Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    06-12-2024 22:09

General

  • Target

    ca262fc5c87e16122ebf76783f677aebf95b273e4c80f06ff7dd94fa02ee7ec5.apk

  • Size

    2.4MB

  • MD5

    0f80b9fb5992c3dfd664360c19d9f278

  • SHA1

    ea8f74d3fda8411c61cf8db5badca4180a9a9f84

  • SHA256

    ca262fc5c87e16122ebf76783f677aebf95b273e4c80f06ff7dd94fa02ee7ec5

  • SHA512

    c6775133482d01bc10b54b3d1f004c70b0b1d1fcbb458779ca32e3af75061430a317283be506d03fe416b716dbeb0476007be241f674647c084f437c2e0988d1

  • SSDEEP

    49152:dTOxN6K77zb/3Cs0HOdSW5OnKjIT/b3fbqk1qsA1a2yrwcLAyzt4riKyNyBtw6W:Y66D3Cf4SW5OnkOTuwqxIxz+LSB

Malware Config

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

rc4.plain

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.dontwould18
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4523

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dontwould18/.qcom.dontwould18

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.dontwould18/cache/johvbgtw

    Filesize

    2.3MB

    MD5

    472898e1e811913ea5422ce5827ceefa

    SHA1

    ab64a1ebb51d24c4dbdc3190fee51ee2c274ec71

    SHA256

    aedc9bfefb7752e348fa4b317c76fb1a8a9b0686f103777a003687a4f55a1818

    SHA512

    f065810b2e562bcd8fdba2c40c6714803b5997c56ea16cc6a39e921959f23517798609875d9b4d7bdcdee092ec83b4d4a99912436e3cfdafa111d101afb28409

  • /data/data/com.dontwould18/cache/oat/johvbgtw.cur.prof

    Filesize

    415B

    MD5

    aeb61dea51bd345faf6632f94d1032c3

    SHA1

    30b091708d8c7ba62f45848b9667bf1c161682da

    SHA256

    63454d814e5ee731eac1d86c99b491b852bd9fd052a3f034d102438ef58d16c6

    SHA512

    dcb4bded446a08f51301905b70b24bca961dfd8434b23eb01861fd54995b64cf2c536a103f20c52a88443795815ec3097473a8df868438d6ecfdcc81d2e38b52