Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    22-12-2024 22:00

General

  • Target

    d2605b2c1189d62c24a3e9706474167182f4c3d4e82f473b27c239d8a5657382.apk

  • Size

    1.4MB

  • MD5

    46f636c56da42786d2f9e5d8ef534796

  • SHA1

    7f3bc4caf05a8f749ca2680da4c798cdc79b2150

  • SHA256

    d2605b2c1189d62c24a3e9706474167182f4c3d4e82f473b27c239d8a5657382

  • SHA512

    98f0d38b4064d6ad789e59cfb5e141675ea570ed61da3b5f5cb5c1d7e977a46fd053c64f3a9ae4af255f8f3ccf75dd5fb5507ef4c79be9c200925a7a908ae660

  • SSDEEP

    24576:k9B/NNmAxSeMzjXwD6xoT6a/Me+iit7tRhhJRF3q2Xm6PD9QqQ8q/p4gIcIfXPsK:CTSeyjXwD6CT6rii3XhJfq2XmIDhQrpo

Malware Config

Extracted

Family

octo

C2

https://aliencivilizations.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkalptensozleriyolu.xyz/YmE4MDdjZjg0NTNi/

https://askvesevginingizemlisozleri.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkalbinisanattanifadesi.xyz/YmE4MDdjZjg0NTNi/

https://duygusalsozlerinsanatidili.xyz/YmE4MDdjZjg0NTNi/

https://sevginintarihindekianlam.xyz/YmE4MDdjZjg0NTNi/

https://askvesevgibilgeliolojisi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininduygusalseruvenleri.xyz/YmE4MDdjZjg0NTNi/

https://kalpleredokunansevgiizleri.xyz/YmE4MDdjZjg0NTNi/

https://sevgininsonsuzluksanati.xyz/YmE4MDdjZjg0NTNi/

https://sozlervesevgikavramlari.xyz/YmE4MDdjZjg0NTNi/

https://askveozlemsanatifelsefesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininilhamverenhikayeleri.xyz/YmE4MDdjZjg0NTNi/

https://sozvesanatinduygusalifadesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkutsaldunyasinyolu.xyz/YmE4MDdjZjg0NTNi/

https://sevgininfelsefikseruvenleri.xyz/YmE4MDdjZjg0NTNi/

https://kalptendokunanhislerinsozleri.xyz/YmE4MDdjZjg0NTNi/

https://askvesevgininzamansizhikayesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininsanatidunyadayolu.xyz/YmE4MDdjZjg0NTNi/

https://askvesozlerdenoluanzenginlik.xyz/YmE4MDdjZjg0NTNi/

rc4.plain

Extracted

Family

octo

C2

https://aliencivilizations.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkalptensozleriyolu.xyz/YmE4MDdjZjg0NTNi/

https://askvesevginingizemlisozleri.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkalbinisanattanifadesi.xyz/YmE4MDdjZjg0NTNi/

https://duygusalsozlerinsanatidili.xyz/YmE4MDdjZjg0NTNi/

https://sevginintarihindekianlam.xyz/YmE4MDdjZjg0NTNi/

https://askvesevgibilgeliolojisi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininduygusalseruvenleri.xyz/YmE4MDdjZjg0NTNi/

https://kalpleredokunansevgiizleri.xyz/YmE4MDdjZjg0NTNi/

https://sevgininsonsuzluksanati.xyz/YmE4MDdjZjg0NTNi/

https://sozlervesevgikavramlari.xyz/YmE4MDdjZjg0NTNi/

https://askveozlemsanatifelsefesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininilhamverenhikayeleri.xyz/YmE4MDdjZjg0NTNi/

https://sozvesanatinduygusalifadesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininkutsaldunyasinyolu.xyz/YmE4MDdjZjg0NTNi/

https://sevgininfelsefikseruvenleri.xyz/YmE4MDdjZjg0NTNi/

https://kalptendokunanhislerinsozleri.xyz/YmE4MDdjZjg0NTNi/

https://askvesevgininzamansizhikayesi.xyz/YmE4MDdjZjg0NTNi/

https://sevgininsanatidunyadayolu.xyz/YmE4MDdjZjg0NTNi/

https://askvesozlerdenoluanzenginlik.xyz/YmE4MDdjZjg0NTNi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.region.eye
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5169

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.region.eye/.qcom.region.eye

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.region.eye/app_refuse/NDL.json

    Filesize

    153KB

    MD5

    0ab0ecb8e5b01f58a10d7951134f2f18

    SHA1

    517632fd125148d7ad2a5a9ae35c52a28b9dacfa

    SHA256

    80e1f3c88e4f76753831a2c64d57cad3dee331a6d51e56a789767939591ae832

    SHA512

    d60f2aa61fa6b2d988051304f76a4db1cf3b84ef52b2b692fc4e1a88ad6f2be05e17738c533cf1654f078bedabb0a3a72a047adb3aec6ae9e78b8e106d0b363b

  • /data/data/com.region.eye/app_refuse/NDL.json

    Filesize

    153KB

    MD5

    b7850e579e87bffa872e39dd132afaa7

    SHA1

    907fe501c39066322a1f71f402ace831d828b8ab

    SHA256

    b2e739114da8b753117ad7b89b8aa7324c5b85bc9760dd260f68256b33e77193

    SHA512

    7a5604fc072f1b36bf7623bdde7ad5c4e45c1c9ec16b4ec7442e60580742e2bb01c46b12a824b7c79ea6a8c78e5ce5cc6375c64ff9aba584de5a4727854c740b

  • /data/data/com.region.eye/kl.txt

    Filesize

    230B

    MD5

    f2fd13057a8d4712be9b0b5655e77578

    SHA1

    b5cfe8d18d2c2d178719cf5c3d50bdf9f2b79e7f

    SHA256

    6dfe18bb29487557e7649d2edcd31bb03ee4450e365b3c8e6fe5f384450b87c9

    SHA512

    250994b3612fd1397261025926ba1a355082ecef40b7a3be75a1d09d175f9c97f1b437171bc6d2c1fc91e0ed41001878e555d50558971fa5cc2fd07f8d21a7e1

  • /data/data/com.region.eye/kl.txt

    Filesize

    54B

    MD5

    9e02e04a217c749f8775f8c1963ef59b

    SHA1

    c3cdce034a02a10d8e6dbc069005088bf2eba6ce

    SHA256

    3cfd6378e399230d3ed7815f6d35c2d001d786470f220fcfb760fc16ff9e75b5

    SHA512

    47b19bed380642cc8e0bff71c4fb82bba2ba4e53f887c49238affa4c11440fae589e21722b4b18834a76217938665ed201851d8a68ce1fd37ff332cefe624801

  • /data/data/com.region.eye/kl.txt

    Filesize

    68B

    MD5

    4867ab724af957d294dcc0c4458a0671

    SHA1

    0c1d41b7b02a97856aedc9e203e3555c7ac72e18

    SHA256

    ea3c585ae148309e6589bf1cb50d6a7d29c6ed93c03c8bbbca0ad01a8d957d98

    SHA512

    2e90f82e7fed97020a8af1f3bd484adb5e1b89793f5631db6e93272a255a76e9e3efe56e6af5be23c621aa7018161a004202ffbc870255947dae99f43c339f0c

  • /data/data/com.region.eye/kl.txt

    Filesize

    63B

    MD5

    0d190be8e4dffb96dc873127005c5fae

    SHA1

    fdca24a6ae9d0dacdfaf8b275a85c89124fadbc9

    SHA256

    8a3f1649825e95e2104891ed443ee262c2301ce7fed082fa08039f0d248cc562

    SHA512

    ec9e10afa058a474e14ead8a0b23ab309defe18459d44dfbe4505bc2b70e572a5639d3d2f12111eeb3f3452a68935472ad4d5a9776aef0d640bebdd8210055bf

  • /data/data/com.region.eye/kl.txt

    Filesize

    423B

    MD5

    178ed712b1bf197b205d02ffa97e27f5

    SHA1

    000acd5b97098a09fa4a02db0379a93a356e191b

    SHA256

    f8118092be07e14cdac378bcfab9c549efb76124c2bf75f2b578099c8181b1d0

    SHA512

    67e485165900d1149b86282f57d0a2f3611a0009f7267c0fe678bf771efc921df2cd4e6394dd3f5e2064adbeb178bb3a518effb981b94acd2d76fbfb5f802d36

  • /data/user/0/com.region.eye/app_refuse/NDL.json

    Filesize

    451KB

    MD5

    19e45d11c7d9974819181f088117b6ee

    SHA1

    3a9311e297357f11363afd58b9ea3a0e9b78531e

    SHA256

    ba95e7712dc1b00694fa19dff92c7597f7538f3eb11abc77875653f7ebfec43e

    SHA512

    9addcc2eafe7fdc1435da8b4a43b79de7c1207df47cb1d3bb90bd223330a28d8dfb00de9b3b5dab8bed00ab5f66209811bd91d8e46e62abad57e5e76a5ab9f9c