Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17-01-2025 22:00

General

  • Target

    c8581e000f91eeb0fa095c38546ab4a03f418238f7df5a48c1ce9d1b73e015a1.apk

  • Size

    2.4MB

  • MD5

    f9bb2c6a903b8d5ec6053e85e162aa41

  • SHA1

    c06b596b426ba90ee9ed3210045bbbe28d09227f

  • SHA256

    c8581e000f91eeb0fa095c38546ab4a03f418238f7df5a48c1ce9d1b73e015a1

  • SHA512

    6ad5338fd2761566c061528511ea4bd4cf1f247438139dba10a2b51c7d04e3cd1c6e62b09575bd5b5497f34c472a300def6755863f9abda89b2c4a0b0887dea9

  • SSDEEP

    49152:42axjeDaO7FuWNJznmmDa7fcXXyMZoNZPKlqIX0U+pUhx/ywrbVHU/BCFEr:XDaOEW3nu7fcXrqIk3eddU5Fr

Malware Config

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

rc4.plain

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.teschvisions.smarup
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5002

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.teschvisions.smarup/.qcom.teschvisions.smarup

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.teschvisions.smarup/app_wealth/rB.json

    Filesize

    153KB

    MD5

    b71912b7d976c6b652dabb7450a09ff6

    SHA1

    804451c8d42f5ae8ccd3015aa1ed33eef3e201d2

    SHA256

    bd3d309691185249d7d9de7e40fa817a473061748fe0fc58235f683657149460

    SHA512

    53162f39aa73c3d4abe3219ebebd99d47368598db5736989e20031f0cd5c6a4270fc1f4b93cc3e59816684ad69ad95b672e320b37cc8afac58a47f6d1cb7e447

  • /data/data/com.teschvisions.smarup/app_wealth/rB.json

    Filesize

    153KB

    MD5

    0d2c281b852b3469f1b0ce522b5e17c0

    SHA1

    04a78c04b545174d963f72c2a65567f98a948366

    SHA256

    23ab0643c3fea400fbc588c4edc8c00ee1b03b8dbc50db0251d479a31249af4a

    SHA512

    6119008546d6c16ef0718fc6d07afdb11791d3e5fb921a6af9fd1d4a8d049510d350c1417b4703a0aee829d34b26b54a2f2b8cdcbcebc6fb5a8e354b2fc41cdc

  • /data/data/com.teschvisions.smarup/kl.txt

    Filesize

    230B

    MD5

    bfe942138f773b6a7c5b229d8ef5619f

    SHA1

    3a8da00b9092bad1e87b719ba98ff795a82e0c05

    SHA256

    283a2b1c78f61e58b5628b1fff09b0937965e2ba55c3f30166c6974a1d93090c

    SHA512

    f28956316f8ee8eb5d70ff5978782edd3cd407ab12194c1b3721e7c2bb426fc64f9f8fd27f8bf867a2004147551c3a105ffd0bc7f59bad181279a398f92c67b0

  • /data/data/com.teschvisions.smarup/kl.txt

    Filesize

    45B

    MD5

    fef95734c62a9dfea0cfeec8347a0749

    SHA1

    6252624f93077318754cc7b3ab7d4a621a8a6d19

    SHA256

    c0490c4f1a187f2614858b726af5ed772ae621f914f8d407e09c33f12b8714cc

    SHA512

    2a2952bf5ee2cdbb8be56915146132f156ac335b7742285a596e0b3b2b9dc6bbef0105523d403a2d157810d33eb0be1057ab28f473f3f43978373712a8a37ca9

  • /data/data/com.teschvisions.smarup/kl.txt

    Filesize

    63B

    MD5

    a9da5ac476ea38ab407e1ba34ca8f057

    SHA1

    baeee0e0cae37d4f378d72c350eed13363b1908c

    SHA256

    555586f74b485d505bb13e62fe96a3151fb2316c85f325482471687527c746e2

    SHA512

    ec7537cd3b9abee985072bd6558fe97fb3d8c34e6066ff0fdc5af5e4bd9cc2e52064633d8be54a0a56a26c5d768b13f96629380362ab2dcb7dbd2a52c157346a

  • /data/data/com.teschvisions.smarup/kl.txt

    Filesize

    45B

    MD5

    034ad71aad99da9b09c6ace136dfb35d

    SHA1

    8035c728c160efffb8eeb06820b8551c3af8a96e

    SHA256

    881bae702d16c6f895c47beb5cd8f670b7cc4db41abd2386b8c6c288b39ef873

    SHA512

    58cb10b9a86b8c672b49472135a5a5dee3abb1c854f4d6f7b4450be97895988636a54a58d6c2f71bd58ffb559d5029e293138cb293c3d0807e325912acd121e5

  • /data/data/com.teschvisions.smarup/kl.txt

    Filesize

    423B

    MD5

    2cc18e50c829e9bccf70c13aac48db71

    SHA1

    20a13d1340c04396c9113b043be5350bf374e221

    SHA256

    00e792c4c6f16e53bd9107c4f62245cbdc0d7b91c94935448351b6cd430c1559

    SHA512

    51f1be1a7ca76dd7a229a2a7fba1b2cdd1f0d8c500ba2a53fed8e0e5176aaeed6ded2d47ad0384a77bf76a830671c2d388208ddd72b4cf85ca90aeb2c4f6cc0b

  • /data/user/0/com.teschvisions.smarup/app_wealth/rB.json

    Filesize

    450KB

    MD5

    347897d583aa1dca3763d87b946c6154

    SHA1

    a26070b3c75422469fea6c7724aa785510d13d79

    SHA256

    cca75ca67fff047741dab628aedbc639930276dbac7084f1e39143f36c552daf

    SHA512

    98a3761e7cf12374a8569ba6a77852c8f15c87a005debf736fd7c4cd12ef50fa887bc58670a6e9b5119c766c269ad005ac777cf6c0de7ca2736c0461602a0424