Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17-12-2024 22:08

General

  • Target

    207b1dc60898087552f5ab669f94e9d2f031865e425e1862756f1b041189bbff.apk

  • Size

    1.6MB

  • MD5

    4bcdb88f0bb5e497cad91c75067409bc

  • SHA1

    2392bf96d4d107c1a7d57b894092afe6ddabfe17

  • SHA256

    207b1dc60898087552f5ab669f94e9d2f031865e425e1862756f1b041189bbff

  • SHA512

    2f4613c0a7a1f282d899d17a6d611b0c2d93e6ffe65df07e963949e97d645501fc7b58dc987ae2746aeaecb23d1e0ec17230dbd808ab47bd99bc9cb79b38ba62

  • SSDEEP

    49152:BdnxA3D/eVK2xtb2R2V0LTlggJZRTRYNI:nn7px12R2ex/pRYa

Malware Config

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.tag.core
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4940

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tag.core/.qcom.tag.core

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.tag.core/app_leader/MdhdtZD.json

    Filesize

    153KB

    MD5

    d404e19de2066a633ce3579bd08e1754

    SHA1

    7d93107338d3c4bba2f41ea8c8e17c5840e2655b

    SHA256

    49c246b2e442d426260dfb98c685cfe7ea3f3a4e53dd7e30123aeaa56c1a86ee

    SHA512

    2b495514679de5cc576d3cbd2becaf3bdf6cbc0026fd292cd214484188aa28edcf7d98c4477b3094164d53884dab6bbcdb219883b87dd037fb0026d3d0fbb8b7

  • /data/data/com.tag.core/app_leader/MdhdtZD.json

    Filesize

    153KB

    MD5

    49b5eb9574a68e3a88e373d56aed0f8b

    SHA1

    f38fb3d20d6fbbf425aa5df18f139fcf9d07e7f1

    SHA256

    3ad49b3fb8e9596f7755c8a81d89edeb4f19fffc2de154e9326f09b4b017b311

    SHA512

    0c724f109beebeac43e8f845dd8055275e6e47cb7c8a2e29cd367421e32422fae162834e14f0c26f8f1408b9cf337a1f458649ca2ae76d2e9839d148aa2d6ca7

  • /data/data/com.tag.core/kl.txt

    Filesize

    230B

    MD5

    952ab0b39b5223677105149713796560

    SHA1

    e15e0d3623fa9b84ba7406041b4e23dc620cf27f

    SHA256

    7811d3021cfdad7e06534a315df348881316e3a2f13a12624897fdae8df14bed

    SHA512

    0fda9f2a11b62cb3143ec522585f1afd6234ab43e74e4e2280e4533b13cbc9e649ea624e4cc2c86efeaf63953908e216520306c5d954fa42a2ea7bf5712ab549

  • /data/data/com.tag.core/kl.txt

    Filesize

    45B

    MD5

    1c0b6103599a1b5cdd850a79f034e5a7

    SHA1

    20e0ad0aa8f7d2e51c551c058b65eff3ba627e9e

    SHA256

    8c3f662379b535dcec7f9ec559f06c46515a19e328269d0548508fbdfda45f85

    SHA512

    3b746bc25c1e8fc4f1bf3ca1c298d7def12d83f4a7451467737101ae619397bac63e8f34edcf82cb21bf24d21e6435f9e863fcf66c695ab2ae0becd692e92fae

  • /data/data/com.tag.core/kl.txt

    Filesize

    63B

    MD5

    c7474b5bd72f45462584c90aa99feb71

    SHA1

    5d458531e99f9dd9e8e1e27d4668d29a5b7ba120

    SHA256

    4cb7ea8077154b4e1f80e8969228c55ff6cf51468f62feb61d165eb6a9254d22

    SHA512

    af139c82394af4aa4b50c884f7e7343c703937187091fe29cec7e479f4157f50e0d1f5ab527d66b30573115fae4b45a685bb0c31bb70b6ff22f5f162bb894091

  • /data/data/com.tag.core/kl.txt

    Filesize

    45B

    MD5

    8a91e882a1e946fc770956ca76cad84b

    SHA1

    63b113e35f537e91d1e9b28e2d5e78df88b96377

    SHA256

    70112bb5c387579c1c35c757d52c2755f1bff8571f36c86daf9296c388b23939

    SHA512

    2a0c313846ceb3dbd7e1ebe0d5b1a54b8c006bfe3a05d85a4001fa228a0c6ce74189489488457d05eb8d8a1b36d9dd03eeb458d64713e11a76febc9b482745a8

  • /data/data/com.tag.core/kl.txt

    Filesize

    423B

    MD5

    367d578ece83a5512fd82a5ddf5706de

    SHA1

    da69a8735467a5279a731946ff87e9066ed336d9

    SHA256

    ec05445ffbcde9f03967da96c76b8856087e8fdc7ff84bd53ea92cbbf96fa2cc

    SHA512

    6672082f33e0eee4e67ddca98c9271a63cf8bbff8ca3f0c2f860a8ff33245eb7de3aa09ec906bc9a9b22edf65939d1fe28411f5c11e9f7e593dcb80d1f7b4ad4

  • /data/user/0/com.tag.core/app_leader/MdhdtZD.json

    Filesize

    450KB

    MD5

    27dc13226931cf15334b1b582af7bf98

    SHA1

    d86181b9691150a1c716402c361a9601cf5aa3c3

    SHA256

    4406fc7f852e7dba2afbd39140fc72afd0f4f6611bd21c3cf78023cb37a0a6cf

    SHA512

    4379fe38967270753ef58746ecb89567a2c80986f5b9a94ddfbbba9a5da774a4b03b4054a168699efdcfcd483047f51752de5489255665dce26e4d1df0b2380a