Analysis

  • max time kernel
    264s
  • max time network
    254s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-12-2024 14:06

General

  • Target

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176.apk

  • Size

    188KB

  • MD5

    b696c4783a18fb9927328ea52fd90ebb

  • SHA1

    b52559586147f8497ce18ef08ea842e23382c63d

  • SHA256

    4d2313e40ecc1cbe582b3b4b78b481c1d00417d9bba02ea98787157c55210176

  • SHA512

    62ea74e26e6989acb10d88a714831ec4f9691fb56d6b3ba03ad6de05073af6ae34fe08f1b4188655590219c7c8be270c8e829ac6c636f8cf588044f18cc5a500

  • SSDEEP

    3072:aRZ8bmdcEreU1STVizAbqMjFywt6xg2icXcplvKEslH2k9tdh+xKU:4FdteZSAbq8FyS6xr3XarslH2ytdh8

Malware Config

Extracted

Family

octo

C2

https://154.216.18.131:7117/gate/

https://builder; 154.216.18.131:7117/gate/

https://panel; 154.216.18.131:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://builder; 154.216.18.131:80/5db7e5d4bd11fc539337/gate/

Attributes
  • target_apps

    com.google.android.apps.messaging

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.android.messaging

    com.bmo.mobile(英文)

    com.cibc.android.mobi

    com.rbc.mobile.android的

    com.scotiabank.mobile(丰业银行手机)

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher (英语)

    com.kutxabank.android

    com.rsi

    com.bbva.bbvacontigo

    com.android.chrome的

    com.akbank.android.apps.akbank_direkt

    com.denizbank.mobildeniz

    com.finansbank.mobile.cepsube

    com.garanti.cepsubesi

    com.ingbanktr.ingmobil

    com.kuveytturk.mobil

    com.paribu.app

    com.pozitron.iscep

    com.teb(英语:com.teb)

    com.tmobtech.halkbank(英语:com.tmobtech.halkbank)

    com.vakifbank.mobile(移动版)

    com.ykb.android

    com.ziraat.ziraatmobil

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.adaxffsfzfada.zbsvxgsvbxhdgs
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4474

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/.qcom.adaxffsfzfada.zbsvxgsvbxhdgs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    46d85cdb2a366f1465188d3e4f7b9a93

    SHA1

    90c8183a3bbca490ff13f71b9e74417e3dd12399

    SHA256

    2c9aea3fc19d726f7136358ec63779055305348dcd15517c5991f71335bfad76

    SHA512

    8989d668c3ae7212a38b2c3ec0815b05b394e7b8f363699e4bbc4a5b5a38fc675cc856fa634d598ab87d984ac0bea7f27db23c6c313b8ff54402bd4c20c8e74f

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    44b689ad200aa99abe6c341433a69d65

    SHA1

    556bbe5d44161c330eafa4eac38d0a4704478656

    SHA256

    afc9fb19b4ffa3fa64c22ea3f70c2b65a208425ec10ee8fb9494b75bfe6662e5

    SHA512

    d8787fdf28ba40afe8695dc6563ff1cbf1f54f5f0da224ba0540d245ed613c55718427a6345ac891e2171288c5d9cfaa97bf0b1201258cea00893880a66f33f8

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    79B

    MD5

    386bbca53ac02546443875c893ef6964

    SHA1

    1981a565fec2e82450f4a72fcccf25b5b5f4b2d8

    SHA256

    7e3d22790c2a1b9f5e8d5366a908bffa9797c2dca15a3445e2fb0216405408b3

    SHA512

    8b3b42ba7fa5716402988fa70aa1e4bd401505b2df9a2ad5e5cec2c366f598feb01bf098fa083d0571de52cc1b32b84593f67204a6f1fb723cb104214ce78d5e

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    466B

    MD5

    b579283911a49e1e870e0d17e8109d5b

    SHA1

    113caa54acec5f80e1a120fcf65178c9af3596c9

    SHA256

    7566c174558975583517c94e284c3662ed4fac8c5ced6d4232820fdfadc50149

    SHA512

    5c00ca3c6894e0a2e1f739abf002ba7948459a1932ed8b3e4d37090669374793beb3cd3f624d4773f5a81f836a19ea61c2b666445e4dc23cd39b421b03000153

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    76B

    MD5

    40c39a949d1e1e24049707259c1263b9

    SHA1

    83868519322644f2d74764cc8c21cebb5a00bf47

    SHA256

    fd58e070a7197baa6b53c3e419037dc07c4e98a180e503d1dc7419084db165d3

    SHA512

    e3ca6b80467664b3e945803d2c794099821600d7d0bbe589c7cb6db3909b37032bca61f0cdb5251b63ec7fa8b58d6215252e226abb55eb7c25465bdf8c30e3c5

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    548243529aa9a8c90cf47d2aae903f2a

    SHA1

    4ee9b597d15f6eae68e9c433e18253125fa0824f

    SHA256

    0aa2599289aeab5e3d05ff3c50dd09b95a87df712d348c80c5e1e41cb071b995

    SHA512

    ddd9a91b82d6f1a325757234a68cd764a6422de1120417d5737d86f77d141c8702a1edfe4bf4b0f2c50464c81aeeac9bda8fd12a7e04877c2ed7686c9deb6c51

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    fe8c419e062987fce46c9eac1c942709

    SHA1

    eb7b15ca40aec6c91bdc052a29827ea56184033b

    SHA256

    60fcf19b70f046f626391d00a491c9ebbcbbc8f9e31cc5b4d41b37013dafd3bc

    SHA512

    4d4919202e8421af6c188f1be8678adb5e2e347358e03fd11e7a0fcaff6a7c2e3cc54355ea503025efde9a692d60793905b88cea88c54a3bc23fae6676656638

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    873676c160389c8f69ce12ceb318ff13

    SHA1

    cdba3bcec7e70faa996ee8545d877cbec45358fe

    SHA256

    58be8aee7cd24597b3653c0cf3ae3de15df52f482671fe9b03af16ae5f7cf072

    SHA512

    1f4dc7962e1fcae824dfcd1d319dbb767deb38f2ae8ceb73e69489d1a634f6db7ac8690d5ac7c6da8bda1e9ea6035f82eb8616af719d7fc4dd3507b15ef17917

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    76B

    MD5

    9907d8e3d3b659a3dc004029a2763c5a

    SHA1

    915c88b8c066c88e935faea3e238adf36a1d8448

    SHA256

    a5444302558cfba38ab364a6e5f1eea8185f5f8c797646bfe733ea3081267f9b

    SHA512

    06bc191ef219b2c064988d86619565f5b584c4d2107ff88620dea59f970554f83fcce6b4d9bca81e7bf639f3cb2920893edd637a2f11ea351efeab594e9b3b17

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    4d4401d7d4ce140a3652e4ff68e0795b

    SHA1

    f9ade3c8b6b9dfdda9a8a1e6380fc5b578972aa9

    SHA256

    a5fa3aaa8623f8e92f80247c3c04ca3db482e13cf9a4903bdaebc3544ebce9f9

    SHA512

    7c477e8fb41af45e4954461812cf8eb3bfb65faa30fe784a4146176ab482fd82ea70a46746b6f96bfa2a08409d44d2cfc8e4256b37a678e6e8b82d391fd86ce1

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    179B

    MD5

    959062383704e8d9043fcb2c4532472a

    SHA1

    f649ad8c2bbb073dd6ed1843da2be37696bb6f3a

    SHA256

    c6783938da89bb749a2b15fa36469fee431978631b55e5d06b9994d4f760c6e7

    SHA512

    7c93bba04ddb8c9f4393c8063f9447edd4747c9c06b6b609576c472efcaa44d9dfa6a8071b38c616c0b0f791845c594b319679dc31b2bfa638969e37c91f7561

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    66B

    MD5

    4d3cf45ce5523f8a32603896aba85aff

    SHA1

    e36be559885f51c4dee2c1543a8ccf4834e4a8d2

    SHA256

    7f4f6b43fd076a15e2b4b139f778b3e732b337e3c4f360286d008d8b1d66e5be

    SHA512

    401fd44bde4e1ee5210e9f25c9905e8cbf1a81dee0312fa9d78cd604a346607a8c8a16096a3d4c23ead2916d7f11cc3dcc3c9cdbefc8a8322f3f4086d6ef7de6

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    dd360eab6773329ca314df0536539c8a

    SHA1

    7c053e2bf6f6d18517c8e1d0dbedf3d25b96ff19

    SHA256

    b975440a0a9d60576ee4c96100e6b5100b55391164dee9018932d1fea95fc2ae

    SHA512

    8a06bb22d53a191e607b573513bfbfd78b52a18f432c7ccdb3cb440f934f7d3bd620d3d42b0274fd7d8dab3cba81d342c0978338a18743baa62595e584338b22

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    84B

    MD5

    727ede3990339b64fd103e7b807d48e8

    SHA1

    c326dc7e7b390936652d492c1f49ef4786c41273

    SHA256

    a4f2be11d152571eeb0bd8e455c7e0baa8df1b4a68263c91f17d6140d7263a74

    SHA512

    0008d478ac1e905e66592c0eca6ca414220eefa62ba4451a34c786301e762ffbabfc028a3e9f3118490842248a68314270ff05ee587883a860ac25e78e4e8a39

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    de32fb30b0f61a0719b183b853d6b676

    SHA1

    f9f89d8bf3998cb122d43c28c339a7b05afe400f

    SHA256

    0f9594b7b35479741c6eb8e9844cb1a8be7c99b0265ef3522fc01fd300e940c9

    SHA512

    2923c0f132b925d5b8a19d1b3ef311413941a8164c23e9ec50849f738aba96cde0368a47bfe5bd79f7cbd36cbef1b9d39900260f3e2463033f7c4a03bed5d52a

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    91dfa69fc571687593d1a4193b51d27e

    SHA1

    b1650e49b68e965a8c2ba8b820c7c87578b1016e

    SHA256

    73f00e9e70cccaac34e4b5073b0cba2614482b9c4b6627a5ecf353927e4c6084

    SHA512

    b82f2766497b216af3a4d8bfefd35433c376355ca418703883c4e1835549ede7e52916afa55bf531c3291f3570e8e93fce18de389d1128809632b9ffbff8d7d3

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    230B

    MD5

    465082014740a84226cc9e99f3cee189

    SHA1

    1edcbd203b5662d64f847fb674ebe719fef877ec

    SHA256

    1bb7eadc2773656887a88f96cc9fdf71b035dda205a4d71918bfce16485ffe0d

    SHA512

    f44ca7684e86a8b0cad9aae6ec5c4483a11fbf1b688baae9ffd31d0fa947138c5eeb78b9d2e02069ab85a4590ef765ae93967767a48b156905adc22f76f75bbc

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    64B

    MD5

    965280f09442cd3edc636b6e678be838

    SHA1

    34fae0cf84a1f07c4e0b00628e505cec47ef8353

    SHA256

    a0c2f536295900247b6f9ae7c0f78024f4bad7457dcd06725348c0bcc31e889d

    SHA512

    7339fcb2934429a5a8ac73e40b6ff5aa8ee5bfc0f3c1c91bdcc5b1a4f14ad151b8640c1c21a344d64e19216fc424747bee5546270c49dd2fc838417942a42bfd

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    715b1518e0adbbda4c5a578d7c7dfd7d

    SHA1

    2b5991636e8ad91acf74f7f0fbbb0b2cfb95d0ff

    SHA256

    e73358219a35f57b44692ee35c156e7233cb16d35d5d4f45eef7b3d2c88ba73e

    SHA512

    1ea590cc0448ff118540bfb017291c6fe7a7398a788f03b7083eeb70c0a4797fe7a1bd5d249187da64f016725908578494d6bb7b3c1f1dddc8970bf65bdc67fa

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    63B

    MD5

    4dc68741fed889c7e241a9b53eb63718

    SHA1

    d540209ad593a66e732a61428247db9f2b22d06c

    SHA256

    4d29c5e47a38a2f0f9b2d7f4841d24b004933bbb59e263c33bf945417189a084

    SHA512

    eaee1813a35c9b97ff271c75a41fce753e0c39dcd574c5692a5412189404b8a3259b809171bce8109e1fdc8d17f8d3e82757428f3776458c7ec31ec84e8c1ce4

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    45B

    MD5

    b60cf9f70b39debac29c132f3ca50f9a

    SHA1

    8eacb9fd3c3ec3d774b3a67b7a51cd6b0b6cb05f

    SHA256

    67bd56ebdf51dfadf32c2e3171b461b56b12826c38d1bcd7537958f30b4597e7

    SHA512

    a4ae93926718842ca49624f179d91836df8692dbb0bc74432e123d626ff44e62cedf4b1f33f4349825e5891ae268e3710ac9b91cf8b618932d5aa196f9a10015

  • /data/user/0/com.adaxffsfzfada.zbsvxgsvbxhdgs/kl.txt

    Filesize

    68B

    MD5

    cbbf98c0013b9955d85fe131441a9b9f

    SHA1

    fac5683ac5fd8ca4c4804f6451e356fea48697df

    SHA256

    6c818a8259d633c06fe8de54cce370d9deeb70217a49424e6df028f253af5c48

    SHA512

    9fe33c057e1e1b4a10a2cf2d2ce27862a3531471c86e4d9f9972459cf2a3680b327b1ae45cb04b1d34788c514b478e4611fcc301c86bb0f3b018707a27e7ca93