Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    25-11-2024 22:01

General

  • Target

    3face5bed30f0ad5e80ebb4139fc370a13c2307aca651374a093b82d0b1806a3.apk

  • Size

    1.5MB

  • MD5

    ad0c9346149807b1afad76530ea965e6

  • SHA1

    5556ee475b507b988cd57b5920b026c5b15d07d3

  • SHA256

    3face5bed30f0ad5e80ebb4139fc370a13c2307aca651374a093b82d0b1806a3

  • SHA512

    e20308ec4d8545de4743ebfc8c7c88725280f1d61488d8e9a9654f2a8b729f1b45e389dd9d28415dbac0aea0b17058ed2cfd1eeaa6e3609f83d1c0e6cf88ef48

  • SSDEEP

    49152:Xm33HEh+buwxXB7w+mJQD8r8dFd95tHL2k:s3bL4JQDF95wk

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.gotdoes33
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5052

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.gotdoes33/.qcom.gotdoes33

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.gotdoes33/cache/ksnperkdp

    Filesize

    1.4MB

    MD5

    084a5c8a288464a0abbd81f340ae9daa

    SHA1

    b7f9c921f95d8455f4928e732fd546d8b4aa17b2

    SHA256

    60baf68afe94e2ebad0700bf786e6ea2733e7ff54c092eab07fa9f58e14a6927

    SHA512

    a128261537ddeab3a40baa7bec84958537c2ad998061c9fa0e555bd7c12286abc47e475b4a520dc487c6dd461ebf611f5a28c4ae20a31c6565135ec34700d832

  • /data/data/com.gotdoes33/cache/oat/ksnperkdp.cur.prof

    Filesize

    495B

    MD5

    1377143a69107cd7532c9d2f7201013b

    SHA1

    f2f1f855c8d259e8c77492336780d24642b0b0b4

    SHA256

    7c869f73e2978e4f3313f59d0df5c157ac18ec5c54cbaa1167a4174fa210a251

    SHA512

    918944f93ca75cd06f907d5a8e4bbd910c49d60aae0e6bfe38433f1d805675c86f4200f73fd46f9aa86ae0893a167fa321095737827b291e2cb485bea6f37c5f

  • /data/data/com.gotdoes33/kl.txt

    Filesize

    237B

    MD5

    f7e41c81a9fe4a503ec2b77e20e895dd

    SHA1

    13be78003dd3006922a8622fc50ab107c130bb0c

    SHA256

    832eeb12989964755c35f2d295a902e168d51c893c33b7e96e203ace6585377c

    SHA512

    a64675a6ea6d0e11ef8221dafed7ee2bffafb862cdcc60dbf0327cf4dd39386b0169c230991e1d1b9c1b52aeb146146a8b9efcc6dc2b5334310275b6f420516f

  • /data/data/com.gotdoes33/kl.txt

    Filesize

    54B

    MD5

    a7cc6d0a74d0ebff28978a8606154f17

    SHA1

    e93651a468001e572894bdc17029095630d2c147

    SHA256

    3f1bd2f671fd40d39195f07b00b565d9b57c8c40a1dc8a7969e820aa41955505

    SHA512

    4fa747ebf60d1848b26cbffc2e6e87da5c7360fb8dfb34875a69b1a24bb64539c4b54b148be37d062acfdb861a2db614ed00246f18b25c2543af0f4043f0e183

  • /data/data/com.gotdoes33/kl.txt

    Filesize

    63B

    MD5

    c8c826dbbef2119e5fa74d9cc7c9a55b

    SHA1

    091c1af715b226cbf4ce5ba72127cab6749511ef

    SHA256

    dd0a6dec94e3e39edca0883b0bda9c478793e3274725b7e8b1e8505eb5809e67

    SHA512

    ef82021c570b1b230adbc5e9d366e4832100ac02226dadd20733a650cb30b6e9f80e21af3c5afa6879479b490bc73019d5cd6b5f07ea8b1b8597fb6a754cd6c9

  • /data/data/com.gotdoes33/kl.txt

    Filesize

    45B

    MD5

    b7785f10730b6cf7ea6ba6537b1921a0

    SHA1

    b869c50faf18de3796dd0f70dbfdfd34e9f68c0f

    SHA256

    57697f2149afdb9015c748d84594cda64d321fd9b81f00880cdcd2e190b57790

    SHA512

    4f46a93513db19649edea2c21604cafb021406558344ceac43c3dac41875d0cbac69fa621ee7cf59ec804e22bc20957034794ec8930c468a970dc9b5d641ff22

  • /data/data/com.gotdoes33/kl.txt

    Filesize

    437B

    MD5

    9cb4eafb4d1ee62a51d30387a6ac0f7c

    SHA1

    e196a99bdcf3ff1e107471a089b5bf1cdfc0f04d

    SHA256

    c6bc405fd334bd3fcf8506bf6ffcf301bae1d5927abb4422f0476f4cdb23d840

    SHA512

    a8ad6c25460aa237d0ffd1295170d98b869cb8243f85ac74c44544d962ac4b40a5eafe0c12a6cf0279c1bd9aa08ef993e7faec12cb2fc4767517dfbf534228b2