Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20/01/2025, 22:07

General

  • Target

    9721388a1a080f389c73263f60bbcbab726cf952aa5fdda916e96e8ce9180cf6.apk

  • Size

    2.6MB

  • MD5

    65fb1d0894f2abdceb71e5eee91f122b

  • SHA1

    fd45cd280f9b97fdfa0c20f6f5e035e286a182f8

  • SHA256

    9721388a1a080f389c73263f60bbcbab726cf952aa5fdda916e96e8ce9180cf6

  • SHA512

    3efe4163cd1fd5c4cd68bb4dda853e0291d24b396a198856b791cc3c9c13041fcfb74f5de26fe5c4ff734dea11faebe538083e101adc6930b3f0d370749cd8b4

  • SSDEEP

    49152:W+BdAMl9/Z+qu185bekb4GVTHxv9ZFymd6vHPe9IWkPrTvYYAJrBdnmWoxyAAdzK:WqpddykbeEdVVF7yhPe9FkjRAJrBdnmf

Malware Config

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

rc4.plain

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.techvision.smarup
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5141

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.techvision.smarup/app_pioneer/iGe.json

    Filesize

    153KB

    MD5

    f09a41f2f8d299686320af426b181655

    SHA1

    bfb9df74887de6f22acdb89f7dec4dbd52be4365

    SHA256

    1f0dc4a1a1b51186855849c572555b81f2bf695e0d6a5643e42d2ba6777d70b2

    SHA512

    02cd131c832a9559d390262fce5d513c9c009a2b92811c40b94ada07af860f1d94f59916855819a951fb45c6bc6fd7c71886f1f3da7662204261c4a917c45c92

  • /data/data/com.techvision.smarup/app_pioneer/iGe.json

    Filesize

    153KB

    MD5

    d0631c176ab8518b3328e9db3e592fc4

    SHA1

    9ed57c15aaf2fc497ba87a5b0b193a7021d33da6

    SHA256

    02e56f3ccc156caae9d46d382423d865f122926fd4c6f3a42eba285c2e207891

    SHA512

    3633728a003740b451f2ced4ad1f27b59d2635c17ee9f72b164ee210074c2e88e9e459b9e0f6646d412ed6c35db5b9191770ef4b81d449c8c9fe8329c6835a8b

  • /data/user/0/com.techvision.smarup/app_pioneer/iGe.json

    Filesize

    450KB

    MD5

    8bc5fa802bad1da1452e9712cd3c2665

    SHA1

    d5aecfa47b594cc630386d3e6b3f42888ebd596d

    SHA256

    84c68ba15263478ab33f797f8aab530214aba3191b02c68774c0a87ad11bf2a2

    SHA512

    f596fc33a50de504cd513bcd89191ad276732bb895a411530a116fdf86cb78b0fa4d2453f49b31cd41fa83056e84ca78ac8835d2b32892ab2e7bc9b39e14c81f