Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    24-11-2024 22:00

General

  • Target

    9fded09d42e928af33733732778019349e519bd68fcfaead47f86e58a18eed14.apk

  • Size

    2.8MB

  • MD5

    98976e01f908bcbaee37ab2caee56fba

  • SHA1

    bced2482c960721a779c4570260be2cf6b14e18d

  • SHA256

    9fded09d42e928af33733732778019349e519bd68fcfaead47f86e58a18eed14

  • SHA512

    868a114e1ea4559bf360e1d02172b7e64586ea7a16aefb9447959331cfae904658879d3059fe02e8a0a97992e23de33db504c171959baec64b550ec720b6828e

  • SSDEEP

    49152:nU/hBc+nkoYMcDcttLKetmyjmUJYPqvA3UluPFnpcztWigyUok2zeKES+SCzYyTJ:U/hBcm5YMcDcDLntmyCU+PqvfuPFnMVY

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.denizbank.mobildeniz

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sign.useless
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5003

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sign.useless/.qcom.sign.useless

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sign.useless/app_wish/rJywC.json

    Filesize

    153KB

    MD5

    b71167a7f069a209edf2bc9e543bc272

    SHA1

    46232ac58c6ea07d32ff0700156fa9c52735e494

    SHA256

    3e951f877a4a311357ecf4c0aee57c73c577af813e1c1c5f0124666f844ae208

    SHA512

    aa82c3460c7c64175caef8744cd0485cb590ae7ee5daef06f841e4f2eb41a3801c271e5b4abc07f37456fa630818d5eabd75eb3fb6a5865332bc2c090e6d68ca

  • /data/data/com.sign.useless/app_wish/rJywC.json

    Filesize

    153KB

    MD5

    ebf0cf2c65cecaa86b51134c83091ac5

    SHA1

    750fba679ea7dcab10ee0fbda6eb2fff9a8845b6

    SHA256

    d7ae837f6572146336da4172e7a2990526c641d7c8a3a007925fedc2b7165238

    SHA512

    59c2a1a16b65e66293671cbb1e56428bfc999e8abad568ed7b0bd0e5dc41a37ab37699ae2913cce35352aa6fee69faee59d231d9e2f7f22bede56537d51591db

  • /data/data/com.sign.useless/kl.txt

    Filesize

    230B

    MD5

    f381f5821d91eee850684b7f43dbef9b

    SHA1

    d06f3e6ab49988c3bc2e5b705baa1fe5c1f68cc7

    SHA256

    33c468a68c7ab5c0741769d06d0914f21b83efb7d0fcc1ac745186fcab81dfc6

    SHA512

    7513de14adb2968555f8e7f324ec94bea3583a10fdabffd56369b8e6c0818d3330d5623358fb5728411f9a084fa347ef8347421aa3044bf7287c3b255929174e

  • /data/data/com.sign.useless/kl.txt

    Filesize

    54B

    MD5

    2cb9a7b6dd412661e046bbb2a47e75be

    SHA1

    f31ab88c060cf6a0050e1e063c36b8a68607ebb2

    SHA256

    d6680d35c5589674ceba93cf1e1992da7fefc8a8f871494d4d1a8521bb533bda

    SHA512

    78b8998a2e62328ae130e8a86a933542c64d5d268a1b6e4412242522fe5c05361735675e6f0fcb41d4ae6c783fc34b8123b511094fa4b4c76f72feacaadaf8a8

  • /data/data/com.sign.useless/kl.txt

    Filesize

    68B

    MD5

    38b76c04d9942f255890c8bdecaa47ca

    SHA1

    e1be8da38bedcb2e59eccee8361cb014fb83e6b1

    SHA256

    cf378e5357a2a2e77ca327f8162c3695d0d7d89ce965de1263858906af378d82

    SHA512

    e41f96628bcb4a4232eb6bfa6fbb4904b71df39b361b9cf3edee7926c684e89ee4f9f923acf6b16e55fb0255e8bb986d80c5476a1e0e67ed14ba227da9dadcb6

  • /data/data/com.sign.useless/kl.txt

    Filesize

    63B

    MD5

    53c8bc1e65b21d00deca6b1426378c9d

    SHA1

    9359280acdfc888c19f8bd28f570cd9320e0c234

    SHA256

    85492e2be4a21ae8cce16af760d1a30aae2d98b9f2d4d80dbb5d4641c845f329

    SHA512

    ee6d8d3d7b475f7e6227c6451d88f178c44075926444e2c06d8c7b2bd05706769e021de39a41148e7c4637be0f6d25cd99c495ba6976cee16f4541924863b232

  • /data/data/com.sign.useless/kl.txt

    Filesize

    423B

    MD5

    a38d5b1ab7fb700e264cba7f5085fd93

    SHA1

    f26114e1f752d98c95e7b9ea067b71f505da2c08

    SHA256

    aa93f1f6339e50044f34fc6d172a9c904c3c1425d3259fac3a84412f44e71067

    SHA512

    4ac76141242d3cf470656e05918066507fcd5690f5f7936ef7706aca5a066fac031f2fffce7d1179ce46dfc8944786ea190d8c20a1c2fdd371982bd95c03504a

  • /data/user/0/com.sign.useless/app_wish/rJywC.json

    Filesize

    450KB

    MD5

    2e8f6485dc3d31e3ccb523518363f86b

    SHA1

    da3293820c9f5e4f61e40ae8138a903b90b17907

    SHA256

    08e03338d5fd6c156e785addd01e0fe5e5ec7f5fa0f033d851f939a26629dc20

    SHA512

    e5e25e6acb197895fbb0d11bae48e2f65d51a0eb68c7720980c1e2555a41ca278dd7f79bcdce7db35e78e10d6ef76b5cb971200ff05519fecfa898c9368f4f1d