Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    18-12-2024 22:03

General

  • Target

    44f1b0e9f03744ef3e9bc6f50e67c26665149c00813e1cf80ef932dfc3ea861a.apk

  • Size

    1.9MB

  • MD5

    1d62108a0a2efac882b5b34b13fa7c27

  • SHA1

    349893c1761179866a0625b7c9bf0fa17485aa8b

  • SHA256

    44f1b0e9f03744ef3e9bc6f50e67c26665149c00813e1cf80ef932dfc3ea861a

  • SHA512

    c3c125e68665825d4dbbe78cb8d54a2436661437e27f8867bdf2650603f257a2ac58ea264df19d43796913123a3f1814f5399900630ec9be292af38f34940696

  • SSDEEP

    49152:JETDz1l2mOmqraRHd0oHQxk1M9T/EyI26lR1PeX:JETD7jZRD0owqWTsyI9R1GX

Malware Config

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

rc4.plain

Extracted

Family

octo

C2

https://cosmosalienadventures.xyz/YmJlYTFiODdkMjcz/

https://intergalacticvoyages.xyz/YmJlYTFiODdkMjcz/

https://stellarexplorations.xyz/YmJlYTFiODdkMjcz/

https://quantumspaceodyssey.xyz/YmJlYTFiODdkMjcz/

https://extraterrestrialhub.xyz/YmJlYTFiODdkMjcz/

https://nebularresearchlabs.xyz/YmJlYTFiODdkMjcz/

https://cosmicfrontiersquad.xyz/YmJlYTFiODdkMjcz/

https://andromedamissions.xyz/YmJlYTFiODdkMjcz/

https://orbitalknowledgenet.xyz/YmJlYTFiODdkMjcz/

https://aliencivilizations.xyz/YmJlYTFiODdkMjcz/

https://celestialinventions.xyz/YmJlYTFiODdkMjcz/

https://astralnavigationxyz.xyz/YmJlYTFiODdkMjcz/

https://galacticcodexbase.xyz/YmJlYTFiODdkMjcz/

https://proximaexpedition.xyz/YmJlYTFiODdkMjcz/

https://universespectrum.xyz/YmJlYTFiODdkMjcz/

https://keplerinfinityteam.xyz/YmJlYTFiODdkMjcz/

https://astronomicalpioneers.xyz/YmJlYTFiODdkMjcz/

https://xenoscientificera.xyz/YmJlYTFiODdkMjcz/

https://orbitalscientists.xyz/YmJlYTFiODdkMjcz/

https://cosmicventurespro.xyz/YmJlYTFiODdkMjcz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.option.stamp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4323

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.option.stamp/.qcom.option.stamp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.option.stamp/app_company/PANiH.json

    Filesize

    153KB

    MD5

    b7aba767aaac13356d8a26765826af69

    SHA1

    707a694aed25652306d008eee6ba8f2b9e17108c

    SHA256

    2bc4f60e30723ceee725fa962336196a72a53778ce8da25ab85b2cb87759cf74

    SHA512

    d4dd5a7f98111dbcd4b2a7e21905c28bb004ab984a5e47a93a2af5e1979caac9c3b7486b1517082659b4cbb1010b32f4cb5e5a940e684b9d4ec728d4421b6b33

  • /data/data/com.option.stamp/app_company/PANiH.json

    Filesize

    153KB

    MD5

    5be02806f8c19174f770eaad77535435

    SHA1

    49f94d40785ed79242cb8586dc9801fcd54266fb

    SHA256

    6f9edc497936083eb49a0939b83eedc0097b6fc67ebd0c2745f5212fe41adfb9

    SHA512

    fd0cc8cfdd0f025b37e80159d49ecdb51d43e8cfeab36212f04909832ae8f78e8f0bc4401c90b418097c66f27c2c2c195acd66560f1f11beeb3cfa44e502db4e

  • /data/data/com.option.stamp/kl.txt

    Filesize

    68B

    MD5

    9c2e158966511f625a12536c94e16097

    SHA1

    78e752216f6eb063ce0c8a6a4d7cb0d1bea5644b

    SHA256

    5669d7bf58baa4e901e4ddc2463777f73373d8ef122ee27d3eed1e9203d8ca46

    SHA512

    9248408778cade97b1213d250303b647ab07c9a986b10f26ed0bcedaefa9179823878dcc254a7d1d8eabb646c7727831e6d1059ab3e2ee63813ba99b83c04b0a

  • /data/data/com.option.stamp/kl.txt

    Filesize

    70B

    MD5

    86f5bb09d5f5ae8cb4b9aa559d042b74

    SHA1

    a636363cd7cc8be51c9d1f2e0da99b402c51be3b

    SHA256

    c08a8f3f02911f129b93f1eba38836bd25274e8cca2a038a16952d731c449146

    SHA512

    81a68551e3031e6f5b9f7362f6d20b242f50378d376a6b823eb67c86b4ff373ffd9cd96d9a74007b507ef3a89deb75112e6344d9b9eaaf7f89747ca57c09f707

  • /data/data/com.option.stamp/kl.txt

    Filesize

    52B

    MD5

    99f9fbf6bf84f029e98a34080e0b1856

    SHA1

    c1c1d11c395f34d11bcb5b78332dfbf41df816e0

    SHA256

    4f4aefe0f55e61488fa8a9034481fe97000fcfef66596b757d7f8267d8009835

    SHA512

    21fba1789895069c6617da7772477d67bf1c1e5e8f706391dbf6d4201c1c4fc5be39964ffb714b5d628c5f71e2b8988f37ee1170b39f221d46229360ff8d7fd7

  • /data/data/com.option.stamp/kl.txt

    Filesize

    66B

    MD5

    1e662d20f1b48226b737c80388870635

    SHA1

    073de22ac6a9001e2e942b6f92517f9bf0ce625f

    SHA256

    a61fe1179bc35d333f7410779fda1b424f989d8cf0398ed21bf5931a45c5e779

    SHA512

    b5bbe8cca642568432c2b69b45fb366a5dccced1019104891523f2da78b1a5cfb4a83c88b78c2ea158e527e376c6751db30b4cd722455c0f445aac37ca305b19

  • /data/data/com.option.stamp/kl.txt

    Filesize

    214B

    MD5

    53ef83837a382f778bc0f206c2e7f58f

    SHA1

    e5f3d3e3539efbc2248f823b070c2c6ec7d962ae

    SHA256

    c37e89684e55bd0fce06f525c756a9e91af95783c5c3f545b22c5959f21c143e

    SHA512

    f28ba2116779318fed9e41ec07a46b4e51f7f8c551bcecd3b08fe3b163959d14edf12f3ce477063c243f8538e1be9f8480370f9f8e11375b3b5221b324514d45

  • /data/user/0/com.option.stamp/app_company/PANiH.json

    Filesize

    450KB

    MD5

    f2fa9f2e153cc4031c6eab2a5b33c191

    SHA1

    c01f6fa3e3ee7b6ef490a8721cd709667f1f58f9

    SHA256

    8c89e29b040a2c2e07746e611886e10cc4123df89debdba140e27e929b59db36

    SHA512

    aeaae142294047ddb246d568ec8755ad98dc341cd5098de9070b78e6c599ea652d3a55e40dc58f3fa5b18530c074004b6f3efa460226cf4e438d5192b02e071e