Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    10-01-2025 22:01

General

  • Target

    e63ec7a95751f8e19b7bebb88cd4d4b99236a8df4a79162c66b8bf86a1b9e312.apk

  • Size

    4.5MB

  • MD5

    60dd34268abe84ab8cd2e5e5a028d34c

  • SHA1

    0b5e4d1dad9f388ee4f3a64db05cb3582c8827d0

  • SHA256

    e63ec7a95751f8e19b7bebb88cd4d4b99236a8df4a79162c66b8bf86a1b9e312

  • SHA512

    f65862847727eb8c687e2c23c27989d20dc45494cbf6c975f417b065527f2fe2298fbb707b72e17d06eb265640aa0bacab4c22bac09137bbe52c247e0da631c6

  • SSDEEP

    98304:mMdWRtbkrIk/Iu8g4X3RfQnOLITlIhubbuVQ7wiMMpBABv4AF5KCfasLZpGrVXup:ROzQ7lMEBAFJ/v6Xup

Malware Config

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • jp.neoscorp.android.valuewallet.sole
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5096

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/jp.neoscorp.android.valuewallet.sole/.qjp.neoscorp.android.valuewallet.sole

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/jp.neoscorp.android.valuewallet.sole/app_wagon/xlPTofe.json

    Filesize

    153KB

    MD5

    b7c622168f52d3350c392d4fdbcc2ba4

    SHA1

    25ac30d81a0dec63b741b4592a9b97158e331d0f

    SHA256

    ad9e91518b40cf2c760a83e442b73ea4d49543f7f801daa29d36cbb5017a4477

    SHA512

    4c2eb5742ffadb6bc900b0b1d06ef17c667ccf895d721dced3367e80c4c79b83af2bfca3caef63ed9a518536a85e015f950fe46508cdaf69cba29b6ca6fbeb84

  • /data/data/jp.neoscorp.android.valuewallet.sole/app_wagon/xlPTofe.json

    Filesize

    153KB

    MD5

    42e311d8c145ff4f5be1621c02460c20

    SHA1

    f28510d54b3a9657f53a5974ca1c38b093e320bb

    SHA256

    31d2ca2b000fe60346a31a4b2bd1c3847ddd48f3004714c93f4d346fa6e9133b

    SHA512

    4d6c7734b34a4839b9988af9489caa409c0a1234ef30a9fa6630365f0cf1f2252607144ad2402cbfd2ab7e64b4eb9b55c4595bd3d902372104ce30182ea384f3

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    68B

    MD5

    f65e701e5b8bfc49ce8df5707d19608d

    SHA1

    6a4237e8f59c709b8c68b633d886701f2d9e8c17

    SHA256

    a869dc8804ac772dc2b0408cd5dafa663c98fabe88202969210e3224f1d4fe09

    SHA512

    219f35244c537de601b20904156343a5cea7886b72fd3603a060c7fb94d229bfca6bc1a1c6196b4a3b03b6424f9d5e810d0eabe3f29b0388d68014f2152be803

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    230B

    MD5

    e4beb4b212d3ae1e750ca317cc529116

    SHA1

    e6ee14458d5cf4acc9f730d5be1c51fdf78ecb08

    SHA256

    ee23d43ff10a601c4c4e8df0dd0a5e3c0f98e882f9d93dca491b8b93fe4a7aa6

    SHA512

    fa62967de801aeaa42a54f71460bce3abcfca6a85fc2bdefcabd9d22c5c6c772f5c9fb2ae0f1e3d866b527aa887e0f2153602cff5b329069e98f8407cac1d29e

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    54B

    MD5

    77e700706ab054920b8b02802bd9dd98

    SHA1

    4ef3ec67e6694961b971915e345d84c5b81b3c94

    SHA256

    22904db2cb2618fe6ffa35c14958ae94e4d0fb97b6e32049d7486badb743ae67

    SHA512

    9e9c641e6c190df631d4bc74238352e1f8c8344b493a9e84c01a1813aee000d0ba6908a310438448f2691827397f049d8502d2694ea7e64afe068b797abbe615

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    63B

    MD5

    bb49453017bc018eff7ab2e6d4b89205

    SHA1

    10194adaebff94eac40393d5d30d95f74ae2ebd7

    SHA256

    843ac3f23f9917c2d9a07eac52acebd2c2af874f8f1f61ec4f4867e8f7a7277e

    SHA512

    91d4a2d5cdce23280aed1dd3ddd9fa355a8395ec83b055b8b2cbc429f19102fb84ffdcdbba6429d23bd81bcf076587840fbbedc7bd6a73961e400880a7c43233

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    423B

    MD5

    f68062f591330bc1b905631ebcdfbf27

    SHA1

    e01e6211fdb71e21ddd177cc8ba1c94b23a7a277

    SHA256

    e0c0d129e1ab7665bd88192c771c22f7dc89a8c6a3e744631e965eed11220f45

    SHA512

    fc6c45f887082dc6b895b4e3567bc44d858ac86be93aef84278f987e5182586937421cdbb41cd306be8c359378044e3f68c697e6ebf59b92fe48a4c0912f6566

  • /data/user/0/jp.neoscorp.android.valuewallet.sole/app_wagon/xlPTofe.json

    Filesize

    450KB

    MD5

    2b1a579650b99b4bae11ba1bf6cacc74

    SHA1

    517703dcb8e0a4ddc73e7e1e32dabf9f6dc4bfa9

    SHA256

    e7d9dff9205346302f6f2dc2b328dcd711eeb013f1c32fa364b7cfe30af071e1

    SHA512

    2329400627195904240b65d1069e10bbd5b71544b4fe8e4f040021d12396853f1d7b0cb6dace00874dde5753138f6c0260b45f4bf404db1204a367765b2c123e