f2340c5a8ba

    Download Submit

  • /data/data/com.hidden.butter/kl.txt
    Filesize

    45B

    MD5

    2800856e93fabbb8727fd32b0dda2834

    SHA1

    39f7ff2669f44d808836fa4f8593373e55edb5b1

    SHA256

    955db17bf787914721667e6cdc28bf136859bfdeaf312a435e19a7d433fba1de

    SHA512

    cccfa6c2243aed7cc6f3452b2f433c7d6ecc1fd4909cdba16244491c421356d7253aa26bd19d05530daf4342c6959f14d0981533cf5ab55841611272e6b36e28

    Download Submit

  • /data/data/com.hidden.butter/kl.txt
    Filesize

    423B

    MD5

    ddf1c8cbbd1cc31ed54a813823559f1f

    SHA1

    18acd4e142c24ad6c7125eec1315a6c35d32ef22

    SHA256

    a37e538b555f50eb7e6aa4df0c708c3fd5be98afe68ee4efc1acf99ba887dfe2

    SHA512

    bf7951c602e7b78902c76ab5c7d5de3b37017f2aab7310b8e2bc33493f6294e625205ef12c1bd1cfe9b578856f3d3fe23f945ec7fb0e23df9bd83e1abf7ecddb

    Download Submit

  • /data/data/com.hidden.butter/kl.txt
    Filesize

    230B

    MD5

    e28297c3853b337a5e5c5d9d4e202065

    SHA1

    3b999c44108bf696188f0923cbaebe28333b9286

    SHA256

    843e0233d0b814ed831d13eb93179c3d9dd1cf9722a3a3a4b54ce4830cd38a19

    SHA512

    3d3d2d34a45c67ec95591d375fb37754bd222b9eaa8afe15e7236ab52c0cd797f056dacbe8895f3c379778109d8e871a15b5cbba1f4341a901e8284d7e665c06

    Download Submit

  • /data/data/com.hidden.butter/kl.txt
    Filesize

    54B

    MD5

    31124e12257ee73b8a4bb5c89a04e751

    SHA1

    aba3c23f499288e33984ef4316131ca324723040

    SHA256

    883a7f171331e915576c884b17d6775a5e094ed589a30e1ff8a63c7d97b52d99

    SHA512

    12da8d4eef90b375afc61cbab86b2f6b4e4e3668ed8044930393b62f58c44fdd5565b8b650d50b8fda1b88baf9ebf21875ce056f05fef48eabf05880b2977996

    Download Submit

  • /data/data/com.hidden.butter/kl.txt
    Filesize

    63B

    MD5

    e5da215be21d28dfe3438a526eab2a01

    SHA1

    1197d6e383bb425efb577b365aa199f15fcb2a08

    SHA256

    458a153a18270953714eef1cc462052a558e0e474653223b83b7c6ccea519304

    SHA512

    3cce9247411f86ce0ec81063ace371db5a1d16b5a4c0c05ffc9379b251272be28ace8e8bebd122ae55a6da8c9935c4a7e52834607494fefac9ef0d9876861801

    Download Submit

  • /data/user/0/com.hidden.butter/app_cargo/CtWIT.json
    Filesize

    451KB

    MD5

    abf3021cc5bb4ceca17e1861f405a763

    SHA1

    5c87260f6c9e8890e76c168723cfba9b7bfa621e

    SHA256

    c0780e201b2a7f43f50b70a162855a075d0b4541df9c3668970b8af18a0c705c

    SHA512

    3558e044476e6ccfd89a1fcdddb845b6c242753cfce347ee10ed3b7a219893c858a1acb52bc74855f89982580e8ed4314b7afb4314a9b7cfba01edc4fb5fea29

    Download Submit

  • /data/user/0/com.hidden.butter/app_cargo/CtWIT.json
    Filesize

    451KB

    MD5

    5c7173504d0976b084f7a90568fada07

    SHA1

    0e4c5335221c737b0c63aac6adb75dbfd3e17773

    SHA256

    e244f8127f3925f99bc046f3ccd97babb925e36b1248fd117b4f7f933f8ccdb8

    SHA512

    9898063507b90798380e0952a1f5eac4d3b5bbbbbbcfae40db048ffc4ff6582905f3c9e8006311f47b8f47d770813cf60c54857ab1a3a3ab805281916f95b181

    Download Submit