Analysis

  • max time kernel
    144s
  • max time network
    137s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    06-12-2024 22:01

General

  • Target

    5b5265f2d0ca0374297485f80f6633db8d54c4a729bdaa39b48ef687651d1ddf.apk

  • Size

    2.4MB

  • MD5

    e91c0e6c6f2854800e71b1cbc56bacfb

  • SHA1

    65a0a496af13218eb3b9f4745ac4c2144c459eca

  • SHA256

    5b5265f2d0ca0374297485f80f6633db8d54c4a729bdaa39b48ef687651d1ddf

  • SHA512

    6240f8c66ce2d1bdf9a02ea39457fa44c465432bc595bbf7a70b457138890a50460e30cf7369f0d35ac96fedfe86f4941dffc692420022fcabf959536a1ab450

  • SSDEEP

    49152:maudEEzv4IJdXfyuStJdvyvqUEFqN+MXzLkik3dMkZUxxULH:y/quhyUEAN+S3k535ZSULH

Malware Config

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

rc4.plain

Extracted

Family

octo

C2

https://weiston12858yw318.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3182.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3183.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3184.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3185.com/Njk3ZTc3ZDVlNmJm/

https://weiston12858yw3186.com/Njk3ZTc3ZDVlNmJm/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.commonideawym
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4338

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.commonideawym/.qcom.commonideawym

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.commonideawym/cache/oat/wvwznqnkfwnk.cur.prof

    Filesize

    436B

    MD5

    e14d0b946682b229506ad5f2dc372208

    SHA1

    ae5ea9dc35d6f2657c8401fc6db648124c6bd51e

    SHA256

    efce64dfd97c9e8373b222c8000bc159865670d8c0405dc665c23dec96d85e0a

    SHA512

    9097246c600ba2fb651a0b4b644d13ac972db933becb53872e2c6cf7e11c1d86bb78c8a885d27e52f61764b674a7971a06a266fc6f048cae04a98e401ae5f746

  • /data/data/com.commonideawym/cache/wvwznqnkfwnk

    Filesize

    2.3MB

    MD5

    291b43e9dc8c68cf9b25c5ba358edf3e

    SHA1

    587d68b5f79ffcf60c58fa17d6207a240a966e38

    SHA256

    0b728ed3eb16796a4d0f8b205b180ad01adee737dc070a85fd1107d4abcdc8f9

    SHA512

    23e4d6fa61bdeaa420659796275778d46b1320d966609ea870574d129f4edc0c5c18a5c76c44babde89fce9f287e607303ab3bfcfd24dfedf30c4adfb9307c4b

  • /data/data/com.commonideawym/kl.txt

    Filesize

    221B

    MD5

    7d119aa8bb92af7e85f649492542beff

    SHA1

    7c53b88e3f1ebff7e76c41cbdacac22992930ec9

    SHA256

    12f0c54b658b3f15e1979ca4de449859adc5816713eb152b064cdd6db65582b0

    SHA512

    0cce90c114c9d9d89ce807ee274ac34818d71b4daea4552935003a2e01772c3dc700d53ab6ee94a990740b78a617ccef52e7fca828efa76036abf33e05b1a1c3

  • /data/data/com.commonideawym/kl.txt

    Filesize

    52B

    MD5

    7216be2fdf869d8e9cf32bfb408def64

    SHA1

    5f32e1831028bd501caa2ef625065a7680c83ae0

    SHA256

    7a2c089509ea7e7f255808f13d3aced5c160a15adf2a3c7737061e9257e35582

    SHA512

    a65c33540cd439fa965fdf3da3c8aa6fbf5ad63c96946bb2209972af9979ef985a631f6cb6e052cbfbfcf402cf0df0526040dc3d90588caaf8487ac3fd539c61

  • /data/data/com.commonideawym/kl.txt

    Filesize

    62B

    MD5

    03d3f42ab4df1f5c9003e691efd06cce

    SHA1

    5c1c9285e07cee36557eeb0cb637ec665f398bbf

    SHA256

    5a034ccb3edad857af3eef73e8797a7c506a4032dc6ce12ad7622091eabf9287

    SHA512

    8f9bdde0893dcaf625fd79fe00be4bd4397fb8a43615c47512126cfb61f2f9e05be8f0a83815d96513ed5ed38acb6ea6ffd029529e11878dfe1c34a9f9c88874

  • /data/data/com.commonideawym/kl.txt

    Filesize

    70B

    MD5

    4bdd98e88f9370a50e62ef86cc9fd092

    SHA1

    a167214baea9ea5eaf5d8ad0a1976e1c9205fe18

    SHA256

    a1dd544b324a317463c81ddbd750ea3a0fcd926e5652638585a9b0f5ddb04307

    SHA512

    99665604a2421fae99d4b602f9e66b04cae00b3b59931dc459063ac660dc2e0813173cdc33b844bc213b950a210f475ff4e5d1fb27209824e4a8d3381819e865

  • /data/data/com.commonideawym/kl.txt

    Filesize

    504B

    MD5

    b09c1e0bb53b760a29de575a8f83a0f9

    SHA1

    94e0c45a279dd49f5ee63a2c1d389cb6d613f167

    SHA256

    fd4b5d1331564211ff43c63c81408c2cd8c3074cd9a50a08e6e27d4a41305102

    SHA512

    bd0b2683a6bedd85631ca9cb25a55a36f23c1791dfff9d622b8e24487cd67c64de5538c31f7c802c5508e66cc084a75876e50249f2b7409aa33a47ed600e1379