Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    07-12-2024 22:01

General

  • Target

    1a5b98af6dc06883e69a5bfbc443c795fc2e004d4abc88af1725c7b2a18f586e.apk

  • Size

    2.4MB

  • MD5

    696bb5e0f700aa3dfc08dae905774236

  • SHA1

    d57cda668edb7c49f09ded05b8bbd9bc213fb7c8

  • SHA256

    1a5b98af6dc06883e69a5bfbc443c795fc2e004d4abc88af1725c7b2a18f586e

  • SHA512

    294c1769c2971adf879c591833e3dd51da883124d4bc839efa9def53b7d5826c9d8800e5e3bc3f7ddb2528d2df7078224ea57b8c0d705a03090bb90a940b1c7b

  • SSDEEP

    49152:8sKVpowVmjQQb52s9HUUzFRVKZ7OdiEgrKibXOmPN2dcATX/V3:ucwwpjFzc7OdW9CmPkd/TPV3

Malware Config

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

rc4.plain

Extracted

Family

octo

C2

https://zzd768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://22d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://34d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://as4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://4d768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://44768db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

https://466db37e5e2f5a7fbc0fe1fee5b311.com/YzhkZjQwNDRkN2Uy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.behindstill0
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4496

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.behindstill0/.qcom.behindstill0

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.behindstill0/cache/dygkclzfgogbysq

    Filesize

    2.3MB

    MD5

    895662ce1de502d9bf9e0ca4f0234ed9

    SHA1

    63dd81f9ef75b5813edb53c815cfbd1a4d58f1ad

    SHA256

    240a92a261adcd402016d01580093e60f3b47efbfa8a78cd6ded2100ff5eb165

    SHA512

    09a3a05ae0d8894da60c85f955578a7a41fcb046bc7e0f5bf7f649a8ecf1c65f98dbb7a4236ecfa19da48df147c3828f975fefdcaef2276b8e1055a92b380e1e

  • /data/data/com.behindstill0/cache/oat/dygkclzfgogbysq.cur.prof

    Filesize

    376B

    MD5

    8f42d69abd2a9d679763eba1052f353f

    SHA1

    ea82088e18c92e868134c102a5e5f6ccef1fbd50

    SHA256

    754461d431fca6804b1c5f4f2e4700462aba749628ec56efa45695e97eb874a7

    SHA512

    92d128727169c8dd629e242105eedb465b75f85b57b269d3826d2b265fd9fd476555adb6ede2805ab22c6b5289ce59595a2f091170dfa366619a92273ee857d0

  • /data/data/com.behindstill0/kl.txt

    Filesize

    237B

    MD5

    b0319c4915c079cb0b1adf52abfa9c87

    SHA1

    90d91c5521123a45f9f35c804d3e15ef589cb7f6

    SHA256

    cc04b4380015d2281b2dac285a0f416ab4bac6bc6b784756379c20b9b3fa58f2

    SHA512

    72d5361c553270e062de5124328385dd9269f78610eaf739c8edd72c3cfdf2f5b87447fa8dabf912e49be172c3b78e18806894e0ffb0bde764465a452cd2b34b

  • /data/data/com.behindstill0/kl.txt

    Filesize

    45B

    MD5

    53e5812167229015dca5f124942752c4

    SHA1

    13003f22e371f460f582daed73da3deaaa25dab3

    SHA256

    8876024561b200a5d3935f02413d415475907b5b15c33a1a0c537ce7202367a5

    SHA512

    a7643ca7f9376249099450fc8fe0500f91bbda924f620ec920271723f7d4a55fd3e29bb18dddf9c10533661d441aba22422afa78f0e8e19c2512f609abc9283e

  • /data/data/com.behindstill0/kl.txt

    Filesize

    63B

    MD5

    ebeb5235935188e55fd3c77b83f44047

    SHA1

    a500acd8323c3f5920fe42b0810bb3bab053ff79

    SHA256

    68c1b2c5a166611c5e4db7a968eb31765e4fe403688c5bd4929370a3623793fe

    SHA512

    b985d40daedc454daa87b11766c3986a946ff8d71700b3107ac2c031d73f720dc263ae2cc508456eb78109ba9876dca238a3dd726c224d196bef2302ec8e51d3

  • /data/data/com.behindstill0/kl.txt

    Filesize

    45B

    MD5

    074344293d76b36ced0db07e6848f970

    SHA1

    0143c74c5c89b652c15c0a9299bcd26e60938143

    SHA256

    08cb6afb3430923cd53068ab0dbcda6f287cd84e50a2119536a08f62347ad757

    SHA512

    4a111fe73832b67a17cd70e54a88e0b0bde58886801c8b46a0446594d5ac560e358dd13cec7e20f63d25359c76849239fa344746412a5236c688aeff2dfd2a82

  • /data/data/com.behindstill0/kl.txt

    Filesize

    480B

    MD5

    b68ebf8641f905faab381d8fd60b70ec

    SHA1

    62c42fb98ab22d0b2e4248ebcaa4b2b7693f4e95

    SHA256

    d83ae6181d898a3f69d268926deeeea0a7135fee44b3462b6995d51d230738f4

    SHA512

    37941eeb4f0c6fa667518efd5fd167e1238066571e559e907171d40921f8233ab07502eec2ad81eff9087a9d08c9e6c38b3bc0411145717aa5ac0f97578c9cb9