Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    04-01-2025 22:02

General

  • Target

    6002830218a4834107a6f020b0fd063d7c9ced32edc4e5fb9e3b8eb52b6c13c2.apk

  • Size

    1.6MB

  • MD5

    4028dacfeecc2fd58e4e6754cb901fbb

  • SHA1

    88f63c7fd800a859fd6e74348b58cfcb69c6e895

  • SHA256

    6002830218a4834107a6f020b0fd063d7c9ced32edc4e5fb9e3b8eb52b6c13c2

  • SHA512

    8867ab5998e8a2fd21e6e06b101516147fdd5d5a72c484ca9d5a9e95ea8e3126201c441f7892f54260a002245bd5b893d827e45d6dda34205b7f0ad245dd8973

  • SSDEEP

    49152:0Jb0jHJxqTsMTFRttIjEONilLPsx9vS4yGQyt:TjHJgPTPttIjEONilL89vipG

Malware Config

Extracted

Family

octo

C2

https://tulumpeyniriyoreseltatlar.xyz/NWNlNzMzN2Y4NmI2/

https://dogalyoreseltulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelecekgida.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritarifvedokusu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivelezzetmasali.xyz/NWNlNzMzN2Y4NmI2/

https://dogalmirastulumpeynirleri.xyz/NWNlNzMzN2Y4NmI2/

https://anadoluyatulumpeyniritarifi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselmutfak.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritutkunlaridiyari.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerkulubu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengeleneksellik.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerindunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritatlardunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselsanati.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivetatlisesi.xyz/NWNlNzMzN2Y4NmI2/

https://dogalvetazeanadolupeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirisevenleryolu.xyz/NWNlNzMzN2Y4NmI2/

https://lezzetdunyasitulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelenek.xyz/NWNlNzMzN2Y4NmI2/

rc4.plain

Extracted

Family

octo

C2

https://tulumpeyniriyoreseltatlar.xyz/NWNlNzMzN2Y4NmI2/

https://dogalyoreseltulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelecekgida.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritarifvedokusu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivelezzetmasali.xyz/NWNlNzMzN2Y4NmI2/

https://dogalmirastulumpeynirleri.xyz/NWNlNzMzN2Y4NmI2/

https://anadoluyatulumpeyniritarifi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselmutfak.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritutkunlaridiyari.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerkulubu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengeleneksellik.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerindunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritatlardunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselsanati.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivetatlisesi.xyz/NWNlNzMzN2Y4NmI2/

https://dogalvetazeanadolupeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirisevenleryolu.xyz/NWNlNzMzN2Y4NmI2/

https://lezzetdunyasitulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelenek.xyz/NWNlNzMzN2Y4NmI2/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.term.dilemma
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5140

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.term.dilemma/.qcom.term.dilemma

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.term.dilemma/app_camera/wUxnb.json

    Filesize

    153KB

    MD5

    3d1e8deb10fe1c7fe807a4d09f981281

    SHA1

    94cdf1c8dc7cf0bf5c723dfed070ba16ef7e728a

    SHA256

    1e8ec3152858ea4e32bcb75b8423ae0c053300d04477e1978655e3b703d42a10

    SHA512

    a3d6846519e5e4a77680407f4a4a659d675cde3670f9834f0ca24eb1db4afd30e017e150a2e561230715f8449174f9e7905d341dffb76dc5c010fe3093dbfbc1

  • /data/data/com.term.dilemma/app_camera/wUxnb.json

    Filesize

    153KB

    MD5

    f28ef4a73078c698505f8e9f257be1a4

    SHA1

    348d9de4dc0616f743bdff019a9d719040b69167

    SHA256

    9a5564d65dfbdab882c8da72b0d2ac03987411579cc3c2f9cd16331fa6300ae2

    SHA512

    a4dcd878f9855a062d8452aa493bab7d7c2c0cbe760576616231b2603bbb44d93dadaf54d36d74de4de3de7110479225e731ccd814bc7f6368db2401bf6fcee3

  • /data/data/com.term.dilemma/kl.txt

    Filesize

    230B

    MD5

    3cea2e7e17e60e584555112e96672f50

    SHA1

    23dd876cb88b5e8dbd70219efe01cd4949dee2b9

    SHA256

    dc3d992c78c5ab323ddbf5a2d64b82190e5015b871f49bbe2be9624dd2687fc4

    SHA512

    b24b45d661960b99668b0bda14b96fdaf6194925ea20892b8fd454028f169963732b4e717c96d3bf4aa95b4c179060cf030200645ee574135bc89993651d4754

  • /data/data/com.term.dilemma/kl.txt

    Filesize

    54B

    MD5

    27236bc3a9b5e8836679b7a4e980029f

    SHA1

    a3f7ac28d843f7bcc8c11186115dd3011eeabec8

    SHA256

    d5f30307d7956e30ce2b3571a3b4dc970d8adcec8ea02290d3e7d859a19b7cf3

    SHA512

    141808903f0c3eff7c4348ecbc8b46998e09a087b90966c355bf4c2217e86f414cdb49395f76bc029977073de744d4b6d04858902473c9ec147f7ca4e1adac91

  • /data/data/com.term.dilemma/kl.txt

    Filesize

    63B

    MD5

    cb2a1a89d7dd940dd333b6310dc9ece0

    SHA1

    5209e11723a5c583beb98a767afbac6f227356f9

    SHA256

    059e1d3883626a8498df96967c0e757cc2dd2b076f477e62d28e6a3ec23a9c8a

    SHA512

    231693cb9973eec4f68e477d333d0777d6445a244ffb906750fbdf15d9abc792cbd519d245e7eb2a1c3ded775392547529ce32574756ed863a7c7e29731d2448

  • /data/data/com.term.dilemma/kl.txt

    Filesize

    45B

    MD5

    2f76f282b5477efbbeb3d29ae8c28688

    SHA1

    09e7837de6e430c83fe09c58a050e12abdfca488

    SHA256

    78ab38f182f079798cb31fd89fa04e4fb81865a28279aa4bbf1c5d91c97a004d

    SHA512

    0fe1a38d19136203c4fff38eea9dc811976aeb17302802afc61db94677751bc6868c74d9e0d9aa7ae0f7df764fe14719296f64b66a9bc223dffb3549db0bdcd9

  • /data/data/com.term.dilemma/kl.txt

    Filesize

    423B

    MD5

    049ea579a57948eeb48d8267aa4c8ca3

    SHA1

    789f12a82ce1385beaf1931362ce3f3e575207bd

    SHA256

    87167e2ecf6ad8308ed9b59f43e9c4f7b1fd93e30ccd910421834828c38b1c7e

    SHA512

    bf783e5abd273401e11d8602973a210d283315b972a43bf995fdb62051f3055a8f1f2f8212f9ba8acb0dc7b985b1cf8fc2afd57027f7e64404c1e2fc0f79ae1e

  • /data/user/0/com.term.dilemma/app_camera/wUxnb.json

    Filesize

    451KB

    MD5

    bb94b42c52d45d7c2a81ea0bf56dd7b4

    SHA1

    274c4008427a7c373bfcd03de89e7c00533d44de

    SHA256

    6cfa652c36213e338cf690dca5d80332d64511a6baef11b12a15c68ec2f9843e

    SHA512

    8105ecb6c6b51dc658cfa76d26489f8ce56fd27fbd45126fe495f6004ca392970fb66ae8ff8914b579d163af57fea0dcaec8579a7784789bfc1b322339b98604