Analysis

  • max time kernel
    73s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    06-12-2024 22:00

General

  • Target

    73933c0bc91015b24f160590b34e6f0c7b2b6b9787708f8ac48b2ce27da7f509.apk

  • Size

    2.4MB

  • MD5

    3a2df06d9c1aff61a2a693a2beb881f7

  • SHA1

    fc2cb9a7ff6ea4d7ac60655faeac6fb20f6a1cb9

  • SHA256

    73933c0bc91015b24f160590b34e6f0c7b2b6b9787708f8ac48b2ce27da7f509

  • SHA512

    a778677534bb110b6b92efc92264e612d1426e5b302fc3d10421f12bf113c3026a0873776132d87357d1ffd33c6a643596747cac1b511b33768a74b769039f74

  • SSDEEP

    49152:XUxlIZZs5PwtpAixbHmLdQnBsHt6CBPLSoMqCSn5Y5OUywVMe3G/GbNez09H4:Y6smpFHmLdIsN6CBmtqRn5YoUhk/GxlS

Malware Config

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

rc4.plain

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.turneastman
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4946

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.turneastman/.qcom.turneastman

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.turneastman/cache/oat/wbljix.cur.prof

    Filesize

    497B

    MD5

    a7076c8fa8e4d29d97cee1c4d6a6f9e7

    SHA1

    5c8605a1593bc1dba72664ce256b2aeeb3b87153

    SHA256

    d495717123e35cef9d44b29565b2c18edae7bb18cdeb751bf8d668e402c8d6e6

    SHA512

    78b331a63dbff787f7442cf94cc67cdd1be12100c2f83bbae0e56f93d2b69850d74a6b09aa2e99d248de4079c5ed5394c9a600514bbe7e230a327f2a7d30edf7

  • /data/data/com.turneastman/cache/wbljix

    Filesize

    2.3MB

    MD5

    2b6e1e879c2251479221ea55e3a68aa4

    SHA1

    fe4da7a6c03df4f78c553dbbd57b86d86fc0b07a

    SHA256

    47e0664dcc0cf12f557d913f544690dd09e5324f72991366567bc4ca61f30116

    SHA512

    5dc60774923d98c91710e4fa5bd0536495d7b39c97c73c8cd7e343194b33887ec9a3617e836b1b42844cfb6e355b03f3555f1b3c1dae1e0d987aeeb3ccba86f6