Overview

overview

10

Static

static

6

19cc5b2654...47.apk

android-9-x86

10

19cc5b2654...47.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09-12-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19cc5b2654f7f5d930ca2f7333d36a73b71e4d4e5693e6d75be25586ca0bfb47.apk

  • Size

    1.4MB

  • MD5

    46f9412de19700615b15952ce0adf699

  • SHA1

    70781a363b216a225f85fa97ab26c298c3e631e7

  • SHA256

    19cc5b2654f7f5d930ca2f7333d36a73b71e4d4e5693e6d75be25586ca0bfb47

  • SHA512

    f4d8954465fc92fd1c600b5d04e8b544599cd0a2121e7a5662646cf75b791338c9574da04f1461e60cd5f81a32786a0c6cabbd53424b79b4fa8cc67fb1a67b28

  • SSDEEP

    24576:iHJEpI25hs/vG+yBQgJUhi7tUMzVmrCjWB1Z5y5nQq/zLCLvKeDlTghdMrBcBmQI:iHJEpI2k/vwBQgKhi7tUMzVvqZEQZ+ed

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://zorhayatdersleriyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azminsonundabasari.xyz/MDQ2MTZjMDhlZDQy/

https://yasananduygularhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinbitmeyendersler.xyz/MDQ2MTZjMDhlZDQy/

https://zorlarinkucukcikisi.xyz/MDQ2MTZjMDhlZDQy/

https://umutvegayretinyolu.xyz/MDQ2MTZjMDhlZDQy/

https://hayatmucadelesininyolu.xyz/MDQ2MTZjMDhlZDQy/

https://yokustapratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://kucukbasarilaringucu.xyz/MDQ2MTZjMDhlZDQy/

https://engelvemucadeledolu.xyz/MDQ2MTZjMDhlZDQy/

https://yasamderslerininhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://mucadelevebasarininhik.xyz/MDQ2MTZjMDhlZDQy/

https://yasambizeogretendeger.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleryenibasari.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayatinsessizcalismasi.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardakiogrenimyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azimvekararlilikdersleri.xyz/MDQ2MTZjMDhlZDQy/

https://hayattanhayatatogren.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardekiyenifirsatlar.xyz/MDQ2MTZjMDhlZDQy/

https://yasamveyolculukdizeleri.xyz/MDQ2MTZjMDhlZDQy/
rc4.plain

Extracted

Family

octo

C2

https://zorhayatdersleriyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azminsonundabasari.xyz/MDQ2MTZjMDhlZDQy/

https://yasananduygularhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinbitmeyendersler.xyz/MDQ2MTZjMDhlZDQy/

https://zorlarinkucukcikisi.xyz/MDQ2MTZjMDhlZDQy/

https://umutvegayretinyolu.xyz/MDQ2MTZjMDhlZDQy/

https://hayatmucadelesininyolu.xyz/MDQ2MTZjMDhlZDQy/

https://yokustapratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://kucukbasarilaringucu.xyz/MDQ2MTZjMDhlZDQy/

https://engelvemucadeledolu.xyz/MDQ2MTZjMDhlZDQy/

https://yasamderslerininhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://mucadelevebasarininhik.xyz/MDQ2MTZjMDhlZDQy/

https://yasambizeogretendeger.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleryenibasari.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayatinsessizcalismasi.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardakiogrenimyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azimvekararlilikdersleri.xyz/MDQ2MTZjMDhlZDQy/

https://hayattanhayatatogren.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardekiyenifirsatlar.xyz/MDQ2MTZjMDhlZDQy/

https://yasamveyolculukdizeleri.xyz/MDQ2MTZjMDhlZDQy/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.denizbank.mobildeniz

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.advice.behind
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4250
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.advice.behind/app_rude/OPPsli.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.advice.behind/app_rude/oat/x86/OPPsli.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.advice.behind/.qcom.advice.behind
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.advice.behind/app_rude/OPPsli.json
    Filesize

    153KB

    MD5

    495418de4590681aae15584f5d565c93

    SHA1

    75ced0062b11c951db6b5ddd8de3a1fdceb1d192

    SHA256

    bbf3854f7a5d58be6734f58cd2777ec9e78353f53b2b412f39bd6420f6ccfc60

    SHA512

    caf3d0eeed9d4a8e725d314850a0bbf03f364216c975698aecfe609d31faeadbad672a0311c1c72427d77180b0e5c19dbc6c7b7260a89dd28866ad814c03e54b

    Download Submit

  • /data/data/com.advice.behind/app_rude/OPPsli.json
    Filesize

    153KB

    MD5

    618967cd54c71ff57e5d4e4d8dfbcbc9

    SHA1

    e6c5a639cb4729c0f25c9088563aabc1c2500ced

    SHA256

    8dc0fec4d39245ec6ca98e53a237f318ffe72c5efe5e77203d0e14f9657d5eb2

    SHA512

    fecda7ae8d2ea83c03220cb2b891a914d1afaf9d49bc06441165e1e3c8d3c4201074185e8ee50bd29f27742990ff4b99b613d51b6b3bb99d1dd8494f42519d1f

    Download Submit

  • /data/data/com.advice.behind/kl.txt
    Filesize

    45B

    MD5

    96cc6a9353615c949f5f97d498ceccbf

    SHA1

    4b7ea2c3249184d106a6d86f61109f7daf3498b5

    SHA256

    2c5e313a998d4b4f71214010ebee26da0d3ebe8f2081f81869bb092c64030701

    SHA512

    9159d1501f983ad8e12afcd8051c11f2e00fc55885761a2971bbaaeca6af613768d4865c1fe0b2867961147b679afed3a6f834d189d8a46b16bce56569294936

    Download Submit

  • /data/data/com.advice.behind/kl.txt
    Filesize

    423B

    MD5

    9d6b2ec926d30c0ca800a4d7d3fb9995

    SHA1

    5bb80b420840a73244c2d3e1bd165fcf6ce73df1

    SHA256

    be728f77430099193097df0fc48f7eff53adb308566c4f682cbfb53d61cce5f0

    SHA512

    cab154bf445cd309e9779cb6e0041165edc68aeeb4f1ce1c9c4b3aa0931df51ab5fda09c79b7d8b4be08e2eb52db71a06d0a19d67289810e475375b5f9eeaa7b

    Download Submit

  • /data/data/com.advice.behind/kl.txt
    Filesize

    230B

    MD5

    0345387f1726c166b81cce0ccf870234

    SHA1

    54b2c380ef3b0382d14f944746b0f20a02f98674

    SHA256

    c99cf1c7fc8feead7bd43b0a2d2e4a456eeeaab1a13cdbe7b4a54d63c0666011

    SHA512

    87e4952da0e94cf7da13385872f0e0ea438504882cfb39367a529d865ba370e5df15839db47fab385b7154761b1476aa4bb92156e96b644c996961b82a9acc94

    Download Submit

  • /data/data/com.advice.behind/kl.txt
    Filesize

    63B

    MD5

    730fcc9f17698fa58dbd744beb9eb389

    SHA1

    e4ca37dce4a0e81c32a8dec23998bd49d13c9044

    SHA256

    eb147a26bf5042a6a975448bb26703f015c9e0565f1b049fc133abfc3f1d3ee4

    SHA512

    fc3d602f20eb8c84f88ab03c0769a5717b41e6031aaa78878352d0bdc3c9fc13cb92adf68ede3e23eb76145f7fb9365d4e7ba692e1d6a4d3ceea880c738e018b

    Download Submit

  • /data/data/com.advice.behind/kl.txt
    Filesize

    79B

    MD5

    99fd287abfedfc39035ae8c984b5cc56

    SHA1

    6991daf2c3e3f8dd886cedb14719e1ba83fe9242

    SHA256

    09787a273d7b3c949d442dd04700c43e4e3f80e1e868de76dd4ee43e9695ce9f

    SHA512

    23baa4b81a414bdb016f2f4896d0f2c379733d83cecacf8a26c881f1d11c5022ca64626023c443a90c2943b4705cba4d6ad626fca34488e89b968c0ce9b9cacb

    Download Submit

  • /data/user/0/com.advice.behind/app_rude/OPPsli.json
    Filesize

    450KB

    MD5

    9dd54c73d836a4b6b967b2af4c41b659

    SHA1

    64c8e818d7975ea42eba4ffc43e6870133b97f11

    SHA256

    4ce0d49aaab0d53a16ee1a6b221adcd02cde21191646bb3b06b3d259e762da71

    SHA512

    b4161096baf70b53583a2caa5423c0f6149bbd999b037bdc70a776a0ae40e45cb793f92d48fb17db4ee0cbe05ff1f22a9bc228feff1190bb710f428ed8d2352c

    Download Submit

  • /data/user/0/com.advice.behind/app_rude/OPPsli.json
    Filesize

    450KB

    MD5

    d77f63e6afc05513f92b65fb6e44f8df

    SHA1

    3f52855e4fb173e07241015bd4a161b46104889e

    SHA256

    8cbdf9480dc20bbfaadf7319e5cefbe8f933e811a8d32f4a8ed8bda75f0138c7

    SHA512

    5e583fbafe6cba57cea4250de45fecfa64c61ed3fbd64db3fa6d11784b55b52bcd19e9ebab518299e66077f6eb5ec56afab1db98f9083006c680d406bf60476b

    Download Submit