Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    27-12-2024 22:02

General

  • Target

    5e6389f2a37a6f0657258eae5d3402d1f563c6f5bc219bba685199a63575f35e.apk

  • Size

    2.1MB

  • MD5

    0c5fee3560ee30f98d428e6dc937c036

  • SHA1

    a654f2fe6157d531d9c1d44bca530e9d86f3d681

  • SHA256

    5e6389f2a37a6f0657258eae5d3402d1f563c6f5bc219bba685199a63575f35e

  • SHA512

    0b54e477323a97f91d0ac0a83107a1124fe1a00f934ad9b8dc5e35ac7bd2a82c2ebc9aa202865dd13a40fab6627ac0a2784a52ad838d04902b9fb5d7f4a33580

  • SSDEEP

    49152:p8+nl65n9B9P1sNA33wa29/k0VM+9N4Kta8pfctjKjgQXn:p8+nc9BZCNAnwa29/k0Vooa8wwg8n

Malware Config

Extracted

Family

octo

C2

https://fenvefizikdusunceler.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesanatinkaderhikayeleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenkesişenyollarinhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinkaderlemuhabbeti.xyz/NzkzYmVjMjc2OGUz/

https://yoldasyolculugunfelsefikizleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderserininsamimiyansimalari.xyz/NzkzYmVjMjc2OGUz/

https://dostlukvehayatinbaglantivekaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenarkadaslikveseruven.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinkaderseltonu.xyz/NzkzYmVjMjc2OGUz/

https://kaderselbaglantilarvesanatyolu.xyz/NzkzYmVjMjc2OGUz/

https://dostlukveduygusalbaglarinkaderi.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinbaglantikaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderinkesişenarkadaslikhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kadervesanatinbaglantilersanati.xyz/NzkzYmVjMjc2OGUz/

https://hayatinkaderdenbaglananhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinsanatselvehikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kaderleyoldasserserivenvesanat.xyz/NzkzYmVjMjc2OGUz/

https://hayatinbaglantilarlaornenyanizi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikbaglanserseruvehikaye.xyz/NzkzYmVjMjc2OGUz/

https://kaderinbaglantilarvehikayeleri.xyz/NzkzYmVjMjc2OGUz/

rc4.plain

Extracted

Family

octo

C2

https://fenvefizikdusunceler.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesanatinkaderhikayeleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenkesişenyollarinhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinkaderlemuhabbeti.xyz/NzkzYmVjMjc2OGUz/

https://yoldasyolculugunfelsefikizleri.xyz/NzkzYmVjMjc2OGUz/

https://kaderserininsamimiyansimalari.xyz/NzkzYmVjMjc2OGUz/

https://dostlukvehayatinbaglantivekaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderdenarkadaslikveseruven.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinkaderseltonu.xyz/NzkzYmVjMjc2OGUz/

https://kaderselbaglantilarvesanatyolu.xyz/NzkzYmVjMjc2OGUz/

https://dostlukveduygusalbaglarinkaderi.xyz/NzkzYmVjMjc2OGUz/

https://hayatvesamimiyetinbaglantikaderi.xyz/NzkzYmVjMjc2OGUz/

https://kaderinkesişenarkadaslikhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kadervesanatinbaglantilersanati.xyz/NzkzYmVjMjc2OGUz/

https://hayatinkaderdenbaglananhikayesi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikinsanatselvehikayesi.xyz/NzkzYmVjMjc2OGUz/

https://kaderleyoldasserserivenvesanat.xyz/NzkzYmVjMjc2OGUz/

https://hayatinbaglantilarlaornenyanizi.xyz/NzkzYmVjMjc2OGUz/

https://arkadaslikbaglanserseruvehikaye.xyz/NzkzYmVjMjc2OGUz/

https://kaderinbaglantilarvehikayeleri.xyz/NzkzYmVjMjc2OGUz/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.quit.catch
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5070

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.quit.catch/.qcom.quit.catch

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.quit.catch/app_source/QP.json

    Filesize

    153KB

    MD5

    80e2bb539b85ee3f49ea09cfb57b791a

    SHA1

    6aea63ee4b855c6ae842bdf779221ea3296d0477

    SHA256

    5ea02f3ec877744db01c2e727928745b5b72e6908e94325c6384bbf186786a56

    SHA512

    35677e5a6bda1538a738cb0b23aafec742875cdd4df54e7355cc84b95dabb9c1d4254f652f8a74507edbdc94f36cede508e1864201d61a9fa150d69e69a1e167

  • /data/data/com.quit.catch/app_source/QP.json

    Filesize

    153KB

    MD5

    a0f077b34268e1d0d2eb546961706b25

    SHA1

    439fd21bd0f8883772c5cb1c5309ec4253664a77

    SHA256

    8c1bd49b334e1f19ed6e13deabfebdaee44de5e74b97b7ee131a413b126176d2

    SHA512

    215b70a63b93069abd6eeda91f4f792743f271ca0bd20fca8c3b088e7aeb70ae336913d8167ae455aeaad3680891d0f430c54ee569cc5e2228efcdc79e6254f4

  • /data/data/com.quit.catch/kl.txt

    Filesize

    230B

    MD5

    fc6ad310b0a2ce5988d426974bfd66ee

    SHA1

    bebf04d851c1a21636193f8529d049c8357abfb2

    SHA256

    a3cee021bd72506ecd67ebbb6cb4ec48be13c65b3cd80cd4a779637355c1538c

    SHA512

    1e14cfe5709c205f2c6531353d56c91559ab51fc16dba647fdb766cfb6735e526d08b364cfee7b7097fc7a9c782a711a4e89bda3aa4edfe88c361ba5b9bccb0b

  • /data/data/com.quit.catch/kl.txt

    Filesize

    54B

    MD5

    70cdc418f7275384ec0c5eb957f48213

    SHA1

    87660b3afe958dc3184997ddc74b7db7bc87bf68

    SHA256

    ce9e33a695b572b4ba7eb209d250bff23b00db49f2f605926ff738306981f8b3

    SHA512

    21bfcb65e25ece5f1b4fece2e5beb4c63b4ed1abecabce12111d704bd1b0ff0fe68095d07c0adeb31265d8ee6857cd9bf3d30518adea61229d26e61f9c0f9b89

  • /data/data/com.quit.catch/kl.txt

    Filesize

    63B

    MD5

    44203ec577b85c21897808020bf5ccf5

    SHA1

    233f5cc33f1a5432f61fa89e092e80ff483e778d

    SHA256

    7c8be3d9fe5b6458fcb087c35587d07c060357a643a6cdda6571f3c2b8c33545

    SHA512

    338ea17beb002c70cedce19af24ba6cb7e9bfbd3c438d6d117904e7147679de2a1c316d56c9110b593caf9dab461ae5c63c1afea119d6a0c7f92e853c184842e

  • /data/data/com.quit.catch/kl.txt

    Filesize

    45B

    MD5

    b9353aece3dfa25432747af3568f9234

    SHA1

    57872f5edcb42786384f11d4291d30d3b49f2e86

    SHA256

    0f73aec690269c1e8477fc69bc91e89b41b427fe7e7ce00ce7bcd404f4f88c6e

    SHA512

    11c9be097eaa5e2554547b6e29be99171aa24f8539ec1ba6a2fcb8841eb81720d061289fdbe79da3289b7492bdb0aee3077cc222fb3122beafe37e84a51d77fd

  • /data/data/com.quit.catch/kl.txt

    Filesize

    423B

    MD5

    410aa547ead1b23bc7f6332b73a59f1f

    SHA1

    c83e5dfb4954b87ab7451528522410549d44b18e

    SHA256

    fe1ac52335d80d99793214f858a58de425a63ae11fd55aaa500581774ad5d6d6

    SHA512

    de6f73682d39b23aa87220c6b575139a0f616c515c29efdcea86862b2dad20d5d25f38c4bf6ce7336c5efbc21dcf5201c90a705444ac8dce523da6514992ae76

  • /data/user/0/com.quit.catch/app_source/QP.json

    Filesize

    451KB

    MD5

    1f020a2b268f3e62bfa59b6e9b42fa50

    SHA1

    847be25392a81ca8c6f2c686e812f9ab76c70ebb

    SHA256

    e4c4613fc417abe38e7cf7dad1abf9a74fa43d8a0c8db1817ad2dbb9a1cb6c81

    SHA512

    cfe043bbccf073ced3442c846ad89458ae7360b7c5681cd0d9a678a49d028c4b29fddd6c825f22d64541985a40fa104c7f118d615ec5ad686da90d9d62b310af