Analysis

  • max time kernel
    141s
  • max time network
    136s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    04-01-2025 22:02

General

  • Target

    1baccb07281aaf021e311320923ac6d3e79bb0fa5594e66f383c9265f36679b9.apk

  • Size

    1.8MB

  • MD5

    9e1197688790ff7caf7d2a57ca8e26f9

  • SHA1

    e815e0228a523a06f2a537751795ea2debd2d780

  • SHA256

    1baccb07281aaf021e311320923ac6d3e79bb0fa5594e66f383c9265f36679b9

  • SHA512

    027559ee33215f8b3d0b66e655ddc941a08b914869fda8f293f2f540999b1c3b818832cab82ac69a8dfee5a31808687029eb8bc4a633685babe029bf02c1a446

  • SSDEEP

    49152:BK7ZhSCH5zP21q2d1Fwua1tOdjLfsz+3FRhItZ:AFhSm5W91qRbcFRhq

Malware Config

Extracted

Family

octo

C2

https://tulumpeyniriyoreseltatlar.xyz/NWNlNzMzN2Y4NmI2/

https://dogalyoreseltulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelecekgida.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritarifvedokusu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivelezzetmasali.xyz/NWNlNzMzN2Y4NmI2/

https://dogalmirastulumpeynirleri.xyz/NWNlNzMzN2Y4NmI2/

https://anadoluyatulumpeyniritarifi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselmutfak.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritutkunlaridiyari.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerkulubu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengeleneksellik.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerindunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritatlardunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselsanati.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivetatlisesi.xyz/NWNlNzMzN2Y4NmI2/

https://dogalvetazeanadolupeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirisevenleryolu.xyz/NWNlNzMzN2Y4NmI2/

https://lezzetdunyasitulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelenek.xyz/NWNlNzMzN2Y4NmI2/

rc4.plain

Extracted

Family

octo

C2

https://tulumpeyniriyoreseltatlar.xyz/NWNlNzMzN2Y4NmI2/

https://dogalyoreseltulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelecekgida.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritarifvedokusu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivelezzetmasali.xyz/NWNlNzMzN2Y4NmI2/

https://dogalmirastulumpeynirleri.xyz/NWNlNzMzN2Y4NmI2/

https://anadoluyatulumpeyniritarifi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselmutfak.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritutkunlaridiyari.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerkulubu.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengeleneksellik.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriseverlerindunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniritatlardunyasi.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeyniriyoreselsanati.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirivetatlisesi.xyz/NWNlNzMzN2Y4NmI2/

https://dogalvetazeanadolupeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirisevenleryolu.xyz/NWNlNzMzN2Y4NmI2/

https://lezzetdunyasitulumpeyniri.xyz/NWNlNzMzN2Y4NmI2/

https://tulumpeynirindengelenek.xyz/NWNlNzMzN2Y4NmI2/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.fly.hurt
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4944

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.fly.hurt/.qcom.fly.hurt

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.fly.hurt/app_help/auXlrm.json

    Filesize

    153KB

    MD5

    057ddacc523265e44ae4a669c076b428

    SHA1

    2d05fca78550eef21374456bafdd1b8e515762a0

    SHA256

    98ff17dd40d239f23b95f576fd53520f58843969ca0551035e1ff53365679e22

    SHA512

    03ad4269c7fa4b169232094db75a9055c340206a7e2df95b3250428b8b7d216350a2ac8a1bf7824bf3888d8277396f2edb77c0965a5996230b9d544a30baa532

  • /data/data/com.fly.hurt/app_help/auXlrm.json

    Filesize

    153KB

    MD5

    45dee761abef268012f70b34852504a6

    SHA1

    168a5e3ccccf9f4cfcdaa8c313d1e97aa9e64c70

    SHA256

    e603c9eecb1cce7d5ebaeb003c1dc40a6803ba6d1acb9b6e1ae78e0d5a2b3699

    SHA512

    71a41a82838454521ec0788986bb0a457ad3d882372ae4405158dee8a1a95bc24d84767244eca71adf48c79acdab9277956218a2268cdadd5ec3724d8e89ca30

  • /data/data/com.fly.hurt/kl.txt

    Filesize

    230B

    MD5

    eaff6f6dea72d0c3c520ab84e82f8c6c

    SHA1

    774d57fd779aa97547ddda61cf99c712104c712f

    SHA256

    3feef7e2dc5d3026345399ef6962c9de06cb8d3e95e1ce27543a60ddc48b00ea

    SHA512

    3b1dcd2170c08f77581a3c27996dc0e615907d8ff6ccd8215b3fc2336d9bf1b71088504365f19c24a5fb57bdf574f6b42acf2dccf03d2b21ec1c4a86a86745ae

  • /data/data/com.fly.hurt/kl.txt

    Filesize

    54B

    MD5

    ede5a687fbe001951f067ccde59e42f9

    SHA1

    ea942ab88f975c1d912faa8763f108c7ce0a703b

    SHA256

    9d1be5d00d911bcc14503129ed4dfaf3515558dd2cfb2d152d67457613956cea

    SHA512

    1979afb3e09b976ee5e108f4a4c067fd2e01f79fc24d21a9254e5dbffc7bb881a01934ddd80d8fe87a3ed06ff6785eeb93db5168989efaddf5b268ec744e3373

  • /data/data/com.fly.hurt/kl.txt

    Filesize

    63B

    MD5

    ba899008dce92304fbf1b5429757187d

    SHA1

    3b668026dcc75428d092cb9a0fe4f28cc684e5e7

    SHA256

    94c16ee70a88e49270b24dee476d2e249bf60600c248f74dc0d96211c8842889

    SHA512

    a13b4c2a59ff2020c628498646fcb591df8b40b888a679fd1aa67e099b6f5ebfa9d99796a74a456bf4017f79457b3a6bc78ad8a8d80a6c98ce914b3a944ac490

  • /data/data/com.fly.hurt/kl.txt

    Filesize

    63B

    MD5

    d1df3c889e8bc612b1e7bdfa7a118748

    SHA1

    8d3c69784bd6fb05c778665b5ab0f2d22bd104b9

    SHA256

    4f2e75e22079aeb7dae6ee6e843fd57cd3d9067435327b3cad7e133505a48280

    SHA512

    89e07dae856c1ddb794f5f6509ef6566f0817c7771937c70ed14c6d22dc16d2161a2034219e85ed5105d2b1064792fee842fcab5552a5df2f914cd72418b6b8f

  • /data/data/com.fly.hurt/kl.txt

    Filesize

    423B

    MD5

    06440a69051236fef0760cd6ad7b6638

    SHA1

    d544ed909eb8073a584c8d947dfba33a8ccf34ca

    SHA256

    7db4d54429bfdd14420f46441a01e268335449941249ef5dfc906a43ada66d57

    SHA512

    b4e77e5fb07f44e8cb611182a1810420da2a56f9e09c69f51bfbc273cc1f68cd5350e6df66a6cd4c9de31a80a19b91fa7937c6e910686842b95d0ec76c245ca1

  • /data/user/0/com.fly.hurt/app_help/auXlrm.json

    Filesize

    451KB

    MD5

    004a8e9fac714192f2cc9d3ecc39b9ef

    SHA1

    174e687b767ca4f3a9479311ae41443343e2c69e

    SHA256

    b3c8b9d85e7c7a6f96d9aff37203a59980742aa7949dfdd35f1a5ef104cc4302

    SHA512

    debac581d71677a47798587d4cc66454e186a3e50786c2b49fab1e0c079262199e915acff80717bbd80646a42d5929ada8e7825c33c18b5d3331713f542c1f3e