Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    30-11-2024 22:01

General

  • Target

    9cc65b844cb8bdac51d65a431e9580d2c59d524411074599dbc7e30b3c010f0b.apk

  • Size

    1.5MB

  • MD5

    080ae5c3860ca900affc50169776672b

  • SHA1

    93062d0b7109ca0119aceef1022dcd19c95456b9

  • SHA256

    9cc65b844cb8bdac51d65a431e9580d2c59d524411074599dbc7e30b3c010f0b

  • SHA512

    3489490ec57e93cfe4f93f00a6d2b967405830085f7eb552797ece1f0bd670c51896077cb66a1c012cbd0a9d5773127b786111cc49e0286382194bd1ece0a94d

  • SSDEEP

    49152:yZPpT0e7CbFNJHcSmkOP7CysWDPj+u7zQ6eFJ:qfCRNlcR2ysWDPJeJ

Malware Config

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

rc4.plain

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.yescoldpo
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4281

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yescoldpo/.qcom.yescoldpo

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.yescoldpo/cache/kgjdhzfrr

    Filesize

    1.4MB

    MD5

    d76eba054d37bd5d1a6b234908c12821

    SHA1

    31ee2cda7375e008d053c04296e3bea50eaa0a20

    SHA256

    02cefd5fa8cb53a84d3a069a72aa68f50906499b813f3b255400ed61508eb0dc

    SHA512

    d8d8469f878291c366699acc39ba4ee120646b6aa6690fb6e131c16ab4770aa4fca29dc67f988257632933e78a79906b8b8674ad19a01a13b1dfcbeddc0fbe09

  • /data/data/com.yescoldpo/cache/oat/kgjdhzfrr.cur.prof

    Filesize

    483B

    MD5

    d4b36143d730fd5711496c1ed7e23ed1

    SHA1

    4deb7f1aafc33b9c1348f106f6ae8cc4ecad91d3

    SHA256

    e005af9af066e3ab37f349c39e0523d783f7428a696493475764909ef1deb64f

    SHA512

    727759ba521c187c5d251e330ec15b3b69605f379b421be5e5dc9ed0b34c012f30c20898b008a6ec1be73cfeeaf3f41ea3bdb9f2a38136cbab0867ad81421167

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    237B

    MD5

    a551a0f2a04748f27498e8413cf3d343

    SHA1

    a946d1c9d1b7ee4950978aa7fbfdb88532bc223d

    SHA256

    7fc60363b5697695ad6bbee1b61ef71b3890dd4256964d89d503a37825deb186

    SHA512

    e3c16065d791bfefaaf1d28244734151ccd62818c0a7e2088562c603b2e7f8b026a4e7d74e957d0138858e2069c77027822274d20b6499d0e92367827ecd842e

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    54B

    MD5

    fbfdccf696b4750bbd82a6fc953ffa6c

    SHA1

    cf7f9d791302b285599b6080bb6015f991ffd3a1

    SHA256

    60f501dfa349564c98f7837dec85a3ff9283998ca76f88868c644bd324c58bac

    SHA512

    a7d472087d2b06c0a104a55140af17bbdcfe95c139bbae7a7667fa001bea4e576891de7d99b6d458a223def9e92e93dc5fa90c563c7510abddbde1ea21e97845

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    63B

    MD5

    e76aec6f512cfefc423ef27af6be82db

    SHA1

    fb000bb4e159bc5e1751fff4573c3c4b2848254b

    SHA256

    99b98d314c0728597def4429b915d72026bf6d01cd6df615f97bbcd4f961b34f

    SHA512

    2148a84b861f7ad461691d8555a87f1ad9cfd4845ab43bbb5604afa33dd5b80761bc2713f7feab2fbee6358d47a5d2f62ecc513d16712eda61fa8fd862e36da2

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    45B

    MD5

    78ce749ca3066db0f4be9e27407b0095

    SHA1

    a0837e146369ca027f879eadcc2f7f7575ae4f0c

    SHA256

    e93753cdb0c4b18a1e95db5a3e83855ea71653c6fdd5986fb5ad53afd65089f3

    SHA512

    aebcb8a7a48d7e03867fec70054fe29629d1e84c9c4e9796df3c0a1fe752c9e1544a986e180a5e17a3c9a55a763675defaaea77a018bfeb1e475d28d1b11ad69

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    437B

    MD5

    d1702901ea64e3a381a54e33590273fd

    SHA1

    a676f028eb687da278ea8d3323ec3584dbccd654

    SHA256

    a5a9e4054dd995c6bb900955f814180123cb5dae65163ef1296ab080174782c8

    SHA512

    8d5228b304ca656765f13e5a9d76fde7262f1a254e677ed8566b756503e62d4a28455bfcc72804f599c578f169f094841bed13a9b5b57600eb5be511b449bd6b