Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
23-11-2024 11:00
General
-
Target
282a7cfccb03ab7ca7fa3eeb9a4cc28e262e2abd.apk
-
Size
5.0MB
-
MD5
613ea39bc391c96f3af86ce77c9e7614
-
SHA1
282a7cfccb03ab7ca7fa3eeb9a4cc28e262e2abd
-
SHA256
245b4bab43a0df29bcb30b49b4426e1bcb7eadc9e4c23a8aecce2dbfc64014ae
-
SHA512
31c959e88ca8f61dfd2f0a836bd542c1f92731c6c46eb11a2eaa117df79a08f24f15f2b627255722a9b34b94b6372184f1c6504abb92f3270b66eb17f46f361c
-
SSDEEP
98304:0SznnPrMK4q1yTA7+McW8o8A0UzCGsIYyGWU6vAubwGDsPamJlb4P72BznF1kiEs:dxhYRfHe6GUYf5ag1m
Malware Config
Extracted
octo
https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/
https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/
https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/
https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/
https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/
https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/
https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/
https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/
https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/
https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/
https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/
https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/
https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/
https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/
https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/
https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/
https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/
https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/
https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/
https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
Extracted
octo
https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/
https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/
https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/
https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/
https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/
https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/
https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/
https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/
https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/
https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/
https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/
https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/
https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/
https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/
https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/
https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/
https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/
https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/
https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/
https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.denizbank.mobildeniz
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.note.square1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD5612a496400388842032c46fae46ff84d
SHA1bbd5255bb9c8e1fe731454c0161744bc4e09b22c
SHA256519dbb3ec17c3699ec1c22f669249e98d9c740391cfd99dc61f2b83740e59646
SHA5125e80f2178007ab8a353f78bc3dbb90b4c5ba0a2e20339ba0f27f8d80548181f25c3e5dd5d226164e7b29d393293b36706067d38032043ceef858f4c5713279ad
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
153KB
MD59f5c85a001a9deee95d1b438cef810d5
SHA11648f0e378a6c7b3e08b02773bbf8252f320fabf
SHA256dc314586313f7e665368fe3ae39eb453512b3df5d05a842bfead43ae47ecea51
SHA512d885430a4a99904521f5765e5d3ec59b4ef17088b28644054ac2993dc382c87e79138c4eb9b10852c60984fa04895f28fdfbaa9d92a6a89a192cc800dcb6a14d
-
Filesize
153KB
MD5532d58c6c7bc6bb3ed7246d97dd25d61
SHA1996e6963a6aeb18ed386ee64fc8775f412400c3e
SHA2562378c93360c8c4329ace04e0c23e7a66f2cf814dba28e6ccf6c414b383bdfd79
SHA512a33965a056a6f1b3f3eae88e70bdebc0b242e850a6a990a3ac146a6659328b4538742103c33a2441c2fe131002b9767113937938ca5478fa485f2231edc6d02b
-
Filesize
230B
MD5776c0714d65030b6dab9ab807365baae
SHA127e58d43bd0a8714f63cc354384b821e35708b42
SHA256164c291b6570fc34a4f4b2b6de1e667f3da7ec0705fc230a539a598fa0a42563
SHA512bd102599110c78889420e8c0884fb640110e93e2828e297565377b518dc1f06bdaba20ee689bb72306f8b59671d2c772d46e7e7ad7c625315620943b54f77960
-
Filesize
54B
MD55198e75e5ef149c4c8eaf85731529f30
SHA120572d98e1bd9fb37ba1392a69bbdc4b13fb03cd
SHA25616b85f1a6180845498beeede554f415629db6029bf3f6f13f24f662debfd94c9
SHA5120bff508b8623a693b9ca760e239b91cd00f15be7471bc0b3c8a06a77c6133198178fe9909efe684564bf0be1416afa5c5c4e03e10baf1807263ef682159e3b3a
-
Filesize
63B
MD5818d4def4410195caf205646c658d08a
SHA16d5014305bd0221c9400616bc295c6e4f0fa426d
SHA256f637d88ec9f4e8513140fe884614a46079f1d5a58ca7b8bd2b0fbdb68670c914
SHA512a669dfd10451738c4f542ed740bd9cd72960bdd104ab32ec914532ca4c17817074d625ea38e561df23f11c3cb2c8eef642967ca220653ef9ebb945f75e24a121
-
Filesize
45B
MD52106927f720716220fcb8725d87d63d6
SHA19ca1acfe40ee1c66385c23705bd386f82b935f4c
SHA256299b19416f9b59a0cbe6bd542c62c6f05cf7e3f18d413396207efe56d85a37a9
SHA512563524ee817b0809be208bf7076e3a842f652f95b2dba764c07ba5ae6b8b545fde0e63665b9e5a34e2dadd21567d723c288534322f801952e7bba60bd3bb827b
-
Filesize
423B
MD5faa43dcd66ec38db6e1466ba6512493a
SHA14927fc7ca5e916ec598dd485f030a18d74f4b82d
SHA256ebdebad2a34c68de2a57b0c8949e0e3c2d0c1c2ba805bd725cb4dfbcb1ae6c2c
SHA512480225c7d3a5e93b98a27966b00be531af1ad7a74ccf9fbbc451c6d44befd0bf8ef2ac9534562bea2095bdef0ccb19f731deddda3381750038809671010e2a6e
-
Filesize
450KB
MD58c4e139e248a0c5c8b7720373b1e859d
SHA1e0b3a8d70a9a47b75c092ff60bf88fa1c9f294b1
SHA256d8ee5971509019d34487c474d7268cb7994c2ea24890dccf5df41b313c14d4dc
SHA5122bb36082adbc0c816d098cc9bf4371a5f6d22ed9c6ab8aabd3865d29d4d7b3174460ed1ced022da27b3bfa3ee526b771303a84a30ef8a1ada9526e7bed442491