Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    25-12-2024 22:01

General

  • Target

    5227ecf3dfeffd02d7bf7dd9a493fdcf281387e214cb05057920fa460cc97271.apk

  • Size

    297KB

  • MD5

    d60faac79a388a81ea92408b9883a996

  • SHA1

    546fcbbcd47add7aaa6df0d909b6755b1b10c498

  • SHA256

    5227ecf3dfeffd02d7bf7dd9a493fdcf281387e214cb05057920fa460cc97271

  • SHA512

    b04f94c1b62b9009344a7089c55acaf977c3248855815f60742d3246746ff506c31f8f216a22b9d86a994c289eb59753fb70522fcbcec5bffdb1c3d888f9c461

  • SSDEEP

    6144:l6Rg0UayNUorRvu5Ym/rzY/yCfp1qsBxGRHPv5VeHkcMP/EuGH:yg0lyNdRvarDzkVGBTCAHnI

Malware Config

Extracted

Family

octo

C2

https://fenvefizikdusunceler.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesanatinkaderhikayeleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenkesişenyollarinhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinkaderlemuhabbeti.xyz/NzkzYmVjMjc2OGUz/

https://yoldasyolculugunfelsefikizleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderserininsamimiyansimalari.xyz/NzkzYmVjMjc2OGUz/

https://dostlukvehayatinbaglantivekaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenarkadaslikveseruven.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinkaderseltonu.xyz/NzkzYmVjMjc2OGUz/

https://kaderselbaglantilarvesanatyolu.xyz/NzkzYmVjMjc2OGUz/

https://dostlukveduygusalbaglarinkaderi.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinbaglantikaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderinkesişenarkadaslikhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kadervesanatinbaglantilersanati.xyz/NzkzYmVjMjc2OGUz/

https://hayatinkaderdenbaglananhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinsanatselvehikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kaderleyoldasserserivenvesanat.xyz/NzkzYmVjMjc2OGUz/

https://hayatinbaglantilarlaornenyanizi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikbaglanserseruvehikaye.xyz/NzkzYmVjMjc2OGUz/

https://kaderinbaglantilarvehikayeleri.xyz/NzkzYmVjMjc2OGUz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.healthlyfy.track
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4349

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.healthlyfy.track/.qcom.healthlyfy.track

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.healthlyfy.track/.qcom.healthlyfy.track

    Filesize

    86B

    MD5

    9a9e94ac5da3b61a1ade3a287e7c35c1

    SHA1

    64f1265cd51a556f817940158e0b12bb7d44f311

    SHA256

    87eaef630e86d57cb8c26713ce1ead09bf490aa38ae2b0f0a115066574427a9b

    SHA512

    924fc359af3a0ab7082f6c1ee6ace311f849dc29eff93f89f7c658fcc61d372c52180ca553bdca96f0dacaee783fd73238967967ad83185ce1e56f1d896c0768

  • /data/data/com.healthlyfy.track/kl.txt

    Filesize

    214B

    MD5

    4736c643d22baeae93a9f8f716253b88

    SHA1

    b508492e1b3e17fe0360cbeda498834e72902029

    SHA256

    fea899f1d1656050b81c47937127c84c884e2ce58a0de59fbd0dc3eabf95be2c

    SHA512

    ac515c793c110d32e9e8d0a76470580eb22301251167a010b571c76e1ca5c5a27daa2052b2cdf88fd9e9554614faa7f14bdc4d03bdfd7ef7ba8cbcd2b8fd1098

  • /data/data/com.healthlyfy.track/kl.txt

    Filesize

    54B

    MD5

    2671d29df4be0461767aa2381e320469

    SHA1

    2d521de6ccb8069a575dc2a491bf2ce58c06f97e

    SHA256

    204b52a040ba492a75c4fd7c71edcb41db971215a4d67070c04e9c1a437246c5

    SHA512

    3c2a4d4e7427ecaf5c13395c813f7f8f62c6b0bc8497204b2d7497472033f3ff59df34bb1cc214de75074d1c3b8fb744ce36577bd886f91cc4f425151c8002bf

  • /data/data/com.healthlyfy.track/kl.txt

    Filesize

    52B

    MD5

    b4287d675a6be4d065eb6a7574d4f3fc

    SHA1

    f19b2d69be352c1aa5e1b19cc72eb17e9a14592c

    SHA256

    4b4d947a324953048a04623ad06b378f9cbf40f1dab00efca6fc3d713ca5c828

    SHA512

    c7bafd9a48dcbe8c6ae8da84b6cef16688eca0386d2792256509a141b49e8fb01acc9f45e90faa61161f7e0b14667bd1bae8b5e760c4aa4ed90deaaa9ceede34

  • /data/data/com.healthlyfy.track/kl.txt

    Filesize

    70B

    MD5

    5ed1447ec182636bcfaa2ce121159f2f

    SHA1

    edb766c01745525bc2420f4b3e837728aa1229b2

    SHA256

    d1e31cbd98ff0b2662d19982c32434ddc4f08cea5113ea1dcfdff2d5b03b4130

    SHA512

    1c2491a2aaf3325f76c3c5d9bd33202e8eaed473ca680cd58f6c7910abf91b3f84ba410395bee939e5479c56ce4ba355cf618ec82acea290dc09a69e69ecaeba

  • /data/data/com.healthlyfy.track/kl.txt

    Filesize

    490B

    MD5

    e6577e60fe66aa0c224874e73819b5be

    SHA1

    1fe418e5e31b25c0ae916652a45c49a1a71e5e72

    SHA256

    e5c41fd2548db323a4d892157d71cce2289f7d42fa6087df017af18c166132f1

    SHA512

    d7a22f32fd49083430c53c98dd9cc64becbbf6317b5deef993e2c360879ca9fa4469e20f57c273f98aa9dc94354209588002846ae6e10bf3a421ea0844432e25