Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    09-12-2024 22:13

General

  • Target

    19cc5b2654f7f5d930ca2f7333d36a73b71e4d4e5693e6d75be25586ca0bfb47.apk

  • Size

    1.4MB

  • MD5

    46f9412de19700615b15952ce0adf699

  • SHA1

    70781a363b216a225f85fa97ab26c298c3e631e7

  • SHA256

    19cc5b2654f7f5d930ca2f7333d36a73b71e4d4e5693e6d75be25586ca0bfb47

  • SHA512

    f4d8954465fc92fd1c600b5d04e8b544599cd0a2121e7a5662646cf75b791338c9574da04f1461e60cd5f81a32786a0c6cabbd53424b79b4fa8cc67fb1a67b28

  • SSDEEP

    24576:iHJEpI25hs/vG+yBQgJUhi7tUMzVmrCjWB1Z5y5nQq/zLCLvKeDlTghdMrBcBmQI:iHJEpI2k/vwBQgKhi7tUMzVvqZEQZ+ed

Malware Config

Extracted

Family

octo

C2

https://zorhayatdersleriyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azminsonundabasari.xyz/MDQ2MTZjMDhlZDQy/

https://yasananduygularhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinbitmeyendersler.xyz/MDQ2MTZjMDhlZDQy/

https://zorlarinkucukcikisi.xyz/MDQ2MTZjMDhlZDQy/

https://umutvegayretinyolu.xyz/MDQ2MTZjMDhlZDQy/

https://hayatmucadelesininyolu.xyz/MDQ2MTZjMDhlZDQy/

https://yokustapratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://kucukbasarilaringucu.xyz/MDQ2MTZjMDhlZDQy/

https://engelvemucadeledolu.xyz/MDQ2MTZjMDhlZDQy/

https://yasamderslerininhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://mucadelevebasarininhik.xyz/MDQ2MTZjMDhlZDQy/

https://yasambizeogretendeger.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleryenibasari.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayatinsessizcalismasi.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardakiogrenimyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azimvekararlilikdersleri.xyz/MDQ2MTZjMDhlZDQy/

https://hayattanhayatatogren.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardekiyenifirsatlar.xyz/MDQ2MTZjMDhlZDQy/

https://yasamveyolculukdizeleri.xyz/MDQ2MTZjMDhlZDQy/

rc4.plain

Extracted

Family

octo

C2

https://zorhayatdersleriyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azminsonundabasari.xyz/MDQ2MTZjMDhlZDQy/

https://yasananduygularhikaye.xyz/MDQ2MTZjMDhlZDQy/

https://hayatinbitmeyendersler.xyz/MDQ2MTZjMDhlZDQy/

https://zorlarinkucukcikisi.xyz/MDQ2MTZjMDhlZDQy/

https://umutvegayretinyolu.xyz/MDQ2MTZjMDhlZDQy/

https://hayatmucadelesininyolu.xyz/MDQ2MTZjMDhlZDQy/

https://yokustapratikcozum.xyz/MDQ2MTZjMDhlZDQy/

https://kucukbasarilaringucu.xyz/MDQ2MTZjMDhlZDQy/

https://engelvemucadeledolu.xyz/MDQ2MTZjMDhlZDQy/

https://yasamderslerininhikayesi.xyz/MDQ2MTZjMDhlZDQy/

https://mucadelevebasarininhik.xyz/MDQ2MTZjMDhlZDQy/

https://yasambizeogretendeger.xyz/MDQ2MTZjMDhlZDQy/

https://hayatdersleryenibasari.xyz/MDQ2MTZjMDhlZDQy/

https://zorhayatinsessizcalismasi.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardakiogrenimyolu.xyz/MDQ2MTZjMDhlZDQy/

https://azimvekararlilikdersleri.xyz/MDQ2MTZjMDhlZDQy/

https://hayattanhayatatogren.xyz/MDQ2MTZjMDhlZDQy/

https://zorluklardekiyenifirsatlar.xyz/MDQ2MTZjMDhlZDQy/

https://yasamveyolculukdizeleri.xyz/MDQ2MTZjMDhlZDQy/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.denizbank.mobildeniz

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.advice.behind
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4951

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.advice.behind/.qcom.advice.behind

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.advice.behind/app_rude/OPPsli.json

    Filesize

    153KB

    MD5

    495418de4590681aae15584f5d565c93

    SHA1

    75ced0062b11c951db6b5ddd8de3a1fdceb1d192

    SHA256

    bbf3854f7a5d58be6734f58cd2777ec9e78353f53b2b412f39bd6420f6ccfc60

    SHA512

    caf3d0eeed9d4a8e725d314850a0bbf03f364216c975698aecfe609d31faeadbad672a0311c1c72427d77180b0e5c19dbc6c7b7260a89dd28866ad814c03e54b

  • /data/data/com.advice.behind/app_rude/OPPsli.json

    Filesize

    153KB

    MD5

    618967cd54c71ff57e5d4e4d8dfbcbc9

    SHA1

    e6c5a639cb4729c0f25c9088563aabc1c2500ced

    SHA256

    8dc0fec4d39245ec6ca98e53a237f318ffe72c5efe5e77203d0e14f9657d5eb2

    SHA512

    fecda7ae8d2ea83c03220cb2b891a914d1afaf9d49bc06441165e1e3c8d3c4201074185e8ee50bd29f27742990ff4b99b613d51b6b3bb99d1dd8494f42519d1f

  • /data/data/com.advice.behind/kl.txt

    Filesize

    68B

    MD5

    bddecffcd60a67dd04bb80e9d4dd69c0

    SHA1

    6a06759581a65e688ec852f3debfbc68bd2f88fb

    SHA256

    0c930499e65cc9e4990a85886b8e9bb4925e2776ec56a97b08953d30ba7b81c8

    SHA512

    0cf6d018945d30910abaf97abe36e424a5078b4b346fa34200c66f038c6a5ab96a5b67d23f3e119abd70a5145fc561b1b54f42ab3510a498df6777372a863ad4

  • /data/data/com.advice.behind/kl.txt

    Filesize

    230B

    MD5

    80ab35755d713711a3999b2f9867a979

    SHA1

    c7a1c8f1a1573592a07b4ca0ee70cbd8ea2c7401

    SHA256

    ac2d4b8f27bb7bbe4807a2f56199d9843cdd780a0396f73ba4afd64f51bc78ce

    SHA512

    af83a1d2ab383237b3e37bea7470241a343ae7f5cbe0c689779cc6f8cdc2d5ab1ae3bfbd4b7e1f98032f718b2b7a23b2caa0b71c723f809d260da42988b26b08

  • /data/data/com.advice.behind/kl.txt

    Filesize

    63B

    MD5

    cf77f754fb883c9082d23fb058a7abb0

    SHA1

    65015a3176c9792b06c4df205b242ce21928b038

    SHA256

    7ac202ab5a4adaf79c40b9e4a757d5f97986269df6d8960e943157f344117875

    SHA512

    970f2f23c56f6a372461c55ea1b29159216e54d2a157b1f80742ad6bfdde47e052faf282341d33b55170856dca5c3df33353d5020a4a9a302f0408d3210ef2e1

  • /data/data/com.advice.behind/kl.txt

    Filesize

    60B

    MD5

    adfbf94f3ebc085dda3a303641a3dc2e

    SHA1

    a07d86b0b9e03d08565d430f325732bfbcdf960b

    SHA256

    9220da3e527b01eff9bbcd2ace8c0c6b05414cb563562e141633e81aac20e9cf

    SHA512

    81b91d209b477579de1abbb96698531cd8b81ced11ebbb214e360b1a0211a5c543ca2a45dd27c52e95f35fada9ec129d6db3be903115219580b290011dba025e

  • /data/data/com.advice.behind/kl.txt

    Filesize

    423B

    MD5

    63386f371d0a6fe94ac76dcec3574fb4

    SHA1

    06c813fd30f32cc373784f0e000a6d59aa92430c

    SHA256

    727f40d29c2a8c3868371f077303e83b8d778d1295ff94e76e11c71b772112cd

    SHA512

    9388425b320db324c12ed9557666e3befe1f06fab78db6779e8d35d91061df3dae3dff5adb74e6f9c7ec045faaab53828703d1a9c7b8740754cb5c7bf8723fe1

  • /data/user/0/com.advice.behind/app_rude/OPPsli.json

    Filesize

    450KB

    MD5

    d77f63e6afc05513f92b65fb6e44f8df

    SHA1

    3f52855e4fb173e07241015bd4a161b46104889e

    SHA256

    8cbdf9480dc20bbfaadf7319e5cefbe8f933e811a8d32f4a8ed8bda75f0138c7

    SHA512

    5e583fbafe6cba57cea4250de45fecfa64c61ed3fbd64db3fa6d11784b55b52bcd19e9ebab518299e66077f6eb5ec56afab1db98f9083006c680d406bf60476b