Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    03-12-2024 22:01

General

  • Target

    81b9ceff94f0f26f25c1e72021cacea668c815c71687b024ce2412e83cd79b9e.apk

  • Size

    2.1MB

  • MD5

    34749ce45603ae913cca3db230b7269e

  • SHA1

    074687b16dbf94af061804b25da305a8d6ebcbf6

  • SHA256

    81b9ceff94f0f26f25c1e72021cacea668c815c71687b024ce2412e83cd79b9e

  • SHA512

    d02f4d72c55e7c95c318c9b719e0e7194ac1b79879da4a071c0c553a481c52fe0851be8fae1db1ad9dceadf9eecde237e8592a225262408cd48b285604e709d8

  • SSDEEP

    49152:E2Mx+tmJJ+K999Y7+dOaP+w4IXTbXmZ218GV9Iz1Zc5GhYCA3xS06:lM9JJ+gWqXhT7t18q9Wgt3xY

Malware Config

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://hayatindonderlerikararver.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklaryenicocugunhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://yasamtarzdunyayidogrutani.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazyollardaumutarayan.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinhikayesipratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://yasaminkavgaveodulleri.xyz/MDQ2MTZjMDhlZDQy/

https://kucukengellerbuyukbasari.xyz/MDQ2MTZjMDhlZDQy/

https://zamaninguctusevinyasan.xyz/MDQ2MTZjMDhlZDQy/

https://gucluklertetekiseyaoyun.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleriozetlemeler.xyz/MDQ2MTZjMDhlZDQy/

https://umutlarvesikintilarbirlik.xyz/MDQ2MTZjMDhlZDQy/

https://cikissizyollaryasadogru.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklarveguzelliklerin.xyz/MDQ2MTZjMDhlZDQy/

https://hayatsevdigiolumsuzluklar.xyz/MDQ2MTZjMDhlZDQy/

https://yasambaglantilaryaratici.xyz/MDQ2MTZjMDhlZDQy/

https://cikmazlardayolbulanruhs.xyz/MDQ2MTZjMDhlZDQy/

https://hayathikayelerinikavrama.xyz/MDQ2MTZjMDhlZDQy/

https://yasanmisliklarvesiniflama.xyz/MDQ2MTZjMDhlZDQy/

https://umutvemucadelehayalleri.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayathikayelerindenson.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.denizbank.mobildeniz

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.spot.police
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4789

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.spot.police/.qcom.spot.police

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.spot.police/app_wrist/EMReEC.json

    Filesize

    153KB

    MD5

    96a625e1a5975f6db704ad4a46ffd46c

    SHA1

    d031979c63ccf3144c3d94346578c2b97c518100

    SHA256

    dbef19ad22a8011069d6d83b42b31e32bea11fead2b7441abf91e8f91bbef3a0

    SHA512

    119876654576af2a07c6190a8bc69ff7c28e04de4cdd871e17b23d0773e652c2221c005688c4619a1ccbe671ba84cbe043e72f33febbc5ca38bd40bb5afcda0b

  • /data/data/com.spot.police/app_wrist/EMReEC.json

    Filesize

    153KB

    MD5

    b635b4cda6f8466bf48d33904ace866f

    SHA1

    1092c805ddf5d0f5e74695422b23b7b7d5afdd84

    SHA256

    1be1adf9bf36a4e69a83eddc29cc36509edc442aebb251af66a363ef935b17a2

    SHA512

    bf26dcff85510a497cdd6d2cec4b026c364f3cba68ec98f8c2fd494ada64be5647520f6080665f0067234a2a0e48d09816ae4586bed4021fa64eef3f16b116ef

  • /data/data/com.spot.police/kl.txt

    Filesize

    230B

    MD5

    1577a2b359226f0403a0b0bd98a13de6

    SHA1

    c28c9bec3807bc33af5c2a30c46550239ef6dc9b

    SHA256

    e245b9d29cd6423d45f70bde09e88e778b18e7d40ea73e35370ce4614b333d34

    SHA512

    ef0acfe2fa441936fe150e4795762136fb07a6ddc1a37e6334c5fb6b55d4ae94ac3f82ae0ef3ca42ca6a5f8e76a039710990828061535b6f07a751645fa08900

  • /data/data/com.spot.police/kl.txt

    Filesize

    54B

    MD5

    c395698b7f8ecb1d054df86cb68d65ef

    SHA1

    eddaed9af0b3c563765fb2f7b679fd786f8b5c48

    SHA256

    81cacfd35fe5059a0eff0ad173574ee3257dc7f510655dc8e45585fae88eab12

    SHA512

    f39efbffcb98e43f95e5dc887b427b4f96531a2f9f315fdebf1478d2d68650930595640e16700d7abb1ae18bb26fa8e892b18c5a27d7d046536bc69df6dadca6

  • /data/data/com.spot.police/kl.txt

    Filesize

    63B

    MD5

    0557a1d0ef643c67b674b56d480acd7e

    SHA1

    2476b325a6d2a5968f32df5edfdb17a05654fb96

    SHA256

    f3fb79676fcd59690b57257c03336ef34dc1166a59593cdda093649285a7e126

    SHA512

    07672bc2dc739bc957abad69c49b5404d5db241b53e393c87b1736502e7a750790b5d29ec1c98195c7a469827cccded166dece63ce47bbd5f6fcdd4959f8f487

  • /data/data/com.spot.police/kl.txt

    Filesize

    45B

    MD5

    56293e84b5f81f6d2e30e140093babe6

    SHA1

    3b42959c98dc64f94220749dbc9a9371bdda7ab9

    SHA256

    e09022dce5cc9355df003a9d4b9bdc78efa95a2acbdc33a30919521bd2c44859

    SHA512

    601ea40be3e15c38ec7bfb6c3ba84905f42677e7ff14eaed3da23525af94be79ce42f105571a3e4b785f8f1fbf8f385b9e5fee5a9e031cc5f2f27b1fb6751e68

  • /data/data/com.spot.police/kl.txt

    Filesize

    466B

    MD5

    e96f7eebf24ee8d31b12b4cf1fbe8312

    SHA1

    992f97d06dea5aa2736a8c5bc988d6c0870b455b

    SHA256

    d76a9e186e312f5934085cf0187f4c7bdc3e8542fd55963ca7d5100e3b51212e

    SHA512

    605f98ab7932a5cbaf3f2573c20448927dc1079fe40c327756feccc1919361b5eeb1b1657bfa23169caa349e921f825765a7d94ab4b2596dbc5c068be97675a9

  • /data/user/0/com.spot.police/app_wrist/EMReEC.json

    Filesize

    450KB

    MD5

    31cb5951ae75cb866bc6a3781f780891

    SHA1

    76b88b9dc76f57789dc854bf6633ed12964b4629

    SHA256

    1af9c50df10643cff663a8e67a3e62d32fdf029343491bebd18fd1f22800166b

    SHA512

    5e333588fb061982ac9b222f7a3eb73df3ad4fac44b8411cfacbd26d2d9a929cfbb6c3aaa993895b79da6d998fbcac8cb2bc9f47c1fdfa560db0d31599227234