Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    27-11-2024 22:00

General

  • Target

    5617835fd088571fce5f3ec31162f327fe4473db733d1c02a568c5540e683675.apk

  • Size

    1.6MB

  • MD5

    76083059951b001b2b26d6bab5f21dc0

  • SHA1

    16d730c396e465935c85bcefa18c5d3fb89d951f

  • SHA256

    5617835fd088571fce5f3ec31162f327fe4473db733d1c02a568c5540e683675

  • SHA512

    e59a55e328be293b5bde09f53503151ce496766ffeb5f39ff719853a589bca7286a6edb5d5103231dc0bf88d9c9cacfa4ca3c3b1e89d626663c562b891e23742

  • SSDEEP

    49152:JW8vna13lDTWMgBoqrnAtGj0zuCjKyJ71z909V:ZulDyMOjDzjG1Jf0L

Malware Config

Extracted

Family

octo

C2

https://roskingming3333.site/MWQxMmUxNmEyYmU4/

https://conmonroskos2241.site/MWQxMmUxNmEyYmU4/

https://roskifavvev25.site/MWQxMmUxNmEyYmU4/

https://ro5123rdcrosking3333.site/MWQxMmUxNmEyYmU4/

rc4.plain

Extracted

Family

octo

C2

https://roskingming3333.site/MWQxMmUxNmEyYmU4/

https://conmonroskos2241.site/MWQxMmUxNmEyYmU4/

https://roskifavvev25.site/MWQxMmUxNmEyYmU4/

https://ro5123rdcrosking3333.site/MWQxMmUxNmEyYmU4/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.heardshowkw
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5067

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.heardshowkw/.qcom.heardshowkw

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.heardshowkw/cache/oat/ogbyiydhwmqgdfm.cur.prof

    Filesize

    486B

    MD5

    14817a7e7c91d68494d770e21c2b5cb3

    SHA1

    ae10b9c949d5b53f77d9de42d887cbc3ce409c61

    SHA256

    2e66147856463e61ccd7c433145a2438a0996484a1eb327befc657bb543d338a

    SHA512

    e5e7e3992648689dfef70795416a8d4273d7b3af2f44ec1ce7d4f47be0886aa18a361042c3cdfe969d3f2aa6ad7e14b9c06d5058151fc21d561b644a41c429cd

  • /data/data/com.heardshowkw/cache/ogbyiydhwmqgdfm

    Filesize

    1.4MB

    MD5

    8f98ba09c557005a0afcedeb660cf56f

    SHA1

    045d2fd3feb62f13a59ed6d41c3b395d1de8b50a

    SHA256

    31767fef80ec4e0d63c6426a63df76295a30f6896702f07c886ff2bba0deb770

    SHA512

    8f736d8cb1cdf97f052cc4fb32fa603b190da4d8fa464c9c3caad761a204db64ef971b232be177d6342119afc0b807c923ec653dcddfea9403cdfdf8ff75c49d

  • /data/data/com.heardshowkw/kl.txt

    Filesize

    237B

    MD5

    c9b2d8771df2cf689d8f5acc8b01303f

    SHA1

    4112819597a4cacd5043bad9416dc479e1a8843c

    SHA256

    7d27b3ee917df17a914f575a544fcc4826d0761a06b3e049668b9bb8a3a5137d

    SHA512

    ab7fdbe6284d4826897e34268e0a5ba601318e79732dd6a01223d580e0a53973ecad6414602348c0a1acae15b8ba9d3b699d40e70c5e701c44cfc30b316c4925

  • /data/data/com.heardshowkw/kl.txt

    Filesize

    45B

    MD5

    5cd93b713656c7dbf8ef5a284c4410d7

    SHA1

    f53e29795aae1a61bbadcc490a125a2270b71b8e

    SHA256

    d1e1d81cafab8c17b9a2755f7ea127f61e5624d773a3b8cfc21cf086caa06745

    SHA512

    b064c11293839a35bf4366c3b612280b9aa88181e97f2020fda9bf02fb429a116acc1572d90f4d35dbd6528bba59b86a1352b37d65fbaeb9f1ffde6f488ed7cf

  • /data/data/com.heardshowkw/kl.txt

    Filesize

    63B

    MD5

    d92742f92730354c14e4e17d9ffb6dcd

    SHA1

    fcccc17277f41d6885d17772acb0b821c6642a88

    SHA256

    fab069b0bb4a87dd453d9d1408f1be2b62c95d3474d902c9a40e059ab69aaf2b

    SHA512

    c99ad51889978cdd65f42c79f9bd0cb1a55c6aab28cf76889c4ee693373465f510b041debc30e3daac1ecf44cf6be76b0d08a1710e6969aeaacd36f9f9a8d9e6

  • /data/data/com.heardshowkw/kl.txt

    Filesize

    45B

    MD5

    5b5cebb9c569679c8345c218c84056a3

    SHA1

    813986ea722a65c237540f6ec507378f44641540

    SHA256

    4cc3a28c76261ece75c2378af723d662dd56daebc4c66dbf76d7454a647469e3

    SHA512

    78310769f29dd8e1b2961e7acc9c372250d4d6b902d2078b1277c643830b0c8281810f2c6de7851c73d241cb2aad386c3ab7333d3ddbebdd02d11017b1e93e43

  • /data/data/com.heardshowkw/kl.txt

    Filesize

    437B

    MD5

    aa79527a88525d798029ecd2184d947f

    SHA1

    d48d452e27a9e622fb1efd48ccecd76832b90ada

    SHA256

    b22dc8de710c726254da329d2306b9dcaf0c751a73ddf75eaa4632db7abdf872

    SHA512

    dcc417cd29c1c4ff16a3547ae17bfeb8e44e4c1991f911fdb0127a3aeb43654e831ebc1150a9b49184efd441e9e22df82dbaacc8d2836b0046f871533f2f3d55