Analysis

  • max time kernel
    143s
  • max time network
    136s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    30-11-2024 22:04

General

  • Target

    1ea9aa4e948fd493094bc7055f87d69f20946e293204e45d9d539a3012181dba.apk

  • Size

    1.5MB

  • MD5

    84420c99dfe780a51c54fc6af04ecc68

  • SHA1

    9df0f59e0eb337ab739de9a0142021c4c3ed83bf

  • SHA256

    1ea9aa4e948fd493094bc7055f87d69f20946e293204e45d9d539a3012181dba

  • SHA512

    fa93ee6aebc61bc1b5527a2d62cc5576ba8b50c4c29de024d70212d904e7ca872f5c669ad161441597f3a0129bb08416f2705884b343bb4df04574b44f109764

  • SSDEEP

    49152:IQ8oTAiPjSRzA3CZe0fcygVSCnyhWTdnYD:QUPjQzAyMJygVS0dYD

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.aboutlatedm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4250

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.aboutlatedm/.qcom.aboutlatedm

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.aboutlatedm/cache/oat/uwaezblin.cur.prof

    Filesize

    509B

    MD5

    f3abc61465a05efe4897bd3fc55952da

    SHA1

    77f7a31ccd0e4880115cc414a4df79e92a97df4c

    SHA256

    b746c8e876a4fdb4b5e886bdc04877e73abbb7b5e0d7af01bc87315c79c156c2

    SHA512

    03f070e0dfc801341d3580fa8011f6d895c7b0dad33217ec4422140501cd8e671f22ac8db10710ec83b21d101c50d761e4f58a5a4d3cf7db652c15c8d937ebcf

  • /data/data/com.aboutlatedm/cache/uwaezblin

    Filesize

    1.4MB

    MD5

    95f5d3d29fdebd0918f73f22d327bb11

    SHA1

    33d1757d49881c656e4ace314295b22dcf7b6147

    SHA256

    e56ff1e609c44c40bc1d5f1f2a5e598bfca04b5d84618f4244aa847664f2fabc

    SHA512

    6ab8a3a5478b7e1b6dec1276054fa854b6a8cd26e1214a1e47c30850acd73028deeeefa573167f8ef8b86478251e0a7b66ddf5bc814753105caced46d7ac83eb

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    237B

    MD5

    0854907f87f51d25103140ea4234694b

    SHA1

    f89f4cf5ebcbfeadf930ea9fa6e925a5bb1465ce

    SHA256

    a0aff126343c1db06623367b0bd4ce6956a4a343037bc3f4567821f6a3473de7

    SHA512

    313bcaadf7c813d748679eccf5264498bed8c7e507a929d7e661817f9b0b72d52562fe380455ea66e4245b742997026c2f068cde8e0787d066adf9c91d0c0071

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    54B

    MD5

    b05cd1c617498eb918f74a2df6aa7b99

    SHA1

    6a856fe8a62906fad243e1729fb5f2f0ac907b8c

    SHA256

    e59868fb54816d2e4c8a7956251ed1def96b986be858aedf942a40e07153a35c

    SHA512

    49ee9bf05dd7404df6f5ccd8d77797f8158b56c0a9f923691e9f39520eeada663a75b32c93379bcb160a2b95eaf6e285b1178f3cbd7d1f73f78331bbbc14bfc3

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    68B

    MD5

    bd2946fb6c8584586077810a379bb8e3

    SHA1

    5c4a14e2978b675b0bc669078b603d809007deda

    SHA256

    77c1726bbb96110983900e648c3c103148a49971a531735f45ef9bc3de3b1338

    SHA512

    4b6acf03ddfe7310e2d8a7ff9df368e60bec08a1afe1d8dc0b907cf59b65ff93042c4d86f2468136e1e471079fd93262f20f3d6173aca1de0f10bd73ee3d2a64

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    63B

    MD5

    3f02d564f83033fb02da9f96ee4745c4

    SHA1

    d5170b40a6c8a923319cb2404b0242dedc57dd37

    SHA256

    6e5de3ab6bc28e6559cb9a05030311a5b6613ad945acac3809107dc68f4530cb

    SHA512

    ff4c0af76ff04b1d50485bc49778fb3e1ee9f6d1cf3d84aef23dbb8805c052a2d599e8ade563f0b3223ffe4f81b340c391e9fd615e1150a807fbb009ea84a451

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    437B

    MD5

    b9a15b9af4d0a25363bdc46b1c67d98f

    SHA1

    18f4c35a2d74eeece15108e391e7dfd915f69bf0

    SHA256

    0295f42a59e4a07c890529b4295ded7ec011ae0a65ed0a9b46c1a201fba1fb87

    SHA512

    1def400528b0c0fe45621c1e9fefbb04b0663ce7321facc2ce6d15cdc5ff01bf4756f471b0f342f816a8a5ea09223ff5428b5cfc31bfa9be7d0d13989ea3f672