Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    23-12-2024 22:04

General

  • Target

    121469eca1864d681f5981c48f734dfe4c897f8a1a259b2ac8b1e05f1e8706d8.apk

  • Size

    2.1MB

  • MD5

    7a6311e8a24165f05e6c32cf3f9a4709

  • SHA1

    048e660cc92abfd22ccd1adc074ee50ab999594c

  • SHA256

    121469eca1864d681f5981c48f734dfe4c897f8a1a259b2ac8b1e05f1e8706d8

  • SHA512

    33bd4c9ec0b91ebfb656a6b631671c5444830c656db02fdecfe9fdfb2d3d76a7325d4256324fad2a9faf25e0c50b43e715886192356b499c564023c53b5020e6

  • SSDEEP

    49152:RMNpuwqk4eowx2neEzQTGjRHa7iEQyKk5S6f/Hm7hq4sxX9fY1A:RMNAre/QnvETGjR6OUKURfCq4O9CA

Malware Config

Extracted

Family

octo

C2

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

rc4.plain

Extracted

Family

octo

C2

https://karateustalariningizemlisan.xyz/MTk5MTQ4ZGNkMDBi/

https://karateyolcususamuraidurusu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatefelsefesininizleri.xyz/MTk5MTQ4ZGNkMDBi/

https://dojovekaretekahramanlari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatesanatvesavasustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraivekarateduruslari.xyz/MTk5MTQ4ZGNkMDBi/

https://karatedoguveteoribilgileri.xyz/MTk5MTQ4ZGNkMDBi/

https://karateantrenmanvesanat.xyz/MTk5MTQ4ZGNkMDBi/

https://karetecininkusursuzvurus.xyz/MTk5MTQ4ZGNkMDBi/

https://kareteharaketveteknik.xyz/MTk5MTQ4ZGNkMDBi/

https://savassanatlarinindunyasi.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalaringizemlibilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://dojoyolundagecenanilar.xyz/MTk5MTQ4ZGNkMDBi/

https://karatetarihvesanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://karateustalikursunumetodu.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekahramankitalarustasi.xyz/MTk5MTQ4ZGNkMDBi/

https://samuraikavramvesanatifelsefe.xyz/MTk5MTQ4ZGNkMDBi/

https://karateevrenselustalikbilgisi.xyz/MTk5MTQ4ZGNkMDBi/

https://karatekapsamlisanatustalari.xyz/MTk5MTQ4ZGNkMDBi/

https://dojotarihiyolundandegisime.xyz/MTk5MTQ4ZGNkMDBi/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.fee.agree
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4357

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fee.agree/.qcom.fee.agree

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.fee.agree/.qcom.fee.agree

    Filesize

    87B

    MD5

    088b58ab711add0b5ddaeefca0734e0c

    SHA1

    4a088f9187973f6ba974b72efb7ac15f5e6f7e6f

    SHA256

    f598b166c9f17f3df1761caefce50089f81f887de4aa73a86201deebd031b0c3

    SHA512

    a2bcb1ee48a020dba046945d49d3c752e0ac9b75d283e0b55fedf83bfec4fb3bf9050fb709ca87602f5fcf9ccec63787969200ff8654964a4c71d3d0622f17dd

  • /data/data/com.fee.agree/app_kitten/mEB.json

    Filesize

    153KB

    MD5

    a807eb78aac496856d13614740252c32

    SHA1

    075dbaa021a212d867e14b1715033358cf7f2578

    SHA256

    1e3feb854210c2875beb3c9324496c7541e464d01e4e512525b2c7b5b7dec7e0

    SHA512

    a3d39a83cb10cf09c3f68e4ffec3ea929b77e9ac19bacb4da20af114d9d00dfb1438f9cf8ce776afeaba585dfc28741a0f2dfbb7768e8e4b9e16e292027f68d2

  • /data/data/com.fee.agree/app_kitten/mEB.json

    Filesize

    153KB

    MD5

    c4fa3d59f773a6ce504111013531a5c4

    SHA1

    1da13629e75c9f0cc4351fdf083ec5e3d986a093

    SHA256

    7c1a1b9cbfb429f190ddb62255adfb40bc1dd2e1dfdfa697bdf782afdb0dbddc

    SHA512

    66b398677c27cf93ab0bb4e832425cb4effb1570eefcdf6377c2a5ca04aa36c6067891b1fc05886b7959ac5ba5231c4882ad178d421abf1960ee2d987bea0047

  • /data/user/0/com.fee.agree/app_kitten/mEB.json

    Filesize

    451KB

    MD5

    a7803e7019fa0f88704b92595e8367e2

    SHA1

    69c86ae3754a589813faddbb5065094f66101e0d

    SHA256

    033ef1d416e8d614a429c3ff73e7c55913f80e2297775aab0426f63ef3c4d5af

    SHA512

    bc89012aa81618f15babe9f23330d606d816c15c4cabf52ffe7ab9620b7d1595d929322b3356a59d259d18ab3407371b62a4ef3e202e2ce830032fbd98419cb6