Analysis

  • max time kernel
    27s
  • max time network
    33s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    23-11-2024 10:56

General

  • Target

    fed26acfb86c23f45020918c294477b3b9ac3dc9.apk

  • Size

    2.1MB

  • MD5

    fc4019c4e8b591acf9e08a33863ce840

  • SHA1

    fed26acfb86c23f45020918c294477b3b9ac3dc9

  • SHA256

    79498727091aedddd0e19d54f6a2b88647bf707b137e3a4f9fc240bf09d6c2ed

  • SHA512

    aaf7cf295533f6c1c232355b0c73aa86f20f4a88879dfb95e782e3dff13a73d5d5dec543c1c58738fa78eb5322207c000e47ec45052889c204a1badd7b73278f

  • SSDEEP

    49152:FYOxmEyq85MRl8HIfcmXnO6eAxOBbMLq+RM/A2j0MCHOKVcK+oxR4:uYf85MRFcmXO6eAxPHC8CsxR4

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.survey.kidney
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4517

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.survey.kidney/app_grief/HnC.json

    Filesize

    153KB

    MD5

    ac6b25c5ddff87c1307a77b0ee0894e2

    SHA1

    d5e5a05fdf2fff82792016b7aac371a6050fd998

    SHA256

    830e4be5c24a4c01b21c7bcd95f621609d1f7eba83fc1fc61df458a0d39101f8

    SHA512

    a591ce9fa631eb3e940b45cc7380cf13fa6de8a7746a662a282d6e1803c028438fd530d830039f0899bd9b4b8f6e79b760478041022f067a88ebf7c4b2dca632

  • /data/data/com.survey.kidney/app_grief/HnC.json

    Filesize

    153KB

    MD5

    5c8608a351b0b4b92f667da1c3928a52

    SHA1

    2e4c7787a3c2190616b3478b9f39152a099421dc

    SHA256

    8a9716567c4a3f377bc3563ef2cb0f608f7b754d22aeca325fb765c11e24d402

    SHA512

    d77d359b2fd14cb74d1e8ece66b286c94c8cc8d9c1250c2ed523a6b4e186ecc34c2fd40be48211ff968f9a8a8ebbc608f6e3cd79477447f092d9ca552af2a3e2

  • /data/data/com.survey.kidney/kl.txt

    Filesize

    214B

    MD5

    0882347fb97748908bece5733730fce4

    SHA1

    3a2f92653b5f41d1c6c069c8a2da3d74e667d0f2

    SHA256

    a8a0425ef48bb1f22e6799a08c96c1acbf03ba25e5df2928f4e6bd38eb96513f

    SHA512

    262cd3701225fcf3dec8ebb458c95ab0035e81849692cc1fab332a754b6cc4bb11bb68923ebb23a6b04f780013dee17391db817b44cf3f7356267b67316d7559

  • /data/data/com.survey.kidney/kl.txt

    Filesize

    54B

    MD5

    32f893b472f006646764768939916d85

    SHA1

    f1e6facc9f3cd8be317acf671840398cb6dd34ea

    SHA256

    f6e9d801b0a4d69784a5f394e03c7236dad37f0ecd229dec9055fb0b48d24837

    SHA512

    3db3dc8ce985b3d052e98b68cbca755e9c42720794aa4b9e014623f424f716224075a01173a9e9720b33afec5878e05a9109bf23b2048544b47030b06267e04a

  • /data/data/com.survey.kidney/kl.txt

    Filesize

    68B

    MD5

    85d774c108bfb6dc892d8c557bbbed32

    SHA1

    948b430963b8b612aeb7ed3d5f81ed9b8cf17cd3

    SHA256

    02e8a38e3851d5d80d5d5b8ddac5ee1168338f9c20f69c251a0c6b6a0c0ce0e8

    SHA512

    3ebd8e303c0efb9d117637c130de627fbcb0973d642c2f75bfb6537de5b74089670293a1b80b161b851bd77c1b2ae0033132ab4c5002b493cea2deea56e46752

  • /data/data/com.survey.kidney/kl.txt

    Filesize

    60B

    MD5

    d330f822e2381d14ccb5496259b39132

    SHA1

    7ec1cbaf4b2c36fbff724be0cc2cc84fdbc11884

    SHA256

    db4efa0115ae242cd5453a0cb9d7d92939cc13fd7247517abb2115a8e652c7f4

    SHA512

    210182028a2122c54eeb43a1cff9ba148d44106e017af117dd3e0fde5d9cfbf63134389cd734aaf135e17830cda30e5ab4f0ea90e11dff52522c3a04a982723a

  • /data/data/com.survey.kidney/kl.txt

    Filesize

    490B

    MD5

    acd9eacb3bf3d27f2e7bec7d12ed775c

    SHA1

    5709596cd47ce09c7b20513b52813ceb163ff403

    SHA256

    c240c5f5f5b9221cc76391c36c13bc85dd127c6ad99e487ea15369b0d096446b

    SHA512

    5280e0ea48638886b69f3dd902cc58fb5887127bc9deb3bffe2a8249d49f14c16a0ee33443f6d455b937fc5ce27c4ad37a413cfacd419799ba50f5c79a442faa

  • /data/user/0/com.survey.kidney/app_grief/HnC.json

    Filesize

    450KB

    MD5

    ab66c4d1fe501ca4bae2dd25f6050eac

    SHA1

    00757c8d461538a30538f157af3e0a8f84faecd7

    SHA256

    bfc2fef258ea2d319ce8feec4f994a719580acf15c66cf46c37bae9f3196f1ef

    SHA512

    e32aea83f08b87e95c22b9fc099cf8fc9789b53da10fa08e8ab98fe218cebfa4feb74479e5dd06656dabbdd4f1a59cb08ed68b526ea1b8e511d565f8a38ca8d7