Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    20/01/2025, 22:07

General

  • Target

    95a82d1def49cc99a762e61c37d338fd190e7fe84320e9b91fdccd7c2ff20f5b.apk

  • Size

    1.2MB

  • MD5

    efd21352e7d1d403aaef97b8c103407a

  • SHA1

    02ab679338defcf70202e99e3a57a020a9b3be07

  • SHA256

    95a82d1def49cc99a762e61c37d338fd190e7fe84320e9b91fdccd7c2ff20f5b

  • SHA512

    96b5a9c7a4fd1a5617295ba60ea0ce563a663956f97df46658657f9f7c3a01d1238a49908233f66ea1d94a122761379277bbbdef20f0805624561cfc54ea5719

  • SSDEEP

    24576:u8a2VS6B1FHniggioRXTWxa/6bT7nAJC8SLf849+xoA+Z3NSrjkkWz40:u8aKv1Fnidi4WxaafE+LfZ8xMlNQkHL

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.teschvisions.smarupts
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4628

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.teschvisions.smarupts/.qcom.teschvisions.smarupts

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.teschvisions.smarupts/app_gain/YbJggE.json

    Filesize

    153KB

    MD5

    ec68bb80ea1c97a468f3f9db9b6d2c91

    SHA1

    421a250d7d01e4e6f87d66d725b9d4a7ba72909f

    SHA256

    24ad260f8597f2434ea4d0aa47042cc85c5cbbe47206458b14ce5f9fbfdc0db0

    SHA512

    8cd33c27ce8ed4a8c48d8df9c11e6f25130fe49a47ba5c08ef658530708e95ad35dc089730c08feb56edd0c3fed679d967705d83ab898256177443d6e51e287f

  • /data/user/0/com.teschvisions.smarupts/app_gain/YbJggE.json

    Filesize

    153KB

    MD5

    d27ee8087c60c3f7a23d16d12f06dcc0

    SHA1

    86dbdf8c1dcb77c39c514eab957b2b9309242c4c

    SHA256

    fb9500c16f47e51f84e1e9fae200498e18508f9563c5c913b132b14b70bf7139

    SHA512

    6c6486011b26cf2ac4509054ace1f955c52e52f5dc57c32c8775ef557a3a87715f73b09cd42a1bbd494d77d39a46358be25f4dc3952fa5af47dafd45902b9331

  • /data/user/0/com.teschvisions.smarupts/app_gain/YbJggE.json

    Filesize

    450KB

    MD5

    aca23f5bb0bd116132681449dd5ad843

    SHA1

    c3327962ecb3568f17b48f99928a8b3c2dde2558

    SHA256

    9ef6b96bae200eeb848d4bfe0e6c3f62287a9efd7fe19574ab7fcb61e9b7c890

    SHA512

    1f6ecec985ca0f52d819aed3b368a3d67a906acc63091163c3b061376db34b6356fff80bc99f52c8b1addbec53e16084aa5c9c25a165cccc51ab5bbbd9e7e3a2

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    58B

    MD5

    5f5456c0b9b4bd5199a3710e8bff6bfb

    SHA1

    90cc20eaf231c3095a6d600be4045479239b8693

    SHA256

    3fc458dc6ed669ac7d2d392a29fbfc49d7fe4bcb35afc6d4a23491e539a59b43

    SHA512

    a40f3e9306b7eab78a41d102e5d9e1566b136c6c0417de676c23c797750c10ef2f380d7d481bbdaa04c37b3924fb6a33b202e78024350663daf395797d6734f8

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    d25615497aacba5fb41d9994d1c58021

    SHA1

    fae9e7f2ef8d2fcbd16a7172b00aa2bfef035621

    SHA256

    3c9b5bbd0a51756b647b8a4a1895d7f3be2016acf668446d7485cf201f279aff

    SHA512

    bca3f26a4f9b7d09365b7703347c36f43b2acbf97f56aa65c73f27970a7cc1370e595dc848b17138de66f394d8f7907ffa677bb2c871489b1230c36368828aeb

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    68B

    MD5

    126bc6fc240b8ab5a0c41210407a0f71

    SHA1

    da8863374f110bb48bed42d4f0daa2db45754594

    SHA256

    0a9260cd2fbce005667d210f53aa44723e1145622b9719e34c0098940b80ff45

    SHA512

    3a7e4d923bce573649754c25afae4b21e435b9ef534e5bb5bd91db2d085ad4f0c7e523e4a1985116c878f1eeff23c6b2dc48e53160e155cfe68202f8e56d7ff9

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    68B

    MD5

    c90c49a108232db55da1ebc06ff826de

    SHA1

    f3c4b633bbe55199d51a542b6081cb92b1b79dc0

    SHA256

    306551ced95e9b3aa21568fbebba01f3553daab16a5e6328ffa6c00bf586a5b2

    SHA512

    39175383fd5ea304d77b50b112ad2dcef3b484ae91931c2c8a2d6533dcca9ffb01be66782af355cb29e91f40162976d1cb7e42dc87317e8dd8e78f7a73444ee0

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    84B

    MD5

    6c838d316905525ff097f39ba5528a39

    SHA1

    4c2d735e418e53f30a35b8e8ab47c93627f3e49d

    SHA256

    8ced4e149a2c9f44a23c4ce427c54ab83200c50129312c8aa36e4b6c6ced5a19

    SHA512

    2cfcdd447d79794c9413cf4dab849a38e7bb641f9e1522760e987b2029e7e144a93cc30cba0e9a4856b27526978ade426e2108e93d7d1efc9cd1bb02902e190f

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    77af3cb3a913c7cdb0068d35f2625188

    SHA1

    66f25b38543cffc35cfa5d1c680d3c77373b8cef

    SHA256

    9b1a554dd9a2b7c4636c554235f064921c2f5d6c7c67dff1629d4ddfc0037eb5

    SHA512

    b32b16b80afc8f84c1c0053a5dce47f15a6e26dcf4d8279948a18647c499a13de36ee45462e3991c94623081ec470844e943420a097ae6cbe27d24e050ad7b95

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    58B

    MD5

    06436eceb5be11354115d59604230c4d

    SHA1

    913bb84164c70c06aa14466f2a7dc59d4fdce793

    SHA256

    1ba00d5fc88357ab9f96171dbe5a00795b9f79c52766ec2c309649461f88b7f8

    SHA512

    d0c0700ed675cb9dda6cf91831389276e12422628558121aeb8c358be4fa8bc065af02a1fdb2bd185ac42397ed1ac862dc0e1b4c3072ab29e64f5c1cee0ff169

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    f9d84104cfd5b7a5c228048fd2eda047

    SHA1

    9cb384cb96ab69c128a48da0cefdb926c6a2bce9

    SHA256

    6162191afce81224322ada50f2e7ca9202c46f0e0330f512c442a2998b8d5c2b

    SHA512

    140ebecb7b9572a8405e02fca3496518fd321522770d26777ddb3a834ec9f5e20e1301dcd889b7a16b4a6975ad0914dbed50e003eb48c5bfff72d129edff6566

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    230B

    MD5

    6a8fd916676b3670df631c0bb9a28191

    SHA1

    420b6a07ce8d65495a2902f4f628e68b4fe62606

    SHA256

    16d2449ce21ef02fd4f064619f8b6008b9be0ffd16f100cfa3fa7076e5a4df6f

    SHA512

    5c42bc8c7111150d5cd0ca35e7ea00468bbddb52d357a6197d9ae20ce83ec6098a34776099518cac222521fd86a50b25e6a60db1953e32992d45ad7bafe5a3f3

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    fe1d1087c6b76ccbe62ef9af05eb173c

    SHA1

    bd3e5211764956e657d7994790b88dbc20234058

    SHA256

    31060ad64b487648d2198ec0afa1fd9f78419983ca8f70fcfad28aa05dd832bf

    SHA512

    7019859793be46a2c034f1f672b56c7f37d8172efd659b43258b4e235d2c249433550e7b85f2e2b1b0f8a1b1a8600c10a2811b6961f2787df83e46f33f3c359c

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    68B

    MD5

    5f74de81479fbc76eefe661a12d7514a

    SHA1

    1cfeae45ad0da6a865a94091ebfa2a625baffdd3

    SHA256

    b350a61a56ef4c0e75f4e9a57f7c7c61d79876a40cc179ad08113ba7321fc2d0

    SHA512

    1e46ce472e2a004a77ecc05deaf7852fa5c7ee848909827e19953210906e5a1751dc62ca9ea53c4e629f4ee1fb6fccc6ebeb6c10c72f0371ec2889609692e950

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    45B

    MD5

    a2c2cd905a6b4d2c68e4d9c0ea8af211

    SHA1

    61710c8d5a9f017eb82beb3ef3c90d2199111760

    SHA256

    9dd93ae2415faf0af81fa1ed4360017a2caa333e723c7500e49833f97baf181c

    SHA512

    ccb804743c7e1e3c7f994bcd1d5c85a194796921f45cac2af90000b62ed01e4654dc5ac532ffa4483b3f2fef49e3849bf150853ec49c4e09bd01f7dbe66596cb

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    466B

    MD5

    df11f71b50acfb264059cf1fe1d38de5

    SHA1

    99488f1428797ab666756fb58968a3fb2c92f4af

    SHA256

    0937f79fe7122b77ddb69a3b1bb4f2fe992930515c75eadeb867c927f1845851

    SHA512

    a3f36a64d547cf57a828290e65d086e802b5aff33f565dd0afddbec9c22ca51a0f1ffd7070718de6ba79e470b2c03796c783a7141f40e3bbc05e631da62eb336

  • /data/user/0/com.teschvisions.smarupts/kl.txt

    Filesize

    54B

    MD5

    60bb4e28e799570c05d0a1027cc1920e

    SHA1

    1364820b0aee08934646ea2c13f1328a92eff881

    SHA256

    3a7c4a3232295839925e4483906fea31200d3882135a4b4d8c5c92149f348c57

    SHA512

    805fdae9a9557f2b988ae26e5181d9491c0ad46da6b7829fbe13a21995c5015a6f9f2d72424030ecd345e811ec74fe02c2f77f0a91ada238af0d0e532a2dabb4