Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    15-12-2024 22:04

General

  • Target

    32f9051276d4e4312f2b6024d1a6450edc63e106eb0426adfbae9fa173064c37.apk

  • Size

    1.5MB

  • MD5

    26febd1a3c568774cd24c8184587716b

  • SHA1

    8dce7aae83e810ce2f905647950f7afe9f229161

  • SHA256

    32f9051276d4e4312f2b6024d1a6450edc63e106eb0426adfbae9fa173064c37

  • SHA512

    69b4a619d50eb7cf4e8e7a85ab84c6636873b84f7511a11ac600b40c7f3ef70b49e8ca1b9ae673158b155b5197581695d0f712038e25689548a95ee9fde80e6f

  • SSDEEP

    24576:C+rYJUnjHhecDx8CFsux6OuVzzxC6vboYOYCbmOn+TRFymbSH80D8kvMhFxWusht:CWY27heMVx9slOr+9FyHH80Ddvll1xi2

Malware Config

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.adjust.glove
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5076

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adjust.glove/.qcom.adjust.glove

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.adjust.glove/app_sketch/SG.json

    Filesize

    153KB

    MD5

    c1ed4ac6208772c38653dbdbb1b232da

    SHA1

    812d6e6fa3b0b690574706b7c2b5aa642ab0f2d6

    SHA256

    debb7a1695a9152a06cf40b2fe64c5d1e1c71765bfa6a6e696e1eaff2dbfe910

    SHA512

    7f5897320ac68dbc28ce6230f4c1d6d3d85a3c6dfcd0383b1ca66a55051a2c4bab0b1303f2ecc515d4c099096416828a5cfdc2c7bcc75953c5fce7dba6632a62

  • /data/data/com.adjust.glove/app_sketch/SG.json

    Filesize

    153KB

    MD5

    77ee07febbcfb8204d51e34e35c7185c

    SHA1

    381466bbe9e602a5075320a6a7f386bbebc46a88

    SHA256

    a271e7c263c84aac87d8561ad51f8f239b6eb457f38ed280ec629dea3e913c44

    SHA512

    719c8f19ee082567f75dea90ad1bcd3ae708b60ce43431e448356e4929797427417f5ed7ceb5fd033654fdfe869671849a9039f77f81d7685e506d6cdf21c9a6

  • /data/data/com.adjust.glove/kl.txt

    Filesize

    230B

    MD5

    c9dbfdce86ed0306fdc64f3debae840a

    SHA1

    d7a71cedb2307296be66750ecf340219e30329ea

    SHA256

    e389b7fcea8d5b4e2d15b8939e4d861b116f606b9426137d70322c47fa76044b

    SHA512

    52de094dc8b6a16f0f3658051e49e10c1d6704b5f9e99e4433e668edf1357742d2025d51bf20061bdcb6fbd5ce6d87996e897f83c4860f3e8bf217e177b45e0d

  • /data/data/com.adjust.glove/kl.txt

    Filesize

    54B

    MD5

    e3066d69a65c9bab3f61260e6b3c25ab

    SHA1

    c6664f8fce5aaa5536eef1f496769026ea7eaf64

    SHA256

    075bb8bded12db358267e3a35a662befe3e2ceb33ce540d36ccc090c9edbedfc

    SHA512

    78047f5712f63c6204824d2522125d0d1d4850b75ccb9ca82c7e6afbd3c401ec3f55dd7b467b93d92ba63c600f0f5216640a32bf7763998ed6b34206995f0268

  • /data/data/com.adjust.glove/kl.txt

    Filesize

    63B

    MD5

    151b705ca28eb65714683f00aca8a185

    SHA1

    9cff478425808ee26684acd3ac9624d656451307

    SHA256

    b36952e06e194513141c1dc674647d5f199f45632932ac104a18be7df6912c9e

    SHA512

    24c7a9b3c9fb4c63467768f2c2408e417e71c9d3a7ec989dc4a6e3f451af9427d97ad4cf8d2995b47631c157cb5b54ed338309c93a8cff96aa49ed25298584ef

  • /data/data/com.adjust.glove/kl.txt

    Filesize

    45B

    MD5

    4e3cf3a86ed9d74e54877cca54c360da

    SHA1

    0579546913862f89dbb0fb69852974a7d2c74a3a

    SHA256

    80eb52e8a36eb0eff5706641cf5268addca2891621c19efae5591e2466f46e98

    SHA512

    6dc7dda2442b83ba28ce1879db00f9942f696af03ca1c76fb9f8a1111b1963ec45be29ac4bb334804f4401e332f68c4b44b885a764893bf5772792e28bac30be

  • /data/data/com.adjust.glove/kl.txt

    Filesize

    423B

    MD5

    206fc6f2ee00799f2cf01098102462d0

    SHA1

    31c0eefe6ba3d0a6dd75ff76c98ae2854388dd5c

    SHA256

    3b1ff1c3434aaa480cf3b8a82fe04ec40affd6d8b62fc5e449e7be87c4646649

    SHA512

    716b4d9ce99d7e2d27c8953e80e0f0cb1812ebe469b82977fdba949615ac435adfe3a2ec005a866e29f8803dab9abc2467932d2dd97ec90bf1fde620a42bc804

  • /data/user/0/com.adjust.glove/app_sketch/SG.json

    Filesize

    450KB

    MD5

    dfea92841720bfd7b92562fa1ad8c1dc

    SHA1

    69b06055ffe8d2f93e42c157aad5317df526f994

    SHA256

    9ee05d29f4405f60137a92364286301741eac5ff1bb229de3995060516ccd8b4

    SHA512

    59e42422fece22d523beb725675d0380269b6d02d9d79df51f8c2d653d3346031744a7e40485ce902200b0c3af8e7bdc5b7ec35fdf1ae698b64604ecf30df150