Overview

overview

10

Static

static

6

207b1dc608...ff.apk

android-9-x86

10

207b1dc608...ff.apk

android-10-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    17/12/2024, 22:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    207b1dc60898087552f5ab669f94e9d2f031865e425e1862756f1b041189bbff.apk

  • Size

    1.6MB

  • MD5

    4bcdb88f0bb5e497cad91c75067409bc

  • SHA1

    2392bf96d4d107c1a7d57b894092afe6ddabfe17

  • SHA256

    207b1dc60898087552f5ab669f94e9d2f031865e425e1862756f1b041189bbff

  • SHA512

    2f4613c0a7a1f282d899d17a6d611b0c2d93e6ffe65df07e963949e97d645501fc7b58dc987ae2746aeaecb23d1e0ec17230dbd808ab47bd99bc9cb79b38ba62

  • SSDEEP

    49152:BdnxA3D/eVK2xtb2R2V0LTlggJZRTRYNI:nn7px12R2ex/pRYa

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/
rc4.plain

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.tag.core
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4374
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tag.core/app_leader/MdhdtZD.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tag.core/app_leader/oat/x86/MdhdtZD.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4400

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Persistence

        Event Triggered Execution

        1
        T1624

        Broadcast Receivers

        1
        T1624.001

        Foreground Persistence

        1
        T1541

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        2
        T1628

        Suppress Application Icon

        1
        T1628.001

        User Evasion

        1
        T1628.002

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Credential Access

        Access Notifications

        1
        T1517

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Network Configuration Discovery

        3
        T1422

        Lateral Movement

        Collection

        Access Notifications

        1
        T1517

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.tag.core/.qcom.tag.core
          Filesize

          48B

          MD5

          046a414913add6f5bb60072c7db819b6

          SHA1

          451ee4f6809260aec622d772fd329c7d0297a842

          SHA256

          b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

          SHA512

          4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

          Download Submit

        • /data/data/com.tag.core/app_leader/MdhdtZD.json
          Filesize

          153KB

          MD5

          d404e19de2066a633ce3579bd08e1754

          SHA1

          7d93107338d3c4bba2f41ea8c8e17c5840e2655b

          SHA256

          49c246b2e442d426260dfb98c685cfe7ea3f3a4e53dd7e30123aeaa56c1a86ee

          SHA512

          2b495514679de5cc576d3cbd2becaf3bdf6cbc0026fd292cd214484188aa28edcf7d98c4477b3094164d53884dab6bbcdb219883b87dd037fb0026d3d0fbb8b7

          Download Submit

        • /data/data/com.tag.core/app_leader/MdhdtZD.json
          Filesize

          153KB

          MD5

          49b5eb9574a68e3a88e373d56aed0f8b

          SHA1

          f38fb3d20d6fbbf425aa5df18f139fcf9d07e7f1

          SHA256

          3ad49b3fb8e9596f7755c8a81d89edeb4f19fffc2de154e9326f09b4b017b311

          SHA512

          0c724f109beebeac43e8f845dd8055275e6e47cb7c8a2e29cd367421e32422fae162834e14f0c26f8f1408b9cf337a1f458649ca2ae76d2e9839d148aa2d6ca7

          Download Submit

        • /data/data/com.tag.core/kl.txt
          Filesize

          45B

          MD5

          11659df1bf64cb65e88af427b3b49a1f

          SHA1

          e0803c2c4b50444fb10de9a6ff0b08677e0145a0

          SHA256

          6d0c8ab367a4e34b6006b38be35b2e78f67ef1b6349dd703eaff31252f220788

          SHA512

          bc224a6b9fa2f5d845ed3ae1c21919ccb74f33f18a61036efa2ace9af3c7ef5a4ee5da7860a15085bd0e3bb7463cbd0b250f5c55a60a7471b5e5aaae850c0524

          Download Submit

        • /data/data/com.tag.core/kl.txt
          Filesize

          423B

          MD5

          7249ee8701b8cf1ea7b378597003cde9

          SHA1

          e8acb1675e20bc14fa711a08909e5bb6b113b6a0

          SHA256

          7754815643cb090272272505ef77ffe18733b20ec58dfaea6f1ef3c274db6d9d

          SHA512

          1026311751b3dadde2b96d3c335db04475c9a5a936080708e935985ee8706bc1364fe44c8803e591dec1dd25e0c9793e36adce217030078c3a6de33f69459a50

          Download Submit

        • /data/data/com.tag.core/kl.txt
          Filesize

          230B

          MD5

          734fb22602c8b31976b35f14406cbe74

          SHA1

          fcf0611e6f61380ac4a37985dc87d03cd140d4a4

          SHA256

          2980d90475fc0ef1d00530237a0654fd44634d3ce263d1c94ed1a8ad561d58ad

          SHA512

          95aa915d3493c901a9ec38a2d368dbd053533c183a57e136ec530f37ec32f4b892304a5904c02268a05602ca76d4eb7139d814ad3e5fabca9d2ebedf7c8d7edb

          Download Submit

        • /data/data/com.tag.core/kl.txt
          Filesize

          54B

          MD5

          5a764bd7c45f781cef39ba2335b46fda

          SHA1

          7eedb73073e0bbd34825d5fdc9b210243782e1e7

          SHA256

          53a68c01d5e0fe021577ee3676e53d2c8dceb83b44feb475d2a1b4e6d2ef2196

          SHA512

          43951539dc1d3c987fe4b1d28b43a72ae0744502f89ac83f84c5eddd8485d6bd90c337a583a56cc2fb722480365aaa995f930825d6a7667e1c5ed2c45c832d75

          Download Submit

        • /data/data/com.tag.core/kl.txt
          Filesize

          63B

          MD5

          e73da62d188d250048ccad3d405d682d

          SHA1

          9d1e09e8b0e719c86a40af2f716f5a1019847193

          SHA256

          ac0e16d7ccb06062aafaf665ee32de30cd2d6a6e846a98abc97fc60bff272aa4

          SHA512

          3d2652eb65ef7c6829c7d5c21bc1d252f5751e586ea28de81b39c7259e96dc7c01d739fafe2a50d6f646958aacb96f20d4fed2feef683cade316ab7c50e14773

          Download Submit

        • /data/user/0/com.tag.core/app_leader/MdhdtZD.json
          Filesize

          450KB

          MD5

          f4f0bb3bfc072b75b0e5029d71b35220

          SHA1

          359882acc4cc03dbd890efe7fc2a270e796c5d3c

          SHA256

          60e723dacbbcbabefe3fe9d669d3b070e2c44383f1463ef1c7b4f9b1cb68fa80

          SHA512

          113be1e1a3469976ee83acf2b2f2121b235308370f0fc44a4d6a64004ce2037200a0c6b60cc37a39e3d83568857a28c5643104e693da349443e48ac6fecdff96

          Download Submit

        • /data/user/0/com.tag.core/app_leader/MdhdtZD.json
          Filesize

          450KB

          MD5

          27dc13226931cf15334b1b582af7bf98

          SHA1

          d86181b9691150a1c716402c361a9601cf5aa3c3

          SHA256

          4406fc7f852e7dba2afbd39140fc72afd0f4f6611bd21c3cf78023cb37a0a6cf

          SHA512

          4379fe38967270753ef58746ecb89567a2c80986f5b9a94ddfbbba9a5da774a4b03b4054a168699efdcfcd483047f51752de5489255665dce26e4d1df0b2380a

          Download Submit