Analysis

  • max time kernel
    43s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    20/01/2025, 22:07

General

  • Target

    e55abc7b08ef730041b32c8f45e92b00f66cae699b595a99a024181f371490d8.apk

  • Size

    1.3MB

  • MD5

    f9eff7c0f8f00bbbdbdc396044350a45

  • SHA1

    07f7c9a31dfca176aa8f2a76f946dff8f4b79195

  • SHA256

    e55abc7b08ef730041b32c8f45e92b00f66cae699b595a99a024181f371490d8

  • SHA512

    c31e9617aae7c2c0d936d6d89b953ed72befab541ab323bb77d08cc64b3fa544904f9d9a38946602586eb896a1cc502cb66a6d097400b9e8d28de9d1f87e5112

  • SSDEEP

    24576:My9bwBztNaW/NCmwQ4DtW2WXpHAsdYrHTn6FQa4DqgO66MHQ6g87GV:F9SXNQmwQetWNXf2Hj62aKvO6twz87w

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyenifikir.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulturu.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenvizyon.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenplatform.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyasam.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengundem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencentech.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensanat.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenekonomi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenyollar.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenhaber.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbilgi.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencengelis.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenpaylas.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkulture.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenbaris.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenkonferans.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencensistem.xyz/MzhiMTg0NTAwOTY5/

https://yenisurencenprojeler.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.teschvisions.smarupts
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4246
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.teschvisions.smarupts/app_erase/BFUhJiJ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.teschvisions.smarupts/app_erase/oat/x86/BFUhJiJ.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4272

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.teschvisions.smarupts/app_erase/BFUhJiJ.json

    Filesize

    153KB

    MD5

    a0cf5a659bd3009405f7d9ed90919bd6

    SHA1

    4dc56777bb70c3ebd5179ce04c7e9fa907ab5381

    SHA256

    e6f5732111fd5515f8844dbdedbad96a81aa5d21bc3eda0f47f6b6656f08d600

    SHA512

    fbef6f02cc1d45eac18e0795544d87b230f37fd12414035f0ea22f3adaa9497c210fb41edf85e6745deea321fad1ff921fb3c82bdd084fa3dc7eca60cdc6c928

  • /data/data/com.teschvisions.smarupts/app_erase/BFUhJiJ.json

    Filesize

    153KB

    MD5

    f26e85cb84117122a0865100680d172f

    SHA1

    18aa81727981885fda2d75626316fbd97bf9b073

    SHA256

    4841b4d0faed0e3b3223bacf7d955d0e6f3e464a6ae88abc66292f64e17a2343

    SHA512

    2f992539c72e8042fae355b462820e05139c385378042154e2da967a2fdb2aa8ab4649ded0e62e51a11ad7bff684efb422622c9d6699bf556d2d9dbf035c3e78

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    eaef76b1b9921bc579d89eb50a628e56

    SHA1

    a7112adaccf12edc8c85bd64781dcf79d5de81a2

    SHA256

    764ba10c08ee24a7cb45fa358a97241f556fd1a4fcdfa790b427d9d400906cd5

    SHA512

    aaca222d0f7478e0e809d5967be7c96a810455ae90e9ae8e847d1d715a24dd63eaeac00570bf9e2f75ad2cccfa36e8613975154d6f3f430326e1435153a0e767

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    423B

    MD5

    9000ee089696e518d96d6f436f8fc59b

    SHA1

    18226758cf69692d2e624a2d7fec69e574d893bc

    SHA256

    02f9f20c069989025c7b579fbc616e63d4620e2efc25bc832c14a9ff5dd161c1

    SHA512

    32eebee65a847cc4181b4bb37c6211ca73310f96dd22d48e24ae7aa73818f6d11bf6a4fad61d5912af5aa60fd10d07ee9317ff5bcefbb408154a449a63f3d325

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    230B

    MD5

    5e060a433096411dcf2792c249614f37

    SHA1

    036a4badb013859c3a1c4254689261d664e127ba

    SHA256

    f370e64629dc0c06e728c7afc3684b3d0716f76d6d3f638e34ea6d818388ebf2

    SHA512

    76b2975a0efd842bed7e77c5d2414190922000ff053832c8f3eda8d9a26496009795aa69d4459bad4e8c9cab808e3b21556b618d28ee54dd7fd438fdcf638cac

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    79B

    MD5

    720f8ddb96cccc82f0819153268a0ade

    SHA1

    cf9e615dbc6135d5c7b998efe948442840c5f40d

    SHA256

    31bb8cc57c805d253f194bd065772b1c7696322c479b61ad8eea4b372a109a48

    SHA512

    cb3fe6a7b3ce4ed2b1384e1bbb0cdd370d3fa9f4febffa05940bb997c8c3f37a854527730f58275c913589bb8f4c442af8be7944d8e3bbcb952289c06aef1afa

  • /data/data/com.teschvisions.smarupts/kl.txt

    Filesize

    63B

    MD5

    ba3ba975b212d3170c0a9c74744af290

    SHA1

    59695f617ee3dac8c192127d7188ee427a3bc8da

    SHA256

    c2fffe49910d0ad1de1c1bfb5ab7e5007b8e63631be0f770a102c39d564b46ad

    SHA512

    0a997c5edbaeeec325021797409c31e8f9a7f966af4359be7567c31821abe096eb4fd986a173f222a9b7871a974814a54efca3f4a2bc827f84f78f4572bf1145

  • /data/user/0/com.teschvisions.smarupts/app_erase/BFUhJiJ.json

    Filesize

    450KB

    MD5

    a3c3516e184d9d2c64072718be3b301d

    SHA1

    753e75b9fb3598546659c5d358c4d6d5b16e8836

    SHA256

    81a40319d16246fa75c8a75b46ff37043250d5d2039a6f120a95bb025d54af3d

    SHA512

    c6884b3ff75ac9924e08c20232523d236791235a60dcc0f8899ab8f07c3681951ff1518975cb508a9ab7f6a34810ff4ac49b5b006689be03ba2deaa6016330be

  • /data/user/0/com.teschvisions.smarupts/app_erase/BFUhJiJ.json

    Filesize

    450KB

    MD5

    aca23f5bb0bd116132681449dd5ad843

    SHA1

    c3327962ecb3568f17b48f99928a8b3c2dde2558

    SHA256

    9ef6b96bae200eeb848d4bfe0e6c3f62287a9efd7fe19574ab7fcb61e9b7c890

    SHA512

    1f6ecec985ca0f52d819aed3b368a3d67a906acc63091163c3b061376db34b6356fff80bc99f52c8b1addbec53e16084aa5c9c25a165cccc51ab5bbbd9e7e3a2