Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    30-11-2024 22:14

General

  • Target

    748705959a5909db7bcb39c68416c05d6d7b05bdc3311b7151c0f9b71889e67a.apk

  • Size

    2.6MB

  • MD5

    f96e2d1433d8b4adceaa2d8b036db14a

  • SHA1

    bc597513b199c6a4c8436d74f3c6714376040c9b

  • SHA256

    748705959a5909db7bcb39c68416c05d6d7b05bdc3311b7151c0f9b71889e67a

  • SHA512

    1cea28284092598998cc48b0297ec07350e2d4d861cd63128cd4cc3ac98c0c3b4cff645ad9ecc5d111ea67e15bd8546e6adb2ba7ebe80f43696d6a1d2557d249

  • SSDEEP

    49152:z33Cfh/Ie9tWJI6/wruLfAVRC82SuPmwpUgFETXLxuoADwxkvIrPgof8JSSvLqSt:z3SJXt2JrzAfCYomEUg2TbQo72mgowuQ

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.denizbank.mobildeniz

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.envelope.they
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5204

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.envelope.they/.qcom.envelope.they

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.envelope.they/app_slogan/tQDoZYC.json

    Filesize

    153KB

    MD5

    1feb5d9b0396252b4e2c6228cae568f7

    SHA1

    a031855244d5ffd9a2a4605580073912e0b1a0f8

    SHA256

    88740300de55549867954ffd92a5f91f5178a46bda063f9b4501e989888048df

    SHA512

    64bd9c9d453d2700c02f4eeba60946c1c84dfa75705935a37cf2f18a6119f83d1ae474643ab1bd33366c26d09310e00b60a25c2b2b21aa61cd20016e63bc214b

  • /data/data/com.envelope.they/app_slogan/tQDoZYC.json

    Filesize

    153KB

    MD5

    7a47093f133cc20574807f728afac478

    SHA1

    90936ab70f75211e4e1ab9f346d0400061c0aa81

    SHA256

    e75508875faad6aec6510b3e89423746f62375e46a00e691864b49df53f74b92

    SHA512

    c2dcc397329fbda2a4f46cb4a7c01548be936a63b1edb597d4312636274af41e2405dc6d7a1afcc6db355ab7f7d51eaf3d2892598e9e9e1acfba327e7a3bea7c

  • /data/data/com.envelope.they/kl.txt

    Filesize

    45B

    MD5

    2d005ff8193a868158e96de8076b05d9

    SHA1

    43272730591e73861188d6b3852ed88918031118

    SHA256

    bf68f2ca1acf9293fa1dc7bb1169072947dc17b6dfc30f059d969a124342d7ac

    SHA512

    d088b586c5484bab3a9abc20551571866cde817be105c291d138e2e6a303b3a6c423228e0508b9645cd67acfa859ae5f550ff8cd196872b5d92698bc1431fa95

  • /data/data/com.envelope.they/kl.txt

    Filesize

    66B

    MD5

    477bcc86ec2e506e4f22392afad751dd

    SHA1

    45e7f8862558cdd5b68f1b52a7e41852614f1bcb

    SHA256

    9f8073fa352e293156d7cb9bf1a913e7211bbdb1b410e14f8c78b67c38abec49

    SHA512

    8c507e6a3b63e4b6af3ffc0e0cc2825644dfdecb094464aa420253bb17e6fb3dc310f7dff17f477a1d69d362ba748a29a219a43743910f5eeaa4c252c488483b

  • /data/data/com.envelope.they/kl.txt

    Filesize

    45B

    MD5

    bf0ac5efee9a5ab0881b3061dcb4c640

    SHA1

    bb88da7ab059c1dbe7c3e31f6115cbf9415377a7

    SHA256

    be279784d4cf94a60dfe5fd8d43e62e21253cd213d1a5234abdb57287544f3dd

    SHA512

    e2f9c9b92ad6d30a55bf21be1db393127dd3f71ee63cae82a82cbdc9057a5f1a54cc38af8f9310ec02f27efe9c2781eda5dea78db8a49dc8b6105dce08683b47

  • /data/data/com.envelope.they/kl.txt

    Filesize

    84B

    MD5

    66618a4531eb994241d93dce91417044

    SHA1

    6f10d433c32aab7bd4e9fe0b1bb5e49e38909ec8

    SHA256

    ec8d8921283acc1978664bd8f68cadacd9388dc63f91db3ce400df90e7b89cdd

    SHA512

    b4c86ec40fb70f50d24a5a515697bce3a2c1021fead99c6c78c9ab26b51951ddec59d0a7ac5b4638d6fed524763c361eab6b867aa9eba7aac16eaf8cfc7f2582

  • /data/data/com.envelope.they/kl.txt

    Filesize

    68B

    MD5

    c39888b98ef4930e3c31e2016325f31e

    SHA1

    1819b0b055b83cc26a1f2520d5312a847f96177a

    SHA256

    b3a66821ef17a07c8c62180ebdba7d7c690f607b8e432d114d1780113638950b

    SHA512

    ba04175a29515869eada1056da3d6704049622ebe05e8c8a8b9fbe20998b336b9fc95ebfdc7cacb406558d662b79d50ee30a7eae505ddf0145e24c265ea95a33

  • /data/user/0/com.envelope.they/app_slogan/tQDoZYC.json

    Filesize

    450KB

    MD5

    d2d7f6ffdbe905b09ee5eded7d8053fb

    SHA1

    d7d142d92402c7c2eecab7ca7b28a54e4c6e38ef

    SHA256

    7d23abb92e467af1fcbfeb67df556fc5a0a1cb9b2c9a15358743563410162906

    SHA512

    d922c9bf316e7f91abff8309ea654e9bb5a5d2f2f2d3c64c84944d0c1fc627aef120c7ec8f58fb668487401a80b2e722c0972a87439c82ab05a045b26c82822e