Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-11-2024 22:00

General

  • Target

    7fbba7bd1431741fba13456cc2d4ea633539ab79648bbbb035113792237e329e.apk

  • Size

    1.5MB

  • MD5

    f4ac2950b5516ef1e28f07a948f9c319

  • SHA1

    283a5d0fb3f9d2b47e55eee27828be60be66d4a6

  • SHA256

    7fbba7bd1431741fba13456cc2d4ea633539ab79648bbbb035113792237e329e

  • SHA512

    08df7dffaf5ab42bd07788d7c26465610024b51a35b165a09a20cb978a16f5fb9353b7c33195bd1c613fb6add515ed6643c20811677b32aee5524a2512d1e5b9

  • SSDEEP

    49152:v3iT3JVJsnni42yPwY57FpURy23txrf32fzrVgmP1XPLkZ:61VJ6p2yP7FUXdxrOfzrd1DkZ

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.easelike2
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4490

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.easelike2/.qcom.easelike2

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.easelike2/cache/oat/qodflckjp.cur.prof

    Filesize

    342B

    MD5

    df4b8a1c071081c97ac33003d8013179

    SHA1

    23e3d850afd8d066970dcbd2ce02b0fd6d4451ff

    SHA256

    b0fad733f1038ff6912bcbf8b27ef10dd8d2012833a56771e06271d1f2f60390

    SHA512

    cb45d009aa269baabdc4c26937603092a04f8ba9349b818a397f1a1aa77091f9e9dab7b5914509f25db211b795b5d80028d5bbc081c1fd7cb7eec5cc9e340fdd

  • /data/data/com.easelike2/cache/qodflckjp

    Filesize

    1.4MB

    MD5

    a8938293083d280bb79be703132ab074

    SHA1

    d7ed9b7b6216b82564e1a0138e36b56623653168

    SHA256

    392d65e1170c8924c091479ddd3378aa11db523ce935c2ac85736a37611f353d

    SHA512

    fd3524bc37915499e15da1e55a38b660b302cd03d570e81ab781aaf945a6c35a542fd3aaae89bd5e4a7d0f70480f9f7ef4e2bc072e94ed4b4344b34b37edbc6c

  • /data/data/com.easelike2/kl.txt

    Filesize

    237B

    MD5

    ea74d6664e8c4b0f997b75638bd2b437

    SHA1

    31e52da8c2549662f28eb2f96d33c19a89b95570

    SHA256

    1222cb48b2015f0acbc87fdef73756586b3982f0da6b31348984475eef8c3d14

    SHA512

    1b99f933b249b9ece64ab1df9c94d211aa0e1dc88adbc3b0ceb364573ae0027a84bf9bb364bff35702b346d2811a2be5ef327234906db89e9d0a764cb143d95c

  • /data/data/com.easelike2/kl.txt

    Filesize

    63B

    MD5

    92a148ca23c391dd7f17b6d51646330c

    SHA1

    d410d5eab19fe307a85f9b9e573212e3491bcdde

    SHA256

    54a6f310310d01e8c2f4d18cc05601a165c2a26ece8ebb2aed0ebe5b3b9d2818

    SHA512

    997b385c1776e6bdc319fea84b693846766769d804d572d62e02b67ca35942cf0e739bc98b51227903d120c23fe35cf99ea401a403cfff5d3d2fa221f09bb464

  • /data/data/com.easelike2/kl.txt

    Filesize

    75B

    MD5

    7be7c2696a630c7fb355bdf5c99f4836

    SHA1

    b091e0c9859185c5cb98b4da838f6a34951e952d

    SHA256

    62cc880fa5f44ba0856c22d212a64a506452a4cd62ca02309fb44e0e12908caf

    SHA512

    69c097d15998c6a74fc99dd330ee6bfce83ce774021907809e7d7fae1ba20603e4d298d41b9153b2d799462262fd2b68f56eac7769905744c14bbbd350e4732b

  • /data/data/com.easelike2/kl.txt

    Filesize

    45B

    MD5

    9c7b4c3bcb5afb364c53989162de4e67

    SHA1

    57ded48f886f790e447189ec461e85c4c515f5f2

    SHA256

    da900dbd5da32743c42688cf5e9e020d33717b39e99517e44f13e0df16ef1077

    SHA512

    ea10c4cf33fc775064e1defad0338599a07afd2e60f63b6c9bf1bed255b4385c6534e28d49d615877ebc445d0689e526b1d47265a58742614c0b78827c195906

  • /data/data/com.easelike2/kl.txt

    Filesize

    480B

    MD5

    c22d69cce5ddc1786319881c00b09f46

    SHA1

    cdd33e200024600d1d09f26d7cf1a3c613067ff3

    SHA256

    6508916f4b8b1b16d8eb734733a753ced720233dc705c9da1331d6e3075be99b

    SHA512

    f5a2905e4e33b3f8c61f4a3cea8b2e248a107c7e2baa6c77d5ef508604d993ea78138f1969d2116ad22a8d40a2a74c4b132d0ec6bb6e8c0a6be2111537a92a73