Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    07-01-2025 22:02

General

  • Target

    b2a61633de6fe5ef3fcb84b12a25b9aa1d25476b88f52448f4cab812b78c5fb8.apk

  • Size

    2.7MB

  • MD5

    01c25de1331593c94c83c659788e3169

  • SHA1

    7d5f23a790c119614ff94cda0e647059dfcaf120

  • SHA256

    b2a61633de6fe5ef3fcb84b12a25b9aa1d25476b88f52448f4cab812b78c5fb8

  • SHA512

    50c458be0d24db2d9d7eed79a1a4ee5c70a582e1b1cc48822bcb749e89ee766fdeb728bba32779adb9adc71ee6538dcb3564d7418afd20ac7c7b6c00ee24da5d

  • SSDEEP

    49152:ur4qRy6FWA8x2EBfAa1oW+fn729XDbQ03IVr/D+v6NEK/3jsuXygvnXFo7nmuS+w:u8qRLFWA8xNVA2+f7yTS/DX/TsuXDVoq

Malware Config

Extracted

Family

octo

C2

https://yesmincanruslane.xyz/YjVmNGU0NmNhODlm/

https://kaderbaglantilarindayanisma.xyz/YjVmNGU0NmNhODlm/

https://sevgikadervedostlukhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderseverleryolculuknotlari.xyz/YjVmNGU0NmNhODlm/

https://kadersohbetleriilepaylasim.xyz/YjVmNGU0NmNhODlm/

https://kaderinyansimalarindankareler.xyz/YjVmNGU0NmNhODlm/

https://kaderduygularivebaglantilar.xyz/YjVmNGU0NmNhODlm/

https://kadersevgininkalptenhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlukvegizemlianilar.xyz/YjVmNGU0NmNhODlm/

https://kadersozlerlehikayeveriyor.xyz/YjVmNGU0NmNhODlm/

https://kaderlerarasisamimiuyum.xyz/YjVmNGU0NmNhODlm/

https://kaderduygusalbagvetutkular.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerinrenklidunyasi.xyz/YjVmNGU0NmNhODlm/

https://kadersanatisozlerdeninsanlara.xyz/YjVmNGU0NmNhODlm/

https://kadersevgiyletasanumut.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerpaylasimbahcesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlarivehayatbaglari.xyz/YjVmNGU0NmNhODlm/

https://kadersanatinrenkligolgeleri.xyz/YjVmNGU0NmNhODlm/

https://kaderinhayatdolasimbirligi.xyz/YjVmNGU0NmNhODlm/

https://kaderinsadekalptenyansimalari.xyz/YjVmNGU0NmNhODlm/

rc4.plain

Extracted

Family

octo

C2

https://yesmincanruslane.xyz/YjVmNGU0NmNhODlm/

https://kaderbaglantilarindayanisma.xyz/YjVmNGU0NmNhODlm/

https://sevgikadervedostlukhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderseverleryolculuknotlari.xyz/YjVmNGU0NmNhODlm/

https://kadersohbetleriilepaylasim.xyz/YjVmNGU0NmNhODlm/

https://kaderinyansimalarindankareler.xyz/YjVmNGU0NmNhODlm/

https://kaderduygularivebaglantilar.xyz/YjVmNGU0NmNhODlm/

https://kadersevgininkalptenhikayesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlukvegizemlianilar.xyz/YjVmNGU0NmNhODlm/

https://kadersozlerlehikayeveriyor.xyz/YjVmNGU0NmNhODlm/

https://kaderlerarasisamimiuyum.xyz/YjVmNGU0NmNhODlm/

https://kaderduygusalbagvetutkular.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerinrenklidunyasi.xyz/YjVmNGU0NmNhODlm/

https://kadersanatisozlerdeninsanlara.xyz/YjVmNGU0NmNhODlm/

https://kadersevgiyletasanumut.xyz/YjVmNGU0NmNhODlm/

https://kaderseverlerpaylasimbahcesi.xyz/YjVmNGU0NmNhODlm/

https://kaderdostlarivehayatbaglari.xyz/YjVmNGU0NmNhODlm/

https://kadersanatinrenkligolgeleri.xyz/YjVmNGU0NmNhODlm/

https://kaderinhayatdolasimbirligi.xyz/YjVmNGU0NmNhODlm/

https://kaderinsadekalptenyansimalari.xyz/YjVmNGU0NmNhODlm/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.pudding.donate
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5090

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.pudding.donate/.qcom.pudding.donate

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.pudding.donate/app_famous/KCxaXcR.json

    Filesize

    153KB

    MD5

    074dd7ff930602db30a83540b88685a4

    SHA1

    6fd3c533f7445f1d8cdaed9c5412be917effc5d7

    SHA256

    f65a23ff979fe000f0df28084c74840b23002f8aa8887236653e1a7d629fe3f4

    SHA512

    21bb26660e002cc431747c5bd43d4d57bf636fe173898c3d2d22b80fd68d7364348bbd5fec13475d8d3102ec3c8266d1ba4190901de6e1010ac304aa25646041

  • /data/data/com.pudding.donate/app_famous/KCxaXcR.json

    Filesize

    153KB

    MD5

    fa17f7f0cd7a1a648aad9994d27100dd

    SHA1

    efc3bd40888d1cdf0acef3bb826b0313eaa764c6

    SHA256

    11aadef5343470299d939f6075837b66583dba9103f7c3ff854db1663cca5e60

    SHA512

    0cad41743c9f6f3ee02359f7659e8dead1c0e813ae3a069a286c44272deb43d0da02889a3fc6480cf741a395da9027387c5dee166001c0874100b97f71ae8ea8

  • /data/data/com.pudding.donate/kl.txt

    Filesize

    230B

    MD5

    e434e0ca73161bd59fadf000cf5079f1

    SHA1

    c1751178bd66bf54bf4b636b5875f76956d2f221

    SHA256

    0921a55b89f1170ed5cef9bfa8ef96af4512d9212e22ca338eb5dc14dab218ad

    SHA512

    33f556a6b03aa8fb4e87802f23319b6171c37624dfdc2eeb038f4157f53b08aeaa242d5f7ad3250bda1fc0706fa9bd2741e3be8038d04331300a5a2e765e22df

  • /data/data/com.pudding.donate/kl.txt

    Filesize

    54B

    MD5

    58d5c028589f2ad43e619fa594ada2b6

    SHA1

    d5715ec177c42e7a2f0c32bb083229d9d980433f

    SHA256

    f9d5a2c85e241d4f4c76a5f0ba56732ae528089ab90818b9593c8880dcdaf043

    SHA512

    41d3f08023e54d526b22ed0aed18ebab6610302837f22bb5e104ef7e78574396cc432021fb29563ff9e52c517fc08ca849d2ccd681c78fb16ed4283f5b184f1a

  • /data/data/com.pudding.donate/kl.txt

    Filesize

    63B

    MD5

    f1dded60f6a25ba21ce9e6c03d822605

    SHA1

    1b7880706b4724e24a8324dd2dd8deebd8ec064a

    SHA256

    72555339f27eb216b9f65b800be74c0a545a5aa6f4bf7e7a23293969292510b2

    SHA512

    da9a3ac086d1080922b12db97a7a259284be88e9b85e3decaa69a561f2ff44ab6809d011642161d78c32cd295c9aae6577ca0f88f56a428da9ebd1d665184da6

  • /data/data/com.pudding.donate/kl.txt

    Filesize

    45B

    MD5

    822a8c4844e26ca56e66f05561210cc1

    SHA1

    1215fa02ebbb8e093ed3d27a9e75940512ddf2ef

    SHA256

    3bf6fbc016e2b3f44ae7ffdf5550de5b2fb2637296a7daf485a958138894ea50

    SHA512

    c3513dd3cade99569c689b4112decd028ce5ef3ceeb5ecc6a3279044c8475ec92073bdb29e23e11088bde0b9cf567aa9bd4e442f734d1fd88a4cba6dc6857368

  • /data/data/com.pudding.donate/kl.txt

    Filesize

    423B

    MD5

    e02c48a7f0b15401be1498b5e68e101d

    SHA1

    1169769c65f59a5f69c4b5c63100b4cc77cc2b6a

    SHA256

    c74b299822bbc2b377b7e7a88c4e5ff6e48980d54eff3d340e811376b09ba385

    SHA512

    d4cd42a6250ffdeea37ac6e8519e361d3fc1c2e059085c370a5ca28927ac848e92a1d420fc59e5776356a460edb71f94af75539ad8e04ccd66e67d643091fcab

  • /data/user/0/com.pudding.donate/app_famous/KCxaXcR.json

    Filesize

    451KB

    MD5

    2eccb41b75e4d02f3cbc7a53b9da166c

    SHA1

    05ebc01976c290be6ab806599b4e24fad665db83

    SHA256

    b621000fb0c5cab95ce2c4065c5bd590c35c568e1e7f5e354bf3b622379461d3

    SHA512

    354f52738b78f04193c9bea04e1994d40780474eaa668523ac6b69cf7a01a65cc7adfc261ff38213ee532046eead05be4260f82b64ab180ac1971f5196d8b16e