Overview

overview

10

Static

static

6

01e6cb93ee...9e.apk

android-9-x86

10

01e6cb93ee...9e.apk

android-10-x64

10

01e6cb93ee...9e.apk

android-11-x64

10

197359a4d8...d7.apk

android-9-x86

10

197359a4d8...d7.apk

android-11-x64

10

2427241add...70.apk

android-9-x86

10

2427241add...70.apk

android-10-x64

10

282a7cfccb...bd.apk

android-9-x86

10

282a7cfccb...bd.apk

android-10-x64

10

284d74a6fb...fa.apk

android-9-x86

10

284d74a6fb...fa.apk

android-13-x64

10

3221126c35...63.apk

android-9-x86

10

3221126c35...63.apk

android-10-x64

10

3f3ab2cd7e...bf.apk

android-9-x86

10

3f3ab2cd7e...bf.apk

android-10-x64

10

43e48ed5f6...fc.apk

android-9-x86

10

43e48ed5f6...fc.apk

android-11-x64

10

616c4ad548...8a.apk

android-9-x86

10

616c4ad548...8a.apk

android-13-x64

10

74aca9fcfb...e6.apk

android-9-x86

10

74aca9fcfb...e6.apk

android-13-x64

10

753c262257...1d.apk

android-9-x86

10

753c262257...1d.apk

android-13-x64

10

83684d8fa6...97.apk

android-9-x86

10

83684d8fa6...97.apk

android-13-x64

10

84b4b256e4...0f.apk

android-9-x86

10

84b4b256e4...0f.apk

android-13-x64

10

865e193b3c...3d.apk

android-9-x86

10

865e193b3c...3d.apk

android-11-x64

10

8734504205...3f.apk

android-9-x86

10

8734504205...3f.apk

android-11-x64

10

950867a96c...32.apk

android-9-x86

10

Analysis

  • max time kernel
    148s
  • max time network
    161s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    23-11-2024 11:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3221126c3590df52f238b0dcbfd5e77b226a8a63.apk

  • Size

    2.2MB

  • MD5

    d02d3dbc0a1026c5004c7ef271d2547a

  • SHA1

    3221126c3590df52f238b0dcbfd5e77b226a8a63

  • SHA256

    ecadc9cdf7e70be4017a06fe6387fbee3b05862b552ada69bc9cbe2c8174f209

  • SHA512

    2a1db9afa7d339796c04aef2faa296c39e1782d2c2b58d9f49bd6c5d8b90fb89136431328d66d0f8bae8534537ab7c9dfd96aace502ef6d72b6b9e5478ceada0

  • SSDEEP

    49152:emqgT/t/pDlo3C8QQQQdW8QQQQ70vXYBKUXS8lwEACOlojOet0YR9i8QQQQc9E8Q:e0l/pDQ3hB98E1R69C

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.cancel.pass
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4215
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cancel.pass/app_hurdle/AZdDQA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cancel.pass/app_hurdle/oat/x86/AZdDQA.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cancel.pass/.qcom.cancel.pass
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.cancel.pass/.qcom.cancel.pass
    Filesize

    4B

    MD5

    27ba19805d52e788ce7ee21d6f82137c

    SHA1

    36bd2c6b725254b966fb8fef828b4f6f9e41d283

    SHA256

    c4fb4c4feb09b15b40b6334bccfac10657db63fc94b0043b35cc7173b43993bd

    SHA512

    c35fe911c13605de5441b5829a925e433bdd8b64c4d076562b07c8d3d6f2ed8bd72273fa7eecb17b946d4ef2584d550d4ac67871822b986f7529c014b0def34c

    Download Submit

  • /data/data/com.cancel.pass/.qcom.cancel.pass
    Filesize

    88B

    MD5

    fa8dff4b3d83b6ff57c951425b01281a

    SHA1

    4ac7d978e16cc6875d4e3c137287361e8b14eaab

    SHA256

    8a90123bce4487f9e1ce23b00e57167bd34ec710f31618087d4ae610fb1fb798

    SHA512

    968847cd1280ead8e30a2f4cb2ffc518d475563240ebf8745addf3b2819fa241cea8c6ac9128f675f2a2d430a6535e2493708f5938f8e32377c3176900e06b83

    Download Submit

  • /data/data/com.cancel.pass/app_hurdle/AZdDQA.json
    Filesize

    153KB

    MD5

    f4cc53982b6ff31342f7cce77f878d9a

    SHA1

    f0a9bdaf594cfb141d063855f5fde7bf0b160024

    SHA256

    502ee5d7b06242f6504863179e40ab61a00573ab2bcdb32bfa192b100a0f10f0

    SHA512

    c852399084be8958f5a1440f91ba6b6f62039f680e9e495ad7161cc6449fa584a5e98f88288414906e9138196a7f078d788d7f4dc8d0776e91a53647a42a161f

    Download Submit

  • /data/data/com.cancel.pass/app_hurdle/AZdDQA.json
    Filesize

    153KB

    MD5

    ca357882a53a8db26a6e0057d8275a77

    SHA1

    08562a65a658d17fa1eb84549bb5a12256189f53

    SHA256

    287e0599065c8c4dc5b4750984043324941060ecd691ce594bd68302eb6595b8

    SHA512

    2b45f99646e8c3e38a4e8330e0def441a7df952346d8a8aa956f87fc7c7fb8ef2d80ceb629bd14753703a0127f6e1b729d987a9710d2c8cad56d67dae6c693ff

    Download Submit

  • /data/data/com.cancel.pass/kl.txt
    Filesize

    45B

    MD5

    99e369a7e30d983d98c0200ca2ad6658

    SHA1

    8a70f70ec46d26546859ecd26b0dcc9e8d221181

    SHA256

    0da5102c6732e664c2020e478774ea92b55258673c808dc2a221cf5c7bb5cc9d

    SHA512

    09d07c02896be12427a97e27e3a141bd951b73dc5b35bba43de5fe30c99782061c2b2754beb31c47a2d3f11dad2b8d81b4de2f8a8092528c554b3f307acafab9

    Download Submit

  • /data/data/com.cancel.pass/kl.txt
    Filesize

    423B

    MD5

    b50bf3ccbad86dcff8c18522ade2ddf4

    SHA1

    8ca996acffed2ef3b59dc2f0c37ffb85183c5c9a

    SHA256

    3cdfad500babdad214823f3af58e0a77741b5c1c58665698d4d11b07dc2b8fef

    SHA512

    f91f6a86d7dcac30343a6cae6bb5d55e4ef38460002a4a3f1f0a91191027f45ec2d69fa7f53d6b4a17ebe492b557cfb60f97223be2636d8f3da9b5f4a257b834

    Download Submit

  • /data/data/com.cancel.pass/kl.txt
    Filesize

    230B

    MD5

    aa1d7049da026a97647b6c2c2b1010d3

    SHA1

    b20cc7d80abbfcee9fe8ae38bd6a95ca9acd0a0d

    SHA256

    47134942996ab0def9dface100f28f542cbb7dfad203bb168dfc0e6bbe6808b8

    SHA512

    d791f724a58b0a146bdba6fe4d1a8b6c22234e1d353e87f32b9838b15ed5c201c994716dd4bb11b2f983a9c7e5e97034046e121ade0e08ad8bacd1a02571ac72

    Download Submit

  • /data/data/com.cancel.pass/kl.txt
    Filesize

    54B

    MD5

    db301deefb7e484737524a525670d788

    SHA1

    2c98c769a7de46bde6f50eb7d6c0971bca3d9012

    SHA256

    6bc0f7941e19225ce3d1948335cf324cf50a64daeb1d561b92f3e0cc7ba8ced5

    SHA512

    d0d945c1508ce0b9a5d038cf48d24ac65ea06020f3d2ab2e7d68aaf2a469906aaa5ae74d9b9263a30db6a310cb8660a9ac7ef8a337d30a646b7d5d6a1a25b714

    Download Submit

  • /data/data/com.cancel.pass/kl.txt
    Filesize

    63B

    MD5

    93b41ccb891f37590cd24394e2654080

    SHA1

    5f6fd2d5a1cd8e61ec609a57e7c25c0883a1fb77

    SHA256

    d6c82a8cafbc8bfbb73eb2cc3ff8459b3aff3f98cf481b4b70d058a66ea3344f

    SHA512

    3f934e4b7d2853d15d788d4879ab971ccc1a1ae7073aa9d1987111777e1c62725df036c2fcb542e7190d8c6c90b6b88e51d14d8512e7b83640e1f4a5de909418

    Download Submit

  • /data/user/0/com.cancel.pass/app_hurdle/AZdDQA.json
    Filesize

    451KB

    MD5

    417428b9e4cf669a359ad4ee22ec24c9

    SHA1

    09a91ffc5efca34b459b47b44d90d0fb23421cf2

    SHA256

    434f027a134eb07a83100e71e5816828c0df7c71ed756ae597b4f8dd9966b5b0

    SHA512

    7b0d51dc7c6dad1feba8d42248b4d599cfe314194ce04471dc4b4f25acb7e1bbb1021771a284df0bc7902efad070f08743a96676b1eb9f1205749055ddc8626e

    Download Submit

  • /data/user/0/com.cancel.pass/app_hurdle/AZdDQA.json
    Filesize

    451KB

    MD5

    eb706616d8767a98e42d3814f33464b7

    SHA1

    e3a9b663f244bb4b86d869d16f52084e0339e8f0

    SHA256

    9d0b631a651236abf53151f61c05d9d6333ab85b4bd9ea568378d88d8ae3e474

    SHA512

    02cbd11dedd8cc74c09269831fe39041d880c6fe36af0934aa629fee48a804073a0748dff9786799f9e07077b291a43e9170a1ee0e4f891553373ebf36d56d5a

    Download Submit