Analysis

  • max time kernel
    149s
  • max time network
    170s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    18-01-2025 22:00

General

  • Target

    ca869b9b5f7f649a3464652f6e640c2c7eeaeb98a92488146d5a570e8ea6ef5d.apk

  • Size

    1.6MB

  • MD5

    1593a618d1b14287f81204ab05a30163

  • SHA1

    0330b2f2e700d5870b143a878ef00169c47d8c3f

  • SHA256

    ca869b9b5f7f649a3464652f6e640c2c7eeaeb98a92488146d5a570e8ea6ef5d

  • SHA512

    7fbae67fece37874bd2d3de96e31e21ab5f17515226acd377a633c1c30ac885a0634a3287075847cc7593b40d069e6c5d5b76410d3c9d0ea0a4b2d0d38e9217f

  • SSDEEP

    49152:JXtdBYQUyQZFyJAAJ4b5KQENX+6D/IOh2z:JXHBaZ+Cm9PD/Iv

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.teschvisions.smarupts
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5159

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.teschvisions.smarupts/.qcom.teschvisions.smarupts

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.teschvisions.smarupts/app_just/kj.json

    Filesize

    153KB

    MD5

    a00e2a3e628b262131538207b22053f5

    SHA1

    ce4c7e1f216161713f11a6fde4d418633e79f5ff

    SHA256

    03f6f73299460ee7e09eef4fe90ca22b2c94785680d7459b200f967e6356aead

    SHA512

    a7f563a68a68ce1a33ed9047581a4a1a0e067b4b4d6c002e022ae7ed54189176ad255cc35a09b87d2f02e55f26562deb0ac461c6ff7405e5f1eb9e3148ecee77

  • /data/data/com.teschvisions.smarupts/app_just/kj.json

    Filesize

    153KB

    MD5

    2b9a5740e6bec496dae8a8cb92d923f7

    SHA1

    6d96a96f6bd3a34cffb7e5675ce369b1419e8390

    SHA256

    b24cdcd73c009fbb3c9eec8aa65b09c1bb18691e39802d43f3bdd0cb407b4ddc

    SHA512

    a314684d422afc208ddd5d8f12a19126973cf7ca885da27aa8ccd85438c1a3ed4e6227fae3c08352c4b59c2c22302ae2a8acc10328656b5f8dbb3e9cff53df8d

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    68B

    MD5

    ea00d6ba5a1bdb9194cd8643ed7db061

    SHA1

    bae681f99c604575effa71d0649ca02d94da3472

    SHA256

    9961ef7e661c173fe5466545fc7808fea225ba14fe0407cae489438b3b6165c1

    SHA512

    31f55674eec0d79d075c947a3098a5e7a14a19b07b6af4ceb0aef401d07fe873f38b5033752de225f4191b7814d629086351d4e2446127937c9afea389a96bd7

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    230B

    MD5

    7a94ef694f1e32d14283314077dd0ef4

    SHA1

    8b75f7ff12223b45fb5ced1572dbd042ffd769fb

    SHA256

    e9adbf679638ede61449fc03d74278a1eec968c69a0e7c1b8344b4733037287b

    SHA512

    fc42a1fdde576034accad7f865866c94a727e1a428876f63cc5f050a9022033d15b5737ce352a649a7ba74c5eb6cfdb314999660ad38e534d2e1563880cb16e1

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    45B

    MD5

    565cd9fe1365f8b7b4c24b901b75eb5b

    SHA1

    320f07e881b4b4d8fd7290b5235bfd6027c865bd

    SHA256

    ac1d815a18dea0a5c7f34497a8e39171acc71de8db6fb67c35b739166395d68d

    SHA512

    8622fe2a41a6bac6e85a4c9843b408f61c70ed921d165e9dd0166fb9e0a93f388d65cf2e1094602d8cd71cbe2961b45dfc2e0447423037915ca30953225f96f9

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    85c5b74f50adbb7653ea64eb846e6576

    SHA1

    f982e2f141c9c0cf53b5f421294dd24413a3c5f8

    SHA256

    fe501738054b3e3e5813b98aac60a246711110ed23494f7ec0dfe74f020471a5

    SHA512

    a50bcd251422fed38da530f8330c9754c33231e7be07836ff3f79649453e9bac94f7e1c4ec0d93dcbb2fd9925bf38da7407b91958cdb2b1d26c3c69db23ef842

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    423B

    MD5

    90dc639533e59b625c124d3edde005b9

    SHA1

    b135c42091932f4c89bf38ca36e44b7d190760ae

    SHA256

    3d540e3bdf2df18f5ac34dd850022bd07bdc8f922d501154b63cd49a851a9495

    SHA512

    2a74183056c3c69124b4eb7dad90720756bc993a99a1b4126d62e5b3e7f4eee698912d09e69dfc54b993459a1a25d34c204d8e2e496174d80d678b5bb2de4255

  • /data/user/0/com.teschvisions.smarupts/app_just/kj.json

    Filesize

    450KB

    MD5

    aca23f5bb0bd116132681449dd5ad843

    SHA1

    c3327962ecb3568f17b48f99928a8b3c2dde2558

    SHA256

    9ef6b96bae200eeb848d4bfe0e6c3f62287a9efd7fe19574ab7fcb61e9b7c890

    SHA512

    1f6ecec985ca0f52d819aed3b368a3d67a906acc63091163c3b061376db34b6356fff80bc99f52c8b1addbec53e16084aa5c9c25a165cccc51ab5bbbd9e7e3a2