Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    28-11-2024 22:01

General

  • Target

    65b564629247e0359992ad83c0f183599d95b9e25492f912df5c81b57c8a2b70.apk

  • Size

    1.5MB

  • MD5

    c13ab92ba4fd50ab9eaf8efe9d5ce985

  • SHA1

    ba3909363274fa5b0afc7b6f578babb0641f1982

  • SHA256

    65b564629247e0359992ad83c0f183599d95b9e25492f912df5c81b57c8a2b70

  • SHA512

    b0d6ea336f17a3c2ab0fdc04920240974c298a9b11c78bb8645edfb8feb157fc81e74151ef8874e2dac28fbac5e100aeda503365d49ca37cd7f6c2921b8c6001

  • SSDEEP

    49152:3+XjrvKXu/nF0S5Czv0QFzrC+WjIor364+:kjm6FPAzvLFz+x8orq4+

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.appearred49
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4304

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.appearred49/.qcom.appearred49

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.appearred49/cache/oat/pwuzretiawbj.cur.prof

    Filesize

    511B

    MD5

    b3077d2272879412d0f05dcf764f7cc8

    SHA1

    e7b3fa71db2df076854527d96555617576049101

    SHA256

    13ca65baf925a88f119fc2501e330d616ecf6e87165d762187fbbe6571e040fb

    SHA512

    5f62adf2aefa1d2cb283da67900c2fff3596200679234e04efdbb9c38af6f5580e7c54325f0ccbc5ff8e2fa36e0c36062adb1a60f1f36fb461250394a0694217

  • /data/data/com.appearred49/cache/pwuzretiawbj

    Filesize

    1.4MB

    MD5

    cc7ded5a6ae1cd1f4ea41564da5f3bcf

    SHA1

    6294879da1a8923068e83328e87836062ca9411d

    SHA256

    1739014400fa0642275c6d3714f32bda8767cdcef7436ce4b546257ad6fe806e

    SHA512

    8d014f8d504a9d3124b58f9941fe561e4b3ccaf8cd6d7e26588546bde5afe454f3430622810d3b7faa819edd266fbf61ca6b4f865c1b56c4d2b8a9e4c4e4a040

  • /data/data/com.appearred49/kl.txt

    Filesize

    237B

    MD5

    06e8ef80a3fab846f0ecab38e14bd2cf

    SHA1

    01ed547f105e1a4bebe313631ddba3e383ffedb3

    SHA256

    98eb14f890eb4cde25181a3f68158b29e88980797b75e6ab5628bb3e43af20c2

    SHA512

    afe0fc694a7c00461ca107d7dc2573c8cb1868c51fb6ea2c5098c5669faf5b0f42b1d20cca10ca6ee93153c8c3df377e3bb719a6f5ad4d46ec2812379f1e7d0a

  • /data/data/com.appearred49/kl.txt

    Filesize

    54B

    MD5

    dd1e03981336029a4a71ddebdd6a5529

    SHA1

    c73bad23b5360746be7a06f1f14d63d475c0cb32

    SHA256

    5070b76d394e83a69735c12d986fc43b0a899028697eaf53263b7cb4f3ec2272

    SHA512

    6e8ff6bf5d7a2cbe8bf5598491b700f85d18aa9137cfadfefbc01d65672a1cfcc0be20dc43c4fef8e874ff5e8bc16f64f5484abcab2562bf193ef50a08c1d91c

  • /data/data/com.appearred49/kl.txt

    Filesize

    63B

    MD5

    9b46176503dc5ebf3231564fb1e97219

    SHA1

    bec12ffd1c733c84c700ce50855a2b17c1f217bf

    SHA256

    2dc40a879809bc853e449decd0da70d0bbecaf1c9c7c510080818ac9c3981bc0

    SHA512

    727a92f6c05cec34f0f5a35eb9fd8cf5d2e4d9bc11a9c6e20ff60e0bcd2675e0795050864eb5397ead8009629cece967a23c07e03beca136483d3f31b79592da

  • /data/data/com.appearred49/kl.txt

    Filesize

    45B

    MD5

    0d567c9d7f669cf8ec0cc285f2fb1ca6

    SHA1

    0f4e22e04ce1964bfbd7c2f318c14a9d834f7dbf

    SHA256

    17a98df3e3a94a1470c1f9db88fd32c10dbf8c4fb0959589ed39089e66dffd58

    SHA512

    d15e5f306011886462357350984f63ecf5180f82bae8720304dae5a37728bf06a5f23db6e54c7cbb8f1dade59ca166e2845d52792080c40b231f321f15120f08

  • /data/data/com.appearred49/kl.txt

    Filesize

    437B

    MD5

    45aeb20f1dbde083eb41a40caad2bd86

    SHA1

    91d9b0783ea518c2a6e154cb7124e5b705275fc7

    SHA256

    d5ce24ece0b80fbebd08e389755fe8d8acbba3baecef3f67fd73f3d5a24e749a

    SHA512

    e8b96f96eada5d4246408b97987e5f2ab266a5026ea063b74a8456dac9290faa815525f424598a648a05b15495243b7c804b8a0d510caa27871654db8568f327