Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    30-11-2024 22:02

General

  • Target

    dad7ba9945abc42abf048a4590cecd91b5c51bbc346b9587795a29821be9ab5f.apk

  • Size

    1.5MB

  • MD5

    e2823d12476ce7c53afac01265e56b2c

  • SHA1

    73c6cb94037783ba25cdeacda4f444f50f2a58eb

  • SHA256

    dad7ba9945abc42abf048a4590cecd91b5c51bbc346b9587795a29821be9ab5f

  • SHA512

    11b1aa56a971badb7602e14dfaf3c072e94f41de82530cf1a2be6a3e9a9433288201da415bd045256edbbb012d651df415911e4cc57c697641245f90578bd022

  • SSDEEP

    49152:IWV+cVnk3sQOV82+ACQnsBn86HkTgZvaVdxtH/:TXk3s1823sBhtWztf

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.howmiss54
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4258

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.howmiss54/.qcom.howmiss54

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.howmiss54/cache/oat/rztxnirntaaa.cur.prof

    Filesize

    500B

    MD5

    0cd7bb26f362b92841d21b7d2cdc90a6

    SHA1

    afa653f7083ba5be53ab6f04151f94b96bf3daf1

    SHA256

    05031edcf32751112bcf780a3c94cc3ed8ae2770b06d4b4ef5cc7ba83998606a

    SHA512

    32060ad1ae5ba511b9d2471bc6421552872d4a386ef40ea882d14b7e12b44ca6212f46537bff5a432edc0c55d4f205bd3b368f4d6334e85828f5b5a304a05d53

  • /data/data/com.howmiss54/cache/rztxnirntaaa

    Filesize

    1.4MB

    MD5

    dfac427d9e18d2321e341423bf1f23bc

    SHA1

    1431e67686e237527bed2d741d627f7fe54d96e0

    SHA256

    eea4b07f1356de69d2e37b5d5c51d1f68f2c8b64778c29a64afc49caebe1a633

    SHA512

    3fba344243f8f59f081b31daaef7618804369492f2bac3729fae689ebd7545986cf4399312437f59af316f69a35ad1fb220bf107316007730a0ddebd7864f7c2

  • /data/data/com.howmiss54/kl.txt

    Filesize

    237B

    MD5

    82d2dc4b9bb4f6defed7875f58eedaa2

    SHA1

    5438dd0c9cb476edc3942ba4b2f0e2b0d16d0ef3

    SHA256

    49237f9a31cebb356f3e111ac3d8f482966cf70d44784c4a5376f58082783e10

    SHA512

    90981707da960770f16f10e238f0f7b8dd07efaedc1b0c30a479532cb8690501385c67112093b581d3f40ddd7c475f9ee14ce015a8fcd0cfa4ce2f3c1201cb6e

  • /data/data/com.howmiss54/kl.txt

    Filesize

    54B

    MD5

    8ff1534db0db45ceadd9f113a1ac0246

    SHA1

    f24fd8a82c486d7d81bacfa7002a565195b245f8

    SHA256

    59f8bf3da23011bc578e57e30f8bf5804c4992e9c36dc6b03ce4e8e9d98332e1

    SHA512

    d4f4adb7a307f1ce8cda1fab5cc33311b48e85a7c03b90316a3a421241f3571149923aa542e38b973bc85127b190122c2042913bef8dbe39ad3204a2d36734ae

  • /data/data/com.howmiss54/kl.txt

    Filesize

    63B

    MD5

    39e30c42f54ac4c7c9f51f9e831122b9

    SHA1

    509692e85906ac88b72dbea06cfff99298ced47f

    SHA256

    5955cfdf5d3d2ee204ede603b947715221bfc6b90336220a41586959d212ef5e

    SHA512

    10eb063786bf8e45453a76e72d656c67a7eb99060effca26c136517601ea64744e998237a74849f90f1f3a84423aa77e77936e6a931c7fbe0f3ff5364fbc4a0f

  • /data/data/com.howmiss54/kl.txt

    Filesize

    45B

    MD5

    fa0272111b48d019232610c1e702b2d7

    SHA1

    9907ec012a0999f36a1db56aaadf95c925ced02a

    SHA256

    e00c3dc64fcb30e9d807e61522314401a3bcb6b45fd8002e3e90112e5c2fb0de

    SHA512

    ced0daef0fb84a795fa2d6e5a414ac7710c626894fb2cf7ebb380d3623d7c599ff097fe4c541ab8e3dd73fcf54c8720828f34fae55faafe943fff4280b5e405a

  • /data/data/com.howmiss54/kl.txt

    Filesize

    437B

    MD5

    a5690d714da67066f1e18e23b6b19a84

    SHA1

    ddcb5a13bfb0167c9cea1a4c3b8ea15bac1deb9e

    SHA256

    7143acbff55500e7aa5345add7e04f0a4e3fd4eb745dfac6b4a7946eb16fc6ba

    SHA512

    78b1e612d277eaf86096d521b746c7c8aab3e5653b7c2fc6f3ce9dbb6b50509d651c95bbc51629d9cdfddc578406ba0086d1749d736f196975410970cff1d459