Analysis

  • max time kernel
    65s
  • max time network
    156s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    14-01-2025 22:05

General

  • Target

    10e58d316d9bc89c4cd2051066238cb8f09715a54f310b493a101b64b784b4c1.apk

  • Size

    1.6MB

  • MD5

    c2dcc0ddec47ba07fa59599f3fb799a8

  • SHA1

    1f6b829a1f7ed9883ae8474b38d57c336fb0677e

  • SHA256

    10e58d316d9bc89c4cd2051066238cb8f09715a54f310b493a101b64b784b4c1

  • SHA512

    11581d7fd57b2e4395ae7af8f2519e8c018ad992d2525c538b58e1ad5132110e15e092069fcc41f50a14b8cc1f0606f71396a9e19440ccc52e2a3dc247fd6457

  • SSDEEP

    49152:HDJLEgP/rxri6PcKXb8WUxcdHKksoKRuuMTYnN:HugPjJixKL8lxwqX9RuO

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • nt.neoscorp.anxdroid.valueweaslletsd.sole
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5057

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/.qnt.neoscorp.anxdroid.valueweaslletsd.sole

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/app_elbow/UTP.json

    Filesize

    153KB

    MD5

    9ab3be20783066c5eb23db9a82e34ed6

    SHA1

    327b82666d1c4efa468729bc050819ee65c0d327

    SHA256

    763410f4894b4e0dc1a07114b30fac76384b733ee02cdfb047d162524223914b

    SHA512

    8efc4190e40298bfab00fa0e04098bb38c5e745de125a42b32b70937d8d36860bd6b6a639f2e8510eef99763b77d42c93432f4ed8cff61dda279b4856c6c586e

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/app_elbow/UTP.json

    Filesize

    153KB

    MD5

    303e36277a08c3e3ef93e974861e7f94

    SHA1

    a229da4b6d7d98bf3fb860dffead1e6ed68e68f7

    SHA256

    cc096cd8c12e40798a7f472493d31c734b1f898fc3a1797962009b72a3386c67

    SHA512

    083d7a51cb4b0ebc6a1483d8f7408f9eefa34f63ffceb3db3b308913cf879ae91437763c748a17efa5f6496b435aa6a06958cc71aadb2884d7e23e13656777f8

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/kl.txt

    Filesize

    230B

    MD5

    13d2fbe87bc97ab3def389ede8778722

    SHA1

    5ea00501623e931770e297437b329ca6cf478394

    SHA256

    32798821ebca535cbdbd8b10aaba44cd31f6714a7b2d3cfd1605166807010405

    SHA512

    62d318cb415b2b033d166f4e74db9a494a8ace99b2110a183306d404f7624d5266f36d1723142a874eb2fe19e3a58370699fc47f8e78661ff097985ab06f8f72

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/kl.txt

    Filesize

    54B

    MD5

    29dbecddcb9eccffe65cf1e2480a6d9e

    SHA1

    ccfd4a27d63a44d7a745e68487a6715f966be0d3

    SHA256

    aac6711b6ef1ca8cc016f47679eaded3805b6a44be2eddd37ce3a6c85af5568d

    SHA512

    d9b607464b7c6b070372b33d1c251d46fa15491d74791592bca5d7304009735812d9c523d41f1d3eba5dc551193aa4bd893fbf1a62b0baa8e44a73e97b2c93c0

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/kl.txt

    Filesize

    63B

    MD5

    b9e655007edf6470c785277c1775a4ba

    SHA1

    e29d37bddd7d8a6d98aa8eb7b2730b826867f5e3

    SHA256

    1d0447e42615a6e13c484aa8ca629c7c74f107185d2227890a2e71edb6117bc3

    SHA512

    736a9264218fb83d1849823257ebb72babe3091ee9876d9da5ded24bb03645a8e31931828acd18f9bdeef91f9e966f284ea89061e0ffde7d318578ff606e05d5

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/kl.txt

    Filesize

    45B

    MD5

    fea24fde622055c916d1235912f753ef

    SHA1

    cb0f309f94c2808c345b1e7ec1a1506a5f7b5373

    SHA256

    162cad19edda3d608b2d7226903845fc9d1cea8b5643d8f189412ff6a6b6eda7

    SHA512

    c6d392a218591488a1eb5c8136b9604d1df35b9c6c563b0f78212711adf6e0ed2c013f9403786e85c43518ec7bd7a7a0a3db9a7749c661414704f3e8fadebf08

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.sole/kl.txt

    Filesize

    423B

    MD5

    a59f787b73280eca5ce513c565246047

    SHA1

    406d288f2d05c310877adf678629a786342716cf

    SHA256

    ff8bcca18dbdc6b99f5d8f9d99f5fc94f4a600917700b0724597f86074b230b4

    SHA512

    e01461c80f52154d1c672a871de5c2530e85d44af135f3687bd65df38d00fe1b479586dc9f9ecdabaff1d894b40fbb600dad50678dc229f3f3baac2665536b57

  • /data/user/0/nt.neoscorp.anxdroid.valueweaslletsd.sole/app_elbow/UTP.json

    Filesize

    450KB

    MD5

    89243960818c1c09c1cb24b04f67faec

    SHA1

    593160660db3c7042ecea68687b63a454d19e440

    SHA256

    c305a073d24953c41b175ef45d02e03f73419e6809a7ab1b0f774550f768fb73

    SHA512

    52ae77c8985026d89ed84601e9a6e072f0556839e207866f9e053068858e68be9a814d2ebf7095c2e0814252edeea4715557818e029ee76fe1eec575f7aa8601