Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    13-01-2025 22:01

General

  • Target

    73df1f94398648dab7fcea9563630a7235a0f9f92f1e04fa313ba3cd9e1ce9ec.apk

  • Size

    2.1MB

  • MD5

    b4ea76d6841cb7be9b2b303511948351

  • SHA1

    69862af080273331999c432de7e41bf7edfb33f5

  • SHA256

    73df1f94398648dab7fcea9563630a7235a0f9f92f1e04fa313ba3cd9e1ce9ec

  • SHA512

    da5465092f18df9cc8ec0b1e681599615032416e8b153f965bef2138365eef49027bf775c7fed59c4b5b3cdf8d5cd128fcf69416215b185137273e8d6710eb83

  • SSDEEP

    49152:XqBlEFDlJ+qP6iSayRUcAreEwhJgPX61z6LZjky54XHLlv4ssrMig/fPTasFBTtK:XqBlW846iSayRse1tx6LibF4PrLg/9/E

Malware Config

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://otorisotobuyukisyan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineler.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoyukselishik.xyz/MzhiMTg0NTAwOTY5/

https://otorisotokontrol.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadele.xyz/MzhiMTg0NTAwOTY5/

https://otorisotodunyasiyasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogelecek.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoveintikam.xyz/MzhiMTg0NTAwOTY5/

https://otorisotouyanisi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakineleri.xyz/MzhiMTg0NTAwOTY5/

https://otorisototarihiyolu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoinsani.xyz/MzhiMTg0NTAwOTY5/

https://otorisotogucoyunu.xyz/MzhiMTg0NTAwOTY5/

https://otorisotopaylasim.xyz/MzhiMTg0NTAwOTY5/

https://otorisototeknoloji.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomakinasanati.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoplatform.xyz/MzhiMTg0NTAwOTY5/

https://otorisotomucadelesan.xyz/MzhiMTg0NTAwOTY5/

https://otorisotoarastirmasi.xyz/MzhiMTg0NTAwOTY5/

https://otorisotounutulmaz.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • jp.neoscorp.anxdroid.valuewallet.sole
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5225

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/.qjp.neoscorp.anxdroid.valuewallet.sole

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/app_chest/IoLR.json

    Filesize

    153KB

    MD5

    3c2078018063569c775877bcb83dcb1e

    SHA1

    2b2d91a3acef495f37e4cb536ba675e910f2c97a

    SHA256

    c45304bb68911f87ec8cfc129ef8a85878d8781fed73bb2aadb12025e781696b

    SHA512

    5e86958353bca7bb2d24163888a9fbda3eb97f2727f6a38ccc9e78c1f9c42081f6bd232a8e09a8a2babf449740ba93ffb5ef339bbc3f50fabe8ea7c84146d180

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/app_chest/IoLR.json

    Filesize

    153KB

    MD5

    4befba3415dbc6d9d7e951e89e8ee39c

    SHA1

    fb668189b6aff331ba3d3fda61335260a22809d6

    SHA256

    857408ae76d1baf7c9a6e35a6fb009238791e2fd97ba06415490d09d6d0410d7

    SHA512

    2af77fb4f63a9035f7f9b5c669e8bbc0f2240d13faa5aa850c7cb356192f32cfb1eced36f3d53baa478c68359d2162c48010ec0110c47cd5e0f457274e72ba20

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/kl.txt

    Filesize

    230B

    MD5

    d1935e3d8c301a69f62c7015b8d97587

    SHA1

    d9c75b07a0d0b972811aae842b69c2a07d1c4519

    SHA256

    5fee6a522498665b1568ecddaad641218522aed3ca33051dc1102f1448d70041

    SHA512

    98906613807eb4e1ea7b54632aac4de00bdeab140d6d2419c317fcaa7db1b46657c1e37d876800fd95d9b6f8cfb51ecfa55642e6fa7881d4ea4535e9c45c60c2

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/kl.txt

    Filesize

    54B

    MD5

    590180d75638a3a4271e0ecbd96db4a2

    SHA1

    1f715d22e83f7cdf9fbd9d876db2d18bc0ffca81

    SHA256

    e6221bfc9da65d6657c24a0a85f1c9dd462f7a7cf4a91d2c626547ec7d524bb7

    SHA512

    37c481f3db2fc119b0d60caa5fb6eebba2b5dcb7cb74833f0ba17ed2dc247cc657935c4bd76ab018593e27f8101ffbc11b28e232510b4b9fe995c6ace2adf1e0

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/kl.txt

    Filesize

    63B

    MD5

    c02113c1159b6f36fd9d11ae3c0220ee

    SHA1

    4dba8794706cc595803ee1983700bdf9eedc8bb7

    SHA256

    3bd28afa6a85cca07a0d37e917b71f50863ea2bb4aa490cda3f0cb4f96a276e3

    SHA512

    328dc918789e50fad0c129e3c9071cf5bd07e58828f3ef743c7ddf6aa5c6833823f1240476442fc5f6b21c9792a57844a0abce0fe64ea67720555e6791afd42a

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/kl.txt

    Filesize

    45B

    MD5

    45aaa6ffbdcdf2ba1234a0a78b30305d

    SHA1

    fc396289e799eec333a37d07cad47b5bf133d1af

    SHA256

    20e7b0f32dc8548987e833be5f5fc4a717f110a4ed8b1ee6bcdff92e9fc06fb5

    SHA512

    702aea0d631431b13543df7fc3ca00b99f9c530189af16fa8f32b7ef35677b0317691d24dc817e39e508a9797ef459b33b1ce5271d6d8f7bcc624ef7203b81ca

  • /data/data/jp.neoscorp.anxdroid.valuewallet.sole/kl.txt

    Filesize

    423B

    MD5

    fae929b4ab6473233ed44dc035fe2ce8

    SHA1

    4fc312d60a94b1a6feb298a9944a828b5627e926

    SHA256

    86709ab9ac47f532822b4a961e96f3de6cd17eccdefb80b785550d01141a35e8

    SHA512

    70f63773c974b826552dff52379bbd1f860846df130f6e04081fd33cf0cf1f713f32926313cfd031c750761e2dd4b5706c9c2f01b734acb275262fa30771b12a

  • /data/user/0/jp.neoscorp.anxdroid.valuewallet.sole/app_chest/IoLR.json

    Filesize

    450KB

    MD5

    65bb8115258b7d4900089a72148e6693

    SHA1

    d273f7a7fd0ebb1b60cd4f5ffa35235542e93292

    SHA256

    f5c734648edd05990fece37efe756bc5ac7c3f2d9bbddb3073d2c037b2b20067

    SHA512

    59ff998184927919e5db6eb7be59011035469954b945b9ea526f9175346d29d66d335b088935e856e9981a4c9a97bda4d8c1eba4e2461fcd4cd33bf380145826