Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    17-01-2025 22:00

General

  • Target

    af0b735642a25515f37041de83ec4cc96efd3dfb59c35fefa9df92020d9f4ca7.apk

  • Size

    2.0MB

  • MD5

    7e9ca2fd1f6b36ccf771c4592c6ae0cc

  • SHA1

    49b3863a274185a6f17c5f3f1bcdcd38852a25b7

  • SHA256

    af0b735642a25515f37041de83ec4cc96efd3dfb59c35fefa9df92020d9f4ca7

  • SHA512

    7458c45f2cd7fd6b0279ca994b130ae2e101fab4fb784ef48c30bf1219b304fc681dfeab764fadedca226cec96c485606aecf1b685444782ace689909f25aafd

  • SSDEEP

    49152:9uV5PPIIF/RP/txb0d/epUU1FMcKEjMQI3Vf5SagrpIJm9+udV:9ujPPIIFJr+2pUU1+HrQI3LSKU9pdV

Malware Config

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

rc4.plain

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.techvision.smarup
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5100

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.techvision.smarup/.qcom.techvision.smarup

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.techvision.smarup/app_head/Cf.json

    Filesize

    153KB

    MD5

    a9361a210b80171919d8954e46308b16

    SHA1

    0bfeb2005edaa7c2713516417a5b96d3fab7d903

    SHA256

    47d48b546595d7b3fe9149da4655c21fc5bada94be206c7b16a0a159b973bc26

    SHA512

    18ba28906b16a1a90083c9ab99a6f39da0a67a2399700eabdcf3e1337cf906da8e971e707fd08faa9d5235255f27dc5620509288a7975d5e3da9629b32dba04e

  • /data/data/com.techvision.smarup/app_head/Cf.json

    Filesize

    153KB

    MD5

    a969140c7bc928536ba6095107aaf8c3

    SHA1

    010f08a86d1247391b44551792b4368d82d07799

    SHA256

    564488a3a8f994a5438665831b3da051a9a0a049e891d5c87462e2b5180a8116

    SHA512

    c8f9c2d7e93aa280f1b8ead43dbf1fdea340f9e7d6d864579bd93c4c21eb8a3ea6651a9a0c200302e11042840345c9cebba4aa9000eefe0cb21be463e752a53c

  • /data/data/com.techvision.smarup/kl.txt

    Filesize

    230B

    MD5

    3f19fce63a81263d33beb0bd064257ac

    SHA1

    5ab57d410772e82df6c568e7e9dcb898e737e1e8

    SHA256

    0c1b6a88cd1711a0c860e92483a510c516f000dcc532df993f98eacbb8e799c4

    SHA512

    a23c07766bc83f539a62e38c5123cc16a537df09b32bfcae0c749de83fc581c2070bb660fafbf71b042264c89b269dee4cbcb88165f9659c86d6b5e6b794f12e

  • /data/data/com.techvision.smarup/kl.txt

    Filesize

    54B

    MD5

    266a4a1948ae81fda27013a7fd31abca

    SHA1

    106d3edcfe3dfdeb3323897f678adfb6d1a77d7b

    SHA256

    a7f5c8da49e98efbc4622d7f25ba73c50398dac4dd1d5335fefaa307892b574a

    SHA512

    c86248b8bbbece68f8afd5270b449a99e72e181f925dd1403d1752e507fca15ecdfd12db438d25677306580af14c3fbfd100f295c4d422c21b0cb028df4ad29c

  • /data/data/com.techvision.smarup/kl.txt

    Filesize

    45B

    MD5

    8ff499190ebadb505388c6a0bf282ef4

    SHA1

    494f1fc7610531c28a01cdaac26f064d19a8acb9

    SHA256

    b632879b29c5309a16064291a50f871aac2ee2c4b86b18021f09dbc8e791aaec

    SHA512

    2778bd904884fdcfb26b8c36f1ccd9c4b82cdbfe047fbabb7f93db8b601f498857c5435a83826509bd46c8b3f45205dff60472ec0c19b4d39c6ba4da093dd3a8

  • /data/data/com.techvision.smarup/kl.txt

    Filesize

    63B

    MD5

    3145d81c5227162a2a61e9fd78c6b17b

    SHA1

    bc3ef11ee0ec2e7197c29c1c8caa86f53a86be2f

    SHA256

    b08beec61323f65d0cec5416b733cb09210d7396561f42afa005672f896283d9

    SHA512

    dd97c10ae0e52746e4d872a311e144ac0cfbb2069416a4fa4cd25a67fc396a4ccde3f398a2f80c35f22cf28485bb81be2e8d4ef4de4346006047f3bcb32179c8

  • /data/data/com.techvision.smarup/kl.txt

    Filesize

    423B

    MD5

    8e612faad5e1e2463e61519d3781bd6b

    SHA1

    1a83aa8378c278853174a29e0619cde8eca74779

    SHA256

    7cde91a6216e82c0726cef1958edb77a8bc7976bf22fad92eec8fd903d487606

    SHA512

    0eb634eabb26e7dd6ce726e6833c929cb227ba5078f2359bb0a2353eed794efd2192a4295f738bdf7ca75ceeda5f66c9d287019c9551317df72a81075960aa41

  • /data/user/0/com.techvision.smarup/app_head/Cf.json

    Filesize

    450KB

    MD5

    8bc5fa802bad1da1452e9712cd3c2665

    SHA1

    d5aecfa47b594cc630386d3e6b3f42888ebd596d

    SHA256

    84c68ba15263478ab33f797f8aab530214aba3191b02c68774c0a87ad11bf2a2

    SHA512

    f596fc33a50de504cd513bcd89191ad276732bb895a411530a116fdf86cb78b0fa4d2453f49b31cd41fa83056e84ca78ac8835d2b32892ab2e7bc9b39e14c81f