Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    11-01-2025 22:03

General

  • Target

    9c98ea82d35956b44d64d33a2be4b7989b834fdb04bd2e76568d84d241bcc00c.apk

  • Size

    3.4MB

  • MD5

    56faf09ffc33470685e8a732afd578f3

  • SHA1

    a328b3241b17520c25efda1a4e18a7b699a4aa23

  • SHA256

    9c98ea82d35956b44d64d33a2be4b7989b834fdb04bd2e76568d84d241bcc00c

  • SHA512

    dfd357a5fddcb6c27d0726c9e245dd0f7833ae3c3913c466831b03ba349b44002db9dbb85ad6c7d13da5104b55de0b4dd2f02323cd7516360d483bc41ff79c57

  • SSDEEP

    98304:3TcF58XmQudfhj+Nj1eOLITlIhubb+2+SFSCT0/Pa7WVeIMBCC+Yieu4ZUCk2Bik:6QrNj1ne0HY2MBvbZdk2x

Malware Config

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • jp.neoscorp.android.valuewallet.sole
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5056

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/jp.neoscorp.android.valuewallet.sole/.qjp.neoscorp.android.valuewallet.sole

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/jp.neoscorp.android.valuewallet.sole/app_tribe/FPYmD.json

    Filesize

    153KB

    MD5

    4c37e1d6cede9f44882ecf943b29571c

    SHA1

    9fa77e4acb03d5141234534226a3436fecc89d47

    SHA256

    e66719fd2c1f125df1853127262748b5e2d7ce8415781af01a5cfd9ec232f80c

    SHA512

    1ec7db9eaf978730d939895059188f52a46659c68e8add9e1816d816c63776e05d17c8f991f2fb59c92b29f1cd753a5937872df31b794f85ec369b25946b2e92

  • /data/data/jp.neoscorp.android.valuewallet.sole/app_tribe/FPYmD.json

    Filesize

    153KB

    MD5

    4eb02f1fa027f67af1dbce688d879ee3

    SHA1

    0b1a39359e3abb90c116670ec1d1ffe60a341b5c

    SHA256

    ae53570a3c5ed17ac866e4b56bf2943e5e5a9608a45f6e986c3087754e3a903a

    SHA512

    bbb2348280a05b1f8a54d7240c24ec08d32401f66d74c0b42fe7094b9bf099a0fbaa24ee8967c0d17637a036c250f86879fabdc71166a802cd97e93e50670d27

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    230B

    MD5

    ce4fe8331a4fcaa9bd350796fd79e85a

    SHA1

    4a00979fa80611e5cf841c104cdd236cd5e3b6b2

    SHA256

    591d11a15408fb481d60859f44931bdd021b6729b2d2761f9a185bef9ea273a6

    SHA512

    ace0bc9218eac91339096d228acd99c77b5531f3c951089bbb3b6122c32996da19c0a8fbb68f8eeaaf67fcbeb1454c390d93b13a4804419ea35473d76458f3fa

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    54B

    MD5

    fff2529a1f714d8e347038485ed80b45

    SHA1

    80e01162bd772680909750c3fe560c21f3b4fa7f

    SHA256

    5261cbaafecc56f33b08ae3ef662d387b16dd268d688307014f1f904509c834e

    SHA512

    0407661e4baeabfdbdbb1c872d8b2d51e047ad0eb48b9b452546df8e2be59f94257435eb2b39aa14202ce671195ba0261e43ae2ce3d45006370b23c1d308e9fe

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    63B

    MD5

    814d901c9014c21909100c2bf4b762e8

    SHA1

    2ec2f033aef841a4a4b84f53fe4b755abeb4d8a6

    SHA256

    dd04b6cb422353f3e1a9ccf9eb3eef9854078ddbea921ec24ce094e5fd7f6d58

    SHA512

    a5ecebbbaae23ae44550baddf683d8e93f5f4d9eccd261038c473da82e02ab18e67f06dce71560035c25711e620a8ed9ad8edf7b2c2e20a9749a949e64c4daf7

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    45B

    MD5

    256757b30c37da8f645f3b9d973fcf3e

    SHA1

    2c6d3a99b6c9c680afe9220f03025c6a139a8541

    SHA256

    edb506520b8913ab5f6f2d826c21c5ea1c3c02d85966c69b571ee53fbd50b769

    SHA512

    0fed008990aeda030fcc63b36f4cb816edbbda22000e6e3b6dbaca3706c8009c2ab66198faf1e3c02cddd79e5eab7a9abbeec3c75eaf7be48fad9c40d80c7f5b

  • /data/data/jp.neoscorp.android.valuewallet.sole/kl.txt

    Filesize

    423B

    MD5

    b28cfd7e9d824f7ba4fb3744575c3760

    SHA1

    b382d158b349e69bcaff42f7690aced102e264ca

    SHA256

    bfb72da31ecf3ea1d1bca7f12f18da7cd2beef29cde7ee57b672c81680c37db5

    SHA512

    476ba1153b76400f85b3899c36128b8cbd7b4ff734d0f5141304551e340c2fb25c86806c5926a149f0267c96eae51857614255c2f069960cca9ba30440786a33

  • /data/user/0/jp.neoscorp.android.valuewallet.sole/app_tribe/FPYmD.json

    Filesize

    450KB

    MD5

    2b1a579650b99b4bae11ba1bf6cacc74

    SHA1

    517703dcb8e0a4ddc73e7e1e32dabf9f6dc4bfa9

    SHA256

    e7d9dff9205346302f6f2dc2b328dcd711eeb013f1c32fa364b7cfe30af071e1

    SHA512

    2329400627195904240b65d1069e10bbd5b71544b4fe8e4f040021d12396853f1d7b0cb6dace00874dde5753138f6c0260b45f4bf404db1204a367765b2c123e