Analysis

  • max time kernel
    46s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    20/01/2025, 22:07

General

  • Target

    01a2deffafcbe9cff21404e9a707746758b28f6fe006d821960235a603da41d4.apk

  • Size

    1.4MB

  • MD5

    71d68ba76a1604c543e0e11479145be5

  • SHA1

    49eb9296855f8af35a5773ff44b26b075be1a2ea

  • SHA256

    01a2deffafcbe9cff21404e9a707746758b28f6fe006d821960235a603da41d4

  • SHA512

    166d315ca82339faef92e758c74221fdaeb331aa22dc9313cc9ce95bc11032de9f9ac88543bc890415fc18870ab2a5b799fc86ce8f67796a2137c320ce2fb086

  • SSDEEP

    24576:/rAEHmxNu3SShxldGH+gZv2w4CuZgJJNEW+n0STUFvZMGMcJAVDU+KwgOBWgdICW:E4mASShxPGH+gZv2z9Wv2fTUJZM2J4D6

Malware Config

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

rc4.plain

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.techvision.smarup
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4269
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.techvision.smarup/app_dizzy/NTXC.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.techvision.smarup/app_dizzy/oat/x86/NTXC.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4297

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.techvision.smarup/app_dizzy/NTXC.json

    Filesize

    153KB

    MD5

    119e30560eba5d86c35393fff3c4cdc8

    SHA1

    b0d808b5ecb370050db09f1e124e40bcf7c1d25d

    SHA256

    5fec2db8ad43c9562321f1f5dd74a29109039b23a8b8bb0ffc96bd81bdd2da30

    SHA512

    d69cd74c3ef5246a4d95e2ff7e7ce3228e69441f34f9ff4a4052a56dfcf9c2def7d6901fb8c8aef603772922654162cbbe293d0a7e0202121d36265f3e727aa5

  • /data/data/com.techvision.smarup/app_dizzy/NTXC.json

    Filesize

    153KB

    MD5

    212823d008b4fc83ccf483a8eac8d60e

    SHA1

    b9eac418ee911f01143e75cb7f652f7cf2a5b84a

    SHA256

    3b83502b80e424a1ef24f38bbb37c8f193d8d56acc104a423115de61c84465ed

    SHA512

    df97f0412a570c6d7c7b584f347975c90d4593c0970605c91a45165f37c06e56aeeaac4c4ca728087f0bdacd5231d560347ef3604d55d9a1e8142d623817560a

  • /data/user/0/com.techvision.smarup/app_dizzy/NTXC.json

    Filesize

    450KB

    MD5

    dcbf640ff642e5150f971f1c5bd47cc0

    SHA1

    fa2d5b3cb99e46d3b68bd217a440bac29d641e12

    SHA256

    76cdf3c9c84bc5e2ceaf229ba86fc949ea66442f8f0cebebd91f26d7cf594016

    SHA512

    6d7fb2570296a5d29cbd34c765f78135d93270fbc8a20cd541e7b54956ed646a38897d720ecbfa60122f02ddb523437411877987de460a8bb5ab7c74f2e6e475

  • /data/user/0/com.techvision.smarup/app_dizzy/NTXC.json

    Filesize

    450KB

    MD5

    8bc5fa802bad1da1452e9712cd3c2665

    SHA1

    d5aecfa47b594cc630386d3e6b3f42888ebd596d

    SHA256

    84c68ba15263478ab33f797f8aab530214aba3191b02c68774c0a87ad11bf2a2

    SHA512

    f596fc33a50de504cd513bcd89191ad276732bb895a411530a116fdf86cb78b0fa4d2453f49b31cd41fa83056e84ca78ac8835d2b32892ab2e7bc9b39e14c81f