Analysis

  • max time kernel
    28s
  • max time network
    40s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    23-11-2024 10:56

General

  • Target

    2427241add3123a2e6fba0aa091c487816d9b670.apk

  • Size

    2.2MB

  • MD5

    337d933f1a96325b4decf4c1efd80957

  • SHA1

    2427241add3123a2e6fba0aa091c487816d9b670

  • SHA256

    4a0ee191e0f6b400106812a55996b4d7848ce9d73d86aed7d58d1ec10cd46d2e

  • SHA512

    033c88cd5d8801bfd1dbd0307fa71eb906d05a7497089fa27b26c46f73167d8bcad56793f154e3ce155d54d0c4a6c87d906f9ef2fd336ac5930720c869621f1a

  • SSDEEP

    49152:qElGP+TaA9+wRqOsfGIg6j4PmrGngzsRjOJ21614u+Ii+0Un4mjO6wuOJW99EIpH:qElGgN5ysPmKgARjOJ461hGXUnRjTs89

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.accident.beauty
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4517

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.accident.beauty/app_worth/DeBy.json

    Filesize

    153KB

    MD5

    596c826d7c88ee64df718e042e5cee22

    SHA1

    4eb293bc06458d9877c94378967164552e9d7f48

    SHA256

    b6e0dbf6e3263aa8e53b1ca909def5bc0b926b780accfbd474fd1eeb86c66c04

    SHA512

    d3b0cb78e095fb0687ac4259bd002ab2393e7c34359692c447de072c4603d24a990e7dd02f4aae6529088c900f7aa41fd16a2a7164dc27aa6cc29d990de9548e

  • /data/data/com.accident.beauty/app_worth/DeBy.json

    Filesize

    153KB

    MD5

    9befc8affc5366b59685272fd340cd1a

    SHA1

    db18d7b7dfde5e995391d328b0161f08f627af29

    SHA256

    8e5df11fd8df5db9f7e159d639e3d25f6509fdb320f4935fa131412f0a5abfc3

    SHA512

    7ffffc2a42fa0cbf29babd56b4169d7198b129f092bbd76d6857e3f97023c2c7753cc7c6fb7057a1fb6321ba787688fe0dcc55e1aa12fa0a5313ba99a906e1db

  • /data/data/com.accident.beauty/kl.txt

    Filesize

    214B

    MD5

    b480893fd4b03a8aa203d5c7723be41b

    SHA1

    e4a1e0e3bb3b70a0aaf4fbf876d02fd2c95515fc

    SHA256

    43c9abee00ae3f87bbdf0ca0a7e75d0ffb4b3eb909f6ff956f151c3814b85ca7

    SHA512

    d7c3c01ee56146861e3877e3c149e44ca1553bcb014cb634663be17f45534428d75ccb4021ccb05dc7d6b99c659a120060b31c0daa069707831908b73bcd4b35

  • /data/data/com.accident.beauty/kl.txt

    Filesize

    54B

    MD5

    a02bbf8e43697a9db5a7c96cd2a38efd

    SHA1

    692a7ba41ec861660b3cf1fba14c4d5c542e2094

    SHA256

    277eecf1494a45ff2235a86e885f275658354870c4248b5e7bb5a8d37d692656

    SHA512

    c3e3742d1e696a58ca4c9a5a6a2777676fd040f520af41624127bcc653f42b08f85c78a9dee99f1f3e5ae8892b58a2b6df128c8fc87f28327e0dd3b52eb31c3f

  • /data/data/com.accident.beauty/kl.txt

    Filesize

    68B

    MD5

    75c7ecbbcaaf80fb187bd802b620b169

    SHA1

    8fd6f0788c4a641b8b1da9af292e7b3ff42c8b01

    SHA256

    ff501177397ee1f6211b711bc31b9da86cef28858528aec6fa8b18db988ef0ac

    SHA512

    9353fad342a695a602acf0f1de5188c27d3e0200f12f8646dfedb4b779a12aa36986b861e25f1c373d977243bf98379b9874879b7d842934f7917563dcea96f8

  • /data/data/com.accident.beauty/kl.txt

    Filesize

    60B

    MD5

    853a3529cc1e0862add0012193aa18e5

    SHA1

    cc4ea4a821d81be48e76579442a9ee67a9846033

    SHA256

    f333a8527da0568e6f50c3196eea83981acac1430dd32464b1f3dcb18072ecae

    SHA512

    aa2c21f6b860a3c727e04736c956d79561a6382a9b1582b6d4c8014391f47d2a4e980c77f6229b3b242839885e4327f19edcda557af420092ee1a8eab04a8b2d

  • /data/data/com.accident.beauty/kl.txt

    Filesize

    490B

    MD5

    2f71db1a01bac1c5565f3e2f9cd5842d

    SHA1

    6291f72bbd79f9613a0c48ff52b02abfd504043b

    SHA256

    d0e399a39a24257f12cc6a1b67649e9fbe57712b028908376600cff6df8d2fb0

    SHA512

    48108d54108f1ca33aa7c2f3de3ff42c352451c1db0378311ae6f585e8afab283aefc916d320994e755c09d25a332e031813c4b5c37cdada7149d660068ac2a5

  • /data/user/0/com.accident.beauty/app_worth/DeBy.json

    Filesize

    451KB

    MD5

    1b5e10f5a09de3a49f22d4daf4cbde5e

    SHA1

    2ac8711f065d3e3a18d1b709145025d5ea16a0f5

    SHA256

    49645a19899dd63c8ee1b2ff3da5572344d1476125064114e81e7def8e405802

    SHA512

    936d8477e97d18f02752a4ba04cf95a33941daf4f6be90d7d47aee852c45dced9d9db7ab9739f123c0666cb1d272ba68f41b99c2d911b643bad0c036e9a829ec