Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    30-11-2024 22:03

General

  • Target

    7d0c1ca856ec2df1f378a50ffc511bd5db27302cc47b19742b1270ec6f05f08d.apk

  • Size

    1.5MB

  • MD5

    090c80b5bd5af2f24a22ef9941ece16e

  • SHA1

    8d5670644d9ad2f3e3a852f106acea62cb7d7802

  • SHA256

    7d0c1ca856ec2df1f378a50ffc511bd5db27302cc47b19742b1270ec6f05f08d

  • SHA512

    9b195fcba812ed7acc126080583be9f677bf939ae8d82727470859512902704a48fd856520444da8bac11b8a333e01228cdcc7e462307f5d11fb702557506618

  • SSDEEP

    49152:R883hhWduDZ5cc8IgS9++Z09CFC9lL3INbQ5Ma23:Hv+a5h84RZ0MkB30Gc

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.heatever8
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4796

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.heatever8/.qcom.heatever8

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.heatever8/cache/nnokhkjt

    Filesize

    1.4MB

    MD5

    a2ef2ae7b578f4b787cef436cf060e39

    SHA1

    5ee36e519d336f5953979b4fbc83124d990ff968

    SHA256

    7fb905d0d58666278afb0b97c1cee8f9c5aee8adf6da813242e369ed33788f03

    SHA512

    555f4ac5f972cb20a05745b084b4c33c3db2ba2b2c7a9a38171436cfbe8a4d58175b5f80e650d4c828a814fd1fe151268400fb465d0ca1db762986e815e12e81

  • /data/data/com.heatever8/cache/oat/nnokhkjt.cur.prof

    Filesize

    338B

    MD5

    d947754ca2c992b6a2568850607c7eb0

    SHA1

    49b448049378e2ea4e54ffb6d296ee4da2251284

    SHA256

    9d197b79e759b5541fd52e2c40ddd181718c616d769013437c166006612d9fdf

    SHA512

    14a5e3d2cfe4a1304a836a8e459124277a123813e1af1c87d9fa99e5966557e2cc829a69b5c06344fd2396bb2bc3ad30197fdddebe8a2fb65adc602e1ff01c30

  • /data/data/com.heatever8/kl.txt

    Filesize

    237B

    MD5

    aca1d572844414a1e72c2d62fbc8a588

    SHA1

    a4adc248b2b950c308889f598bcc7d72a92b02ef

    SHA256

    aa1a701e8e1b9e9adb29ba75fdbe2e1e0e9306bbf55750d827dd27858ca7ae80

    SHA512

    f6345201e9e3bbee4a9e09a786febea608701b2a9e244203335c0f2909b0c53ad1eca4194168c34c903eaf27cb56e4e19c7c29b1ee68bfe14d279f75f616d1eb

  • /data/data/com.heatever8/kl.txt

    Filesize

    54B

    MD5

    b9767beb3c9e286dc741b644c725aa60

    SHA1

    bde0f80df86d8e3a29204c18f86ba6e2866d7fd0

    SHA256

    264d96221ed168a13f4ed2f777d8e2273aa0539dc0d46dffe475c17925f90163

    SHA512

    1b28d39db22b591abe76e6c65701649532908fb8de7b0708c2965b0ae88c6ffd80265e62b37d3fa36c2f3bb8c92464577e3cc35a60a3912f90a3a0b0d8c2fab8

  • /data/data/com.heatever8/kl.txt

    Filesize

    63B

    MD5

    8936c67f8062e1dd3b86f3a945c5d2b1

    SHA1

    73aec02c4ebc979a240e874eb51f44d1662789db

    SHA256

    30c86e92bfd518f202a4be738b34402c744cd26f6e03693cac3aea27ae7e3c08

    SHA512

    0c99347052ac43ffbbc996fbe2289e350e78b2eadaf7bfc0bf1b00e5171a7b5e2357c1817c8d8874b5d0107f2efd945b092b2fd10056e1f2b25415f677947e93

  • /data/data/com.heatever8/kl.txt

    Filesize

    45B

    MD5

    c48e77d313193bf3f004f295b8e95ca2

    SHA1

    288e19c2922029510eb10451b7a2979e73068291

    SHA256

    d1451197d1db7b14463278154e7ca6e1eb728491518d999b4a8af47bb605d26d

    SHA512

    6e58cccd85f234ab89a02f8dc2cc7d2f002d6aa3635a4707fd5909d72870f6404b2770a6f69b743adbf66bd0ce89c702d4f2574a34c4fe1454804e1664f0bbea

  • /data/data/com.heatever8/kl.txt

    Filesize

    480B

    MD5

    f6c3ad2af63f4772ff60fee160219060

    SHA1

    d3db1367e59f1f6d3eeecb02c6fc67b477f82196

    SHA256

    16c6484c0d51c3a8927b61ca47928ae37022cf40c594d9537521a4dced1958ed

    SHA512

    8a186c18611babe2606b65baa2d9ecbe3424e124a1908b6d9076b0481a3e5658f4bc6cf57bb8b1b00c148eded10d2ffb6f21b9bace8c5e7f8bdd0ea8b3eaa42c