Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    30-11-2024 22:01

General

  • Target

    9cc65b844cb8bdac51d65a431e9580d2c59d524411074599dbc7e30b3c010f0b.apk

  • Size

    1.5MB

  • MD5

    080ae5c3860ca900affc50169776672b

  • SHA1

    93062d0b7109ca0119aceef1022dcd19c95456b9

  • SHA256

    9cc65b844cb8bdac51d65a431e9580d2c59d524411074599dbc7e30b3c010f0b

  • SHA512

    3489490ec57e93cfe4f93f00a6d2b967405830085f7eb552797ece1f0bd670c51896077cb66a1c012cbd0a9d5773127b786111cc49e0286382194bd1ece0a94d

  • SSDEEP

    49152:yZPpT0e7CbFNJHcSmkOP7CysWDPj+u7zQ6eFJ:qfCRNlcR2ysWDPJeJ

Malware Config

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

rc4.plain

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.yescoldpo
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4489

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yescoldpo/.qcom.yescoldpo

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.yescoldpo/cache/kgjdhzfrr

    Filesize

    1.4MB

    MD5

    d76eba054d37bd5d1a6b234908c12821

    SHA1

    31ee2cda7375e008d053c04296e3bea50eaa0a20

    SHA256

    02cefd5fa8cb53a84d3a069a72aa68f50906499b813f3b255400ed61508eb0dc

    SHA512

    d8d8469f878291c366699acc39ba4ee120646b6aa6690fb6e131c16ab4770aa4fca29dc67f988257632933e78a79906b8b8674ad19a01a13b1dfcbeddc0fbe09

  • /data/data/com.yescoldpo/cache/oat/kgjdhzfrr.cur.prof

    Filesize

    417B

    MD5

    4955e33e7a71976fab4f6c6d08e5f094

    SHA1

    23a90347ecfb491687bf932e575336b455243afe

    SHA256

    07692f1cf0948c45d6b8ad0b62ea32e704929d55781fb9c923ecc1a5723f7f4e

    SHA512

    f634232f5297172f5bfd9bc667b8335515ed63603649ad2b18ad659e0e1357d18a980660bb44b136d86f9cc920cf5c7c481601b0fd7b3624b38b07261e1c0107

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    221B

    MD5

    2372be708238a8b6173930950b20cf44

    SHA1

    6882f21942b07fd10e124c65aa5a0b93ce214125

    SHA256

    d1fd74329a1f15953a8b5a0b4c429ab39fb6d0a25eaa4fe6f50ce1cb0768625f

    SHA512

    d093ede13bd3abe3eadd29bbd4e4ddc8f501edb36eba5b53510618bd263f6643b28b923e424ee2f5f2c50fc1b6f7c9c367f3eab245d908c27648b2e0f1dd7a37

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    54B

    MD5

    8d3effd8b0ebc7ad3adc0b88b59e503c

    SHA1

    4f1ff70060da414644857e97f4def7ce29bb1aa3

    SHA256

    fddcf6bd39a55f05db848df36c6879b9abaea2e71a6003c340faa85f9e83fb77

    SHA512

    8e029531a7f8d54b0d79374330ab3c18e985890d844475d18a1295b53f3b3546403eaa06b364f3d464692ee218f137e697845351c729f23a07ffba5875cc4b00

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    68B

    MD5

    8a7d34d8b175ba44cb2f578417549cd8

    SHA1

    cd3bd543bd2c223e8f61af1292a0e9e9b432e66d

    SHA256

    d0e61eb0bb81c74b35e66a881c82f794404759c39c32cc32f36ddbde1aed0db5

    SHA512

    ca871ba131e9af6b06a5bf9e4f3de6bf22b62c071293224e537bada301e29db36eb773aa0ba5153acdbbd045ddda76eb0c033660ea7260e5d940cb8ed081c79f

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    60B

    MD5

    9dbf9de0a5d395912c592a60825ed760

    SHA1

    70eb9da0babc01c3fecfc956fd9e373492e459ce

    SHA256

    238f6dce37ccc60e63c094d64af82b61282996af86ee5cf7653ccf9e9b3dede9

    SHA512

    e54a7f01538872d3a8bcc5df90a16d371f41177c96e15b76514354d01e5cbbba0b6c54844d13639d1d8c7bd8fb2b91c0a2849bbdc8abd937b2af8e744e255706

  • /data/data/com.yescoldpo/kl.txt

    Filesize

    504B

    MD5

    abf7af8f5e38fd2d976eb803b0daa45a

    SHA1

    a7a013bec4d5e5f7f7a4f646ef651ef1fe0a47f2

    SHA256

    920855e22f53b52570a849dd5b639b235f595164bf40df841d67ada4682c3747

    SHA512

    756e3e7968aedeb698ca43d458db580133596de47e8792339986906fcdc4b19cef21002b6f9eea9ee50fd04963a346cc21250e73531bb1086a24ab559f9d30be