Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    09-12-2024 22:09

General

  • Target

    0aa45906787ea8635a44aaf3a351653759dab1edd9d5fdd62c4c65a25f8d08a2.apk

  • Size

    2.4MB

  • MD5

    d2b3eedbbb462f670146ff2fd717c02d

  • SHA1

    18e823a223c6f5eda653725052c85d4e1d1d5d1c

  • SHA256

    0aa45906787ea8635a44aaf3a351653759dab1edd9d5fdd62c4c65a25f8d08a2

  • SHA512

    d063176459c5be2ac2097904f9372edabed046b0dd8511e5f9768946371058e51c973e4dbae4268181d397804ad29756bd841c526bb517001b60677c11129a89

  • SSDEEP

    49152:Xc4mWftD1RtaMVsR13lurtb/uDur/g3qxIIO0mjT5Z3WG20CmiEQw6twON:FTtZ3aMVsX3sBb/u26ITmjtZ320ViEvI

Malware Config

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

rc4.plain

Extracted

Family

octo

C2

https://567237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://4453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://554237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://77233467453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://5672346981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://56723747455033c23.com/MjNkNTlkYzBhZjNk/

https://7237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://9237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

https://8237453981d0595033c23.com/MjNkNTlkYzBhZjNk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.redkeeplrf
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4505

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.redkeeplrf/.qcom.redkeeplrf

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.redkeeplrf/cache/oat/orytzeggfinux.cur.prof

    Filesize

    431B

    MD5

    a203d2d332845e7208fbb9e5a324649b

    SHA1

    a903699f641a1336d8009bf7934bc8b3ecabf547

    SHA256

    eb747e7e54150b4bf87e6a8955d65ab2688eff97d9bf01abe98685ea2ef5d6db

    SHA512

    6232da90df321b2009967f030ebb41e6c9f9b26552e52831a7b05ca2e7b45bbb3f119bf8a6e78676227e7eb0159bd45c82ee752ad0a6fa1f151c5d71d69d2a0d

  • /data/data/com.redkeeplrf/cache/orytzeggfinux

    Filesize

    2.3MB

    MD5

    ca469b1c3e0b6e2ff869afb1c826cd15

    SHA1

    08b704cfb3ae79eec061b2c59ac35da0f1d486bc

    SHA256

    eb9fdb961bc37cd545e390c3020ef213ca959102d19bfad3d44c72afea48db1a

    SHA512

    f85c15b65364d4be203bb7497229a8b4f6e314333640b245b918f3bc39f709f9defcb27430f242ecd08b179723acab61cb9e4f9f470783e3fb9a6225211fa68b

  • /data/data/com.redkeeplrf/kl.txt

    Filesize

    221B

    MD5

    3199b4dece9b1e31a2e328caa299bfd2

    SHA1

    b5b5e9bc969c0013a0452bedcb0df4328d4e7c74

    SHA256

    7cccc7ad01d3db0d99d7661ad2d50c38ff382696d84d0ac13fa5920b944349bb

    SHA512

    9f69ffc16d6491cd8c8e4f6885896efaf87212a149c5bc62de90eab0c2303c3ab4a87201b36165b566f1dfe5cf78e7b78f0532275f2adaf3c7c44945de25fb1c

  • /data/data/com.redkeeplrf/kl.txt

    Filesize

    54B

    MD5

    41457f8ee3ad85298d0bb74d7deb881e

    SHA1

    0d752836f05a1054e535695195bdcce63059b6a3

    SHA256

    32c06df6d0285b530923b586c62abbb7ae23756d42ad2a9c39800ca5571b12c0

    SHA512

    ac53b5309d09b966d6ac56793c7ac7946e3fe12af2cc8d5c4145f99d4c6a39836cd102660ad707455a4a505fc8b49898bbe9a536665af1ab0a7aabe391830f79

  • /data/data/com.redkeeplrf/kl.txt

    Filesize

    68B

    MD5

    90ebd537dbf8f58d90d0dce017d093cb

    SHA1

    ba81546040972fe089e971c6f39c88510aa6a40a

    SHA256

    ae710c8be301bea0b935f68ac92c727d1a2259c54b8767dea4604692d57072fe

    SHA512

    642a731e609f9b7f15939867a8a4666b6f0f36c88ad2418bbe415c10b79ce662d90e0948898b8b831e033a98ac3ec00b33462f83422700ddceaf819d45930373

  • /data/data/com.redkeeplrf/kl.txt

    Filesize

    60B

    MD5

    ee129bfafe88c3605233f45dd140c36c

    SHA1

    5f544b9eea8baeaa36438d0b655d55954b1ff31a

    SHA256

    2561123e73d6cd75e8775dd5edd2ef47c0e8e076690fc0ee97ae7b850928c319

    SHA512

    a3ed70efdca8ec34e9476c4fa654b7a226dd763566a97d45c808e22ad4c042ad0383fdf60010557db19e28efad54adebc2bfde914b5af40b6f371fbbe27ab362

  • /data/data/com.redkeeplrf/kl.txt

    Filesize

    504B

    MD5

    183bd6fbb9f7cd9c7046bec03bcb4a3c

    SHA1

    3aa80d820a5d52323c264847cff935185470a787

    SHA256

    ff4a4a218439aba51693a72293c39de1e54fdf8d2a3f1757adacd5fe44698608

    SHA512

    99a0bb3dc8da4af6bce00e6919ed5c3c93261085f9897fac7ffcd02cbab41a7f1bd1e3bd4b2ad0d5b02c78dc8c71b92c4b7e572e02787850e0ccca2a51142d9c