Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    30-11-2024 22:04

General

  • Target

    1ea9aa4e948fd493094bc7055f87d69f20946e293204e45d9d539a3012181dba.apk

  • Size

    1.5MB

  • MD5

    84420c99dfe780a51c54fc6af04ecc68

  • SHA1

    9df0f59e0eb337ab739de9a0142021c4c3ed83bf

  • SHA256

    1ea9aa4e948fd493094bc7055f87d69f20946e293204e45d9d539a3012181dba

  • SHA512

    fa93ee6aebc61bc1b5527a2d62cc5576ba8b50c4c29de024d70212d904e7ca872f5c669ad161441597f3a0129bb08416f2705884b343bb4df04574b44f109764

  • SSDEEP

    49152:IQ8oTAiPjSRzA3CZe0fcygVSCnyhWTdnYD:QUPjQzAyMJygVS0dYD

Malware Config

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

rc4.plain

Extracted

Family

octo

C2

https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/

https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/

https://pigav233.com/ZTZkODUzMTBjYTA3/

https://tavaekemk42com/ZTZkODUzMTBjYTA3/

https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.aboutlatedm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4320

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.aboutlatedm/.qcom.aboutlatedm

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.aboutlatedm/cache/oat/uwaezblin.cur.prof

    Filesize

    405B

    MD5

    eb371521c8180318987a8f5bd0cab851

    SHA1

    cd9b343709f650d39fa5fd7a18e829c7cff75a50

    SHA256

    afed3792d2ccb94584601d06a57ba1a34605c5dfbfec6cbf0d38ec6d321da3dd

    SHA512

    bc91a8c18b67f886e420b6809dd484f9809ec9005f26699e0b43f8e482cb4df97ad8c280650b40c6cc084b5fe2faee1a56a75d106bad9c760441c177b5e0472d

  • /data/data/com.aboutlatedm/cache/uwaezblin

    Filesize

    1.4MB

    MD5

    95f5d3d29fdebd0918f73f22d327bb11

    SHA1

    33d1757d49881c656e4ace314295b22dcf7b6147

    SHA256

    e56ff1e609c44c40bc1d5f1f2a5e598bfca04b5d84618f4244aa847664f2fabc

    SHA512

    6ab8a3a5478b7e1b6dec1276054fa854b6a8cd26e1214a1e47c30850acd73028deeeefa573167f8ef8b86478251e0a7b66ddf5bc814753105caced46d7ac83eb

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    221B

    MD5

    2d0559e2671726bb908e123a11b17380

    SHA1

    ff403322dca016b45787569641d01a8d119adb82

    SHA256

    8681c068f1ec48f525a6341df52efd15c01428d8a6f80d90335aa132541c8fbc

    SHA512

    49c1be78c051426dbb084872904d4804a8b6cd20cce3a1c2c4ec21d26d955c7443381a3030ebf058d08c5ec7f62d29a72bc2d10fe5682086a8fef3f8190bfe83

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    52B

    MD5

    f40d97994e63740c7fee187518f7b9a9

    SHA1

    884a6cb1f28bd756949eddae8d5074f86c0c274a

    SHA256

    292c47f0b4366b1ee6e9409a38f349d82ef70f2b50e90c479c532978b57b3d5c

    SHA512

    9abc068d509c80f33ec0d12b0f126ffbbab14df0b2e8537e586da37551c99713eefee3082ab85c76bf0f2a532bc62bfc3bee37d52e045184e61d736a61acddbc

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    70B

    MD5

    19f6cc28b7d819e28e9e1e817693be12

    SHA1

    094863d79ea57d73992be42dfefbcc1d83d2b8be

    SHA256

    c7d7dc1e81b3d9e8ab8888cb790975c73611554398dd59fa53e26e0f26c72c90

    SHA512

    4e474038a2103049b25c71b5e7a5ab3bc62a14c20f0d471c2dbe8b96b18657a23a2f3f1c03880f85e379b0e34cf6e59fc5b6115c4c583ba800a2f7a953e754dc

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    62B

    MD5

    03a759213a0d5e513e3f94f967ccc0a2

    SHA1

    65261d80d2744df9e1c19545ede03ac880b71605

    SHA256

    f934a3660e2b42a9d737582cfe5b7caa43b95388ee1fcd1f4ea8a602af244f2c

    SHA512

    74c83dcaa3dd3f9c402256cd28969f60caec756621df3db0138d8a0a627bb944c2f92ba47d79f63a8409780292af316814e099895dc37c63e9eb7563f560e805

  • /data/data/com.aboutlatedm/kl.txt

    Filesize

    504B

    MD5

    153fe13c98a7acee6391df964b833229

    SHA1

    19f0700ccef30ce4f65556681cf596f60150f2bc

    SHA256

    9cc1a876fd95eeae54627619614601f839dcf353cd74ef54c24a24c6a1a1e6aa

    SHA512

    5bb99f41373f94f3a5ef4592d7e5b773e0465cd4079cdd7c75cb47017ef3b31c877e69dfd93460a93444f9e55ded86e07b73e1b01dbecb8cab4ff9b969577c1e