Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    28-11-2024 22:01

General

  • Target

    6c92d9817c150eec54c92b3d716d1b228a20f70179156556b28a35d17e41b6f6.apk

  • Size

    1.5MB

  • MD5

    c839cc344bd5116bd0e9f33752888c8e

  • SHA1

    41ca16487f7d6a44a7c00fcb10742029756f6671

  • SHA256

    6c92d9817c150eec54c92b3d716d1b228a20f70179156556b28a35d17e41b6f6

  • SHA512

    6308523e015baf9bffc70f9a5350b770e354f24610e3242ff6f37e7a5bbb78e2d93082cdf051abd6df589ff1252de30310ff3d3f4e427a20323f8caf4035a025

  • SSDEEP

    24576:4AaJOsjneuS/8hEtISvDkSR9cNPc2yLkPcdSLfw6dmAU7Z0cGffjvMbGnQpv:4AYOsKt/4S9DcNPASckLVfWGgbs2

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.endknow4
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4379

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.endknow4/.qcom.endknow4

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.endknow4/cache/oat/wwfyvzpgtbxxwv.cur.prof

    Filesize

    510B

    MD5

    74489d9477dd25cc0e9f26c7cb94693c

    SHA1

    732c478ee2a287764a8d9f8c8ece7202f8e59b44

    SHA256

    df5f96d3305a937ff4b2ab60c965ae1473339d7817b145dc5e531894a35aec3e

    SHA512

    61742f78d42f1cf9b9529fad3c5a149a4694d8bf69e7e28f3d217b138c4d1a5858fd02b02e156f699823decf27dae4561c33451f7efdefe6a8de12f4314b5ac1

  • /data/data/com.endknow4/cache/wwfyvzpgtbxxwv

    Filesize

    1.4MB

    MD5

    c4e188801fc029ffb6ce76064adb13f5

    SHA1

    5726435d129e02084a0f4c319da55517ec42fd79

    SHA256

    98393324e72d0af3792d666ebf951823bee06fff57b7aec3addb44462f6df724

    SHA512

    3acd2cffcb9d17e95f3e56d8ecb1c3926cf5751538738e904c6ae72dab3bba566ea56873615558b130e5dd10b92d4f0a2b837b3c0ee6a920c03ad19e51002707

  • /data/data/com.endknow4/kl.txt

    Filesize

    237B

    MD5

    2254180fe5494bce535b907d4df431d1

    SHA1

    76a5bd8d14dd78f8cb813dd7164d7bb2b03fa64a

    SHA256

    9a9535b275b0c51a02879fb867b01d8e1725bcd63d0a96f51bc87642b20ee37f

    SHA512

    461da4360ecfd4aadf03f237e9545bfaded4135a92820ad8a1791cb53cb71c3cbeaa58e3dd26b7ffc32da819fbe92f77608586d0fdb3b7a9b75ccf6d5a353dc3

  • /data/data/com.endknow4/kl.txt

    Filesize

    54B

    MD5

    34a9b1723717d5bc9e5400e4b51d30f5

    SHA1

    88889f9dbc49fad2f32bffc378f493d542a004bb

    SHA256

    9521e01c2bff4a34dbd5b5c971bad48a8c907bfe9fca957f046d119d5678d0b0

    SHA512

    1fca4bb93c4cfc8f4f3215713f1b1ae04d5d813f85986cfb063c87ad35d112270f0337cde5fc598cff8157ab54da8a55e55ddcbd898470fbc696e73b280ae660

  • /data/data/com.endknow4/kl.txt

    Filesize

    63B

    MD5

    76db95fdc88ee621e2d72d4d58cafcc0

    SHA1

    6ab519cfebb80f8b97131fac202580b583b4181e

    SHA256

    0e896c1e5b3d0f68db3273b5ef50fcc44d96f52f4e8073e0a63414890c7f7175

    SHA512

    12833d34114fd55bb094492a55ad8d24a482e6721ba36b106e0b2364ff9dabd5cf4bdfa7c33f812b07b93112bb5739f8670b66c47d5045ebd32dce9e668d2746

  • /data/data/com.endknow4/kl.txt

    Filesize

    45B

    MD5

    444ccd2a112171533c6f56f3c8b1a38c

    SHA1

    9af1cff6c77d1a11ecd2081ed22c162af44a7499

    SHA256

    0335e6987acc592379dd598552e4e9b2c589f29d83f896464fb24a23a527f2e6

    SHA512

    34e75d171782d1a0933321dfd17489249c274b2e9ed85beb093d56e390cbcd0b8d48ddc768cd2b5fd9a57672c3b8ba1d33ba24e4d096b2a786f1d537359d72f3

  • /data/data/com.endknow4/kl.txt

    Filesize

    437B

    MD5

    11602ba0b703ec0d57db4e6662f56e23

    SHA1

    8feba11a289f6e58ce5a21493deaf17c50bb6a44

    SHA256

    1b3019de113695ede0d1ca51169e4bf39938f6b042644f483b1bd4d736f30d8f

    SHA512

    1d1b37cc8bc2e10da0c715f14cc899bd5a3665fa1781fe9e7aaae61f3d532d320adcf6ecd74497dc149da9f5221f79f90027a58798682cd769304b50ec4477f2