Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    04-01-2025 22:02

General

  • Target

    593d674059c9be85581585be40a2182d5be2ff2a26d22532eefdbec92fef0f6d.apk

  • Size

    297KB

  • MD5

    27b1a399533126391dd2db01bc4577c1

  • SHA1

    0d82432e05e325f84cb426bcffd271206e327e1e

  • SHA256

    593d674059c9be85581585be40a2182d5be2ff2a26d22532eefdbec92fef0f6d

  • SHA512

    5b9cef7e0d95892f0072d069c64d4d7eeb08106f44fa2d48b6edb28641b0dfb38abb99e31b4ce3e4985da32e6e65e167a6cd228723675b022a7a0562002dbd30

  • SSDEEP

    6144:mvl6Rg044avNUBrKvzqc8P5r4DR8RMiyXZoL9k1L2LKMYsU3R/EuGo:mqg04ZvN0KU46RJeoL9vYseRn3

Malware Config

Extracted

Family

octo

C2

https://tulumpeyniriyoreseltatlar.xyz/NWNlNzMzN2Y4NmI2/

https://dogalyoreseltulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelecekgida.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritarifvedokusu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivelezzetmasali.xyz/NWNlNzMzN2Y4NmI2/

https://dogalmirastulumpeynirleri.xyz/NWNlNzMzN2Y4NmI2/

https://anadoluyatulumpeyniritarifi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselmutfak.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritutkunlaridiyari.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerkulubu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengeleneksellik.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerindunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritatlardunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselsanati.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivetatlisesi.xyz/NWNlNzMzN2Y4NmI2/

https://dogalvetazeanadolupeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirisevenleryolu.xyz/NWNlNzMzN2Y4NmI2/

https://lezzetdunyasitulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelenek.xyz/NWNlNzMzN2Y4NmI2/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • th.ac.ru.uSmart
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4596

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/th.ac.ru.uSmart/.qth.ac.ru.uSmart

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/th.ac.ru.uSmart/kl.txt

    Filesize

    230B

    MD5

    3cea2e7e17e60e584555112e96672f50

    SHA1

    23dd876cb88b5e8dbd70219efe01cd4949dee2b9

    SHA256

    dc3d992c78c5ab323ddbf5a2d64b82190e5015b871f49bbe2be9624dd2687fc4

    SHA512

    b24b45d661960b99668b0bda14b96fdaf6194925ea20892b8fd454028f169963732b4e717c96d3bf4aa95b4c179060cf030200645ee574135bc89993651d4754

  • /data/data/th.ac.ru.uSmart/kl.txt

    Filesize

    54B

    MD5

    27236bc3a9b5e8836679b7a4e980029f

    SHA1

    a3f7ac28d843f7bcc8c11186115dd3011eeabec8

    SHA256

    d5f30307d7956e30ce2b3571a3b4dc970d8adcec8ea02290d3e7d859a19b7cf3

    SHA512

    141808903f0c3eff7c4348ecbc8b46998e09a087b90966c355bf4c2217e86f414cdb49395f76bc029977073de744d4b6d04858902473c9ec147f7ca4e1adac91

  • /data/data/th.ac.ru.uSmart/kl.txt

    Filesize

    63B

    MD5

    cb2a1a89d7dd940dd333b6310dc9ece0

    SHA1

    5209e11723a5c583beb98a767afbac6f227356f9

    SHA256

    059e1d3883626a8498df96967c0e757cc2dd2b076f477e62d28e6a3ec23a9c8a

    SHA512

    231693cb9973eec4f68e477d333d0777d6445a244ffb906750fbdf15d9abc792cbd519d245e7eb2a1c3ded775392547529ce32574756ed863a7c7e29731d2448

  • /data/data/th.ac.ru.uSmart/kl.txt

    Filesize

    45B

    MD5

    2f76f282b5477efbbeb3d29ae8c28688

    SHA1

    09e7837de6e430c83fe09c58a050e12abdfca488

    SHA256

    78ab38f182f079798cb31fd89fa04e4fb81865a28279aa4bbf1c5d91c97a004d

    SHA512

    0fe1a38d19136203c4fff38eea9dc811976aeb17302802afc61db94677751bc6868c74d9e0d9aa7ae0f7df764fe14719296f64b66a9bc223dffb3549db0bdcd9

  • /data/data/th.ac.ru.uSmart/kl.txt

    Filesize

    466B

    MD5

    5c5d74e1fa8fae5f2b7343c47aac2cae

    SHA1

    1310f5ccefd8b2ff94499e6573a05a627d4afcef

    SHA256

    1956f76f311e54f0c2467cf6976c95b504caa3cf571be17643130a4ecc872792

    SHA512

    969031a667b544b7c3bbbfa7d4eb8747b92ed59c526683f31fbb0679218e9248941df9e2d3bb467cec9ca3d2526989ce2737d085696d1e4b9c1a16655020a070