Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    30-11-2024 22:02

General

  • Target

    dad7ba9945abc42abf048a4590cecd91b5c51bbc346b9587795a29821be9ab5f.apk

  • Size

    1.5MB

  • MD5

    e2823d12476ce7c53afac01265e56b2c

  • SHA1

    73c6cb94037783ba25cdeacda4f444f50f2a58eb

  • SHA256

    dad7ba9945abc42abf048a4590cecd91b5c51bbc346b9587795a29821be9ab5f

  • SHA512

    11b1aa56a971badb7602e14dfaf3c072e94f41de82530cf1a2be6a3e9a9433288201da415bd045256edbbb012d651df415911e4cc57c697641245f90578bd022

  • SSDEEP

    49152:IWV+cVnk3sQOV82+ACQnsBn86HkTgZvaVdxtH/:TXk3s1823sBhtWztf

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.howmiss54
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4456

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.howmiss54/.qcom.howmiss54

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.howmiss54/cache/oat/rztxnirntaaa.cur.prof

    Filesize

    406B

    MD5

    05d91340412f67f82532d2f511fc8ec6

    SHA1

    63ae642806da166de723fca9cd7c6c98e3a3eca7

    SHA256

    50a3c17a686188685404ffd089a80616108b1bb3376643139b249c9894b72522

    SHA512

    d7108ed68feacfd7ca56c5f2b430a5cb31204e90129c765f9bcf24d6bd87560e0c214ded7d530eb485d196d182836a3340d7940b9b66d755c56960e6145d727a

  • /data/data/com.howmiss54/cache/rztxnirntaaa

    Filesize

    1.4MB

    MD5

    dfac427d9e18d2321e341423bf1f23bc

    SHA1

    1431e67686e237527bed2d741d627f7fe54d96e0

    SHA256

    eea4b07f1356de69d2e37b5d5c51d1f68f2c8b64778c29a64afc49caebe1a633

    SHA512

    3fba344243f8f59f081b31daaef7618804369492f2bac3729fae689ebd7545986cf4399312437f59af316f69a35ad1fb220bf107316007730a0ddebd7864f7c2

  • /data/data/com.howmiss54/kl.txt

    Filesize

    221B

    MD5

    406ed2d5119ddbaa04a814f32ea5f38f

    SHA1

    b66364fd646dd202876b87a0cb2be08cfdc00b51

    SHA256

    1481604744e269f0dae7e34849f23eb7a28caf45ce27888bacd94489520adef8

    SHA512

    db5ebaa1ff024020f4a43f1037902e92be47c826d4af22160b66b6dbe1060b9a7750ace528f191757c9883ebb17bf33711497a36d186ab4ef55e507fceb03671

  • /data/data/com.howmiss54/kl.txt

    Filesize

    54B

    MD5

    c48edcc42e15625e2eae345891439ea5

    SHA1

    02ffdf5138c1f5f54205e2117990414d63e76c9d

    SHA256

    676f5868ce1b5d8398844acb1000f50d74c842a270d4c331261cd5a519e15d91

    SHA512

    39caf2b31f0ec7f6e08be2c83afddf8a3418d99997432defe6ee23777157e89b39d734515cd7af50c4253147c25329503b2dd0b2f3cd8e9c80d68679f43f9a8c

  • /data/data/com.howmiss54/kl.txt

    Filesize

    68B

    MD5

    428db8b2e5391d2e08270de25004f7a0

    SHA1

    1eaff10928e2900db8c2948846701a01c98d28a3

    SHA256

    f3996f832f019566f9eb5db09bd307c4efa80c47e8dc72793f278aedae10906a

    SHA512

    781c9dd59e7986788d1a7d743f9983f5048933ec8e7b1247b486d7e9d0e9504be957adaf22de541cf1a6a24d8305107b5cde674fed4a299d9cdf592c63c6b603

  • /data/data/com.howmiss54/kl.txt

    Filesize

    60B

    MD5

    424c05d21bd1ad01242f93480613dc24

    SHA1

    9112e2f40f3a67f86a92a50b5e6fd81a116ecc2d

    SHA256

    f385dc8710265525661afc0fddc89de485c10a95cb82929574dd56c1c9b45853

    SHA512

    ff98f4d4b1045f946e0677bccaf07c9f4881ed43084f418827e644cda9752d21b5706428981b88424db30776ddd328c10b72aa5e5fe82b765797e1dc95ae8b24

  • /data/data/com.howmiss54/kl.txt

    Filesize

    504B

    MD5

    1c4658c9c31e0ea166025052a135c571

    SHA1

    8cf6bbc1f9186ee4e358c53a0150e60ab11ac758

    SHA256

    2da4e825e0c9b438ad61bbf60474a31bc353c5b999c453eba0aba6aa6867bc77

    SHA512

    109be26eac3dfcebdf8eb2cc7b1a8484e257340c05463b5edf90e2ea32438e78991932c3a10b0067475623ceeb597ca28dfaec790e7668b93763774f50588a5f