Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    07-12-2024 22:01

General

  • Target

    21f58a2c242923467487fac0eb9fd9af397f5ccb1866358019363baab5432974.apk

  • Size

    2.4MB

  • MD5

    d5bdd2e6b738e4ccc92a5ff38525c5f0

  • SHA1

    66e7b5977c5ab9bbb8d46837ed074f4c16844d38

  • SHA256

    21f58a2c242923467487fac0eb9fd9af397f5ccb1866358019363baab5432974

  • SHA512

    19892aa4ed71b069d93538971cec23cc4b41d58472f5b7931f1066e31d3fcffb238b64c9b2a4b202bbb4410aff1e3fd3a59b6c219eaaa2dd49fa84e1e94718ac

  • SSDEEP

    49152:Mm+epVhqLLEdJAnsmeLpEnlOTghkACQhm4OLyPr42k6zRH8a8uTN9QXiIvuSO:oKYLEdJAsmeVMOHQQlyPkcRH8a8EsXi9

Malware Config

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

rc4.plain

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.untilearly32
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4476

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.untilearly32/.qcom.untilearly32

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.untilearly32/cache/bpigcnbpcqfpd

    Filesize

    2.3MB

    MD5

    ccd112d17814c9e668f3639b01f75fde

    SHA1

    bcf958ae3ef07b50fc81615f0a7378fb2a168ec6

    SHA256

    bdbde80e5c6a847c5dc4b6782080356df877d0575d232e735f3d1fda0fd91108

    SHA512

    88d2f671e48b7430f38d19c4285dce1e312ef309605f32ba5d479aa17f40c0b01da60e4d9872b8f84f6d88c3cfb63bc9e7d2be88b16c75982793973806367f24

  • /data/data/com.untilearly32/cache/oat/bpigcnbpcqfpd.cur.prof

    Filesize

    432B

    MD5

    0b6a359b34bf222ac49dd971d69192ff

    SHA1

    5757c92d782655006339d2ef350521a7af8995ee

    SHA256

    2c27a705ac81036a7cc910c616ef9261c8ac3c27b397e34892b6727f594cb397

    SHA512

    f4c36cfb75ab038bad22f83c789b4eb608fc205897a0794c3429aa7f72bbeff0fe0e69b424cbade2dbe58f845c85464bd9f6b1b0a150c56ffbd5a9f8205c8ec4

  • /data/data/com.untilearly32/kl.txt

    Filesize

    221B

    MD5

    a0a2ce729167514e4a6efa3c8aa21cb0

    SHA1

    bc35751b340d7c831eeb8e32d359182cd1a0e439

    SHA256

    7c67303b35a3e93c0a5a74a79d98748959d687793a3b63394c1d895c8521f267

    SHA512

    993f2a755608ac27773b4319fa9639db2faef4dfb8fe77cd93938a546e1e14aaf66e022c780d3fff4895fe34b49475ed0f64ea7e6876fc80e3ec5eb7ff4acc3a

  • /data/data/com.untilearly32/kl.txt

    Filesize

    54B

    MD5

    1192fb9bce5cd77e5c9df44af335f004

    SHA1

    7c7926913cef300815ab575885d3c59cbd6bc3e8

    SHA256

    f065d567d906b9aa19e806830712fa47eb382383b36f0f459941528a0f8b1bd3

    SHA512

    aefcef112a1e975e5ed4c87a74923677c4db203a35852683bfd7fa450fa86ac2e99a3d33768580618f23bd55d33ea458c17cddb621b50519db6d34183d7b5d91

  • /data/data/com.untilearly32/kl.txt

    Filesize

    68B

    MD5

    efe4303004f80d8a55c84475a46d5979

    SHA1

    62f208ff9f2d214a610c509bdcbb0895c13528f5

    SHA256

    f562f541b48c55e20d475611ae871203097125206a9a0427685d52eba1036c4f

    SHA512

    e1d3a80583d99380d269d9ebf3fbd8e525e1766e9db01c6bb41772ca97ecfeade6dc6703d1df7dd4f0d88025bd8aa5416c4dddc94d6d3816409034e14e40a8ad

  • /data/data/com.untilearly32/kl.txt

    Filesize

    60B

    MD5

    20ad5481cdb9c36558fba8ae184ebd16

    SHA1

    cfad00eca47534469237f63837f0dd591037e3de

    SHA256

    cc0da0e3271815965d6b662126134d5facd0627df852fb89b5853a0642b5092f

    SHA512

    f98f58717dae7787909e1dc3671e8120e6f129d1f9a6d722de556ea95f850484172c5c65748c808526b216c7d6366b6e4d6ddb3c7bba5dd10ab5b98f823c628c

  • /data/data/com.untilearly32/kl.txt

    Filesize

    504B

    MD5

    86959a187d7bfcfbbb518da848a70089

    SHA1

    51465108bb3582a567a2520e51cc9abe5b95e53a

    SHA256

    cee68a81cfe3953a0e30b8581592b4634fbf3a8671dfdd2524200f9985a91d72

    SHA512

    93ecb760221aa01710b0ac7a784dccb189e0cb405ef58c4067c66112fa9594d1adf4330d7d6043fed15bff1c50cf88123dd2e5d35ee5e41a55504a48bcf3a861