Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    15-12-2024 22:03

General

  • Target

    f0c831683246257815917d27aed7a78c5b9d4a12fa16f1d6c5174f939aece147.apk

  • Size

    1.4MB

  • MD5

    a8791695caee597bea1f6ebfe8d85e5c

  • SHA1

    c050b945102a2c07f97e0377f959566f6d4c0633

  • SHA256

    f0c831683246257815917d27aed7a78c5b9d4a12fa16f1d6c5174f939aece147

  • SHA512

    63df1e95a756da96f8ed33221a8bdc33780abb5dc72e33e3223a466e67cd1af763514472d3f95d880c7662ffe4f3b5a74815458e5ea5cd6aa4cb5fe1dedbd377

  • SSDEEP

    24576:tGU4IXY7Nx7OcgrTFGajUkSy0oCQzkED797lT5WWzT2js830zZKPq1aeLCJ8brLg:tGUzeD7OJrTYajUkSy0BQQC7zzfamXQf

Malware Config

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

C2

https://hayatvesanatguzellikduygusu.xyz/YmJlYTFiODdkMjcz/

https://mutlulukvesessizlikyolculugu.xyz/YmJlYTFiODdkMjcz/

https://yasamvesahtekarguzellik.xyz/YmJlYTFiODdkMjcz/

https://sevincligunlertatminkar.xyz/YmJlYTFiODdkMjcz/

https://dogaltatvesanatyaklasimi.xyz/YmJlYTFiODdkMjcz/

https://hayatlarinhuzurvesessiz.xyz/YmJlYTFiODdkMjcz/

https://keyifligunlerinfirsatlari.xyz/YmJlYTFiODdkMjcz/

https://sevgiiledoluyasamyolu.xyz/YmJlYTFiODdkMjcz/

https://sakinlikvehayatderinligi.xyz/YmJlYTFiODdkMjcz/

https://sanatvesanatcihayatlari.xyz/YmJlYTFiODdkMjcz/

https://ilhamdolubirhayat.xyz/YmJlYTFiODdkMjcz/

https://zenginlikvebasarihikayesi.xyz/YmJlYTFiODdkMjcz/

https://kalpvesanatdostlukhikaye.xyz/YmJlYTFiODdkMjcz/

https://mutlugunlerinyasamayolu.xyz/YmJlYTFiODdkMjcz/

https://yasananhayatinduygular.xyz/YmJlYTFiODdkMjcz/

https://dogaylaisbirligiyolu.xyz/YmJlYTFiODdkMjcz/

https://hosgoruhayatvekultur.xyz/YmJlYTFiODdkMjcz/

https://hayalguclesanatbaglantisi.xyz/YmJlYTFiODdkMjcz/

https://sadelikvehayatfelsefesi.xyz/YmJlYTFiODdkMjcz/

https://dogaldostlukvesanat.xyz/YmJlYTFiODdkMjcz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.scene.neutral
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4725

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.scene.neutral/.qcom.scene.neutral

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.scene.neutral/app_music/JQOB.json

    Filesize

    153KB

    MD5

    9487706f0b2719f0b275b4af9642ad9b

    SHA1

    e31e2f51dc4aca37b05d7b802f3c52269ac53afa

    SHA256

    94b04741b0670d10673cd0ef0c86907dd056ca66b98d6d9d8867e8e1bed341e6

    SHA512

    a5561d8a0917ce6ea5cb4ed76ba0a4cbbe99921835444eec5a6267023d5170b7e52493a016afa0851fad5721e210c90288f48d76d8afa6c222820fa4c9eb887d

  • /data/data/com.scene.neutral/app_music/JQOB.json

    Filesize

    153KB

    MD5

    0bdfa3b0eae1cdadf224518bb53500a5

    SHA1

    dc0da2e0430c86feafc4ea01519cdc3fee380423

    SHA256

    732ac5ac78c8570152cbfb4d0b82d8300c81a5d5fee5f8b6c5267999f388fe69

    SHA512

    f479a865521c9f9965e2d79378ef8506e5806fc869747a223558f8a3a297888265d4a8b7bfd0dae2f8b5c239e62efcac9db61471a5292d193aa0e5de3237d478

  • /data/data/com.scene.neutral/kl.txt

    Filesize

    230B

    MD5

    395bbfedb290eeffe297e3524ffdc90a

    SHA1

    e85d94501c0cc200c0f7472084501b2783a0c83d

    SHA256

    17ae8be18126a80aaac5d4b3bc5a81d0a7f29b3cd6923e25905bc5b36a2f35ac

    SHA512

    19b0b9e0cfbe4acf930eb53257d14c93c1847ef67e203d1ca34267e49f7d2d3587c3d91b651e85629613a187f564ce33d5db50aeab2ab495d03eb38db89f5b19

  • /data/data/com.scene.neutral/kl.txt

    Filesize

    54B

    MD5

    a6b908f612f6b9f1f731d59cac1bb72d

    SHA1

    3370a192b8d6728b88f6f0f232e84dac1b0041fc

    SHA256

    97bcc5799200650e6e661b1dc1c0b1463e4bf9ad5609602875d8da27da79a172

    SHA512

    23a525e75b098308156bab47fb3933b1ddd98065b861c93dc40c1407582afacce5ca2c5259d8f72baf473185c052a76a4445542c6630a60e07b798561b97d239

  • /data/data/com.scene.neutral/kl.txt

    Filesize

    63B

    MD5

    9323effe31ddb268d26c637f3567932c

    SHA1

    8dee57f2e8f52df639ad171043ce97e71180acd7

    SHA256

    731000a761b0d84eaaa6e59fd92aa54eaf472d001cd72de3abb3d4287caa7b09

    SHA512

    9eca3fda06b0b8cfc2a7baa51b1c5c0a370177fb726ec166bef17a48f5a77ac188784737cbcf42e49062c2bff5db12a62125b51fd58ed25217c83b6c1afc333b

  • /data/data/com.scene.neutral/kl.txt

    Filesize

    45B

    MD5

    f355bc5a62c4087d9d4b6524ae05b6f3

    SHA1

    846faefcf65ff95cd83dc5136514bd83b2146747

    SHA256

    c01b767a4d3c3494377309c8d33a2b9f3b53532daf5b33efe10926b5d1d45ed1

    SHA512

    18814ce12e11044508352f5afca284c7885e4ba2a586107e8ce81f1d4e65afe96af8a6f388cbbc813265cd8453f52c571ffdcccf5370bf8c485aca4ef834538c

  • /data/data/com.scene.neutral/kl.txt

    Filesize

    466B

    MD5

    ba67011d9ac0686632e98ac767cf07f2

    SHA1

    047299bfda33ca2b639dd56e2d882277381f6e56

    SHA256

    ddfb0fd77bb9f68867e52745118e656a83a17bbb0639764651a4bef00354ea15

    SHA512

    4e46f45cf9237792c429477d53cc173288fdac4925e6d5a3199f1ceb85be571f466a9d8544d97ddd6969556d95e02e052d9c956bd2ffe8bd8461c36562f4ed6d

  • /data/user/0/com.scene.neutral/app_music/JQOB.json

    Filesize

    451KB

    MD5

    c6ff2ad5ab41ebac861af270bf03fb02

    SHA1

    3f135a10d69b516a0e6a1f50b23cfb986209885c

    SHA256

    076d16235e314a4cb0ed045421a7caafeca4fb10ddcd3d50337792e5c1cc5558

    SHA512

    d4a79cbfeb5797de4a2efb0f856cd7c7f4957f632310ce1a9dc44287b2a63b33054ce959dd0988937d8e2539af1c6515b827feb5201fbd0587febac7ecd055b2