Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20-01-2025 22:10

General

  • Target

    ee20c23b1205228684e7f3ccb0117344fd72cace7dc86a36e62d0ff793fbb10e.apk

  • Size

    1.4MB

  • MD5

    355342db74633ca8641cde2d28247a14

  • SHA1

    d63b1acf077ce6516cdda5f9fb06882459f82160

  • SHA256

    ee20c23b1205228684e7f3ccb0117344fd72cace7dc86a36e62d0ff793fbb10e

  • SHA512

    c9c2468a6a3d11c3a4e09122ab079dad3360d13eb5bac0b44877fa7e197c12f59e6efccd48700cfd784b9d8ede059423aa62ba7724d049f69cb37f9375a71b90

  • SSDEEP

    24576:cFjeJdTJHLBnx0tLb6KXt00rHEtYm1YNAgaeJIP/hgZY7MWuIgse2kpoICM2uDyO:CjeJ5JHL9K/6KVrH8YmSQPJgMNGseuMv

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • nt.neoscorp.anxdroid.valueweaslletsd.solepe
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5054

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/.qnt.neoscorp.anxdroid.valueweaslletsd.solepe

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/app_fade/RxYcxQ.json

    Filesize

    153KB

    MD5

    1d5970ed7e90cd7e55a42e6c3f225654

    SHA1

    dd2fd8181943e0374b9aa0b252b5b8c8ad5c1fa5

    SHA256

    7caa2d6bb41e5b9dfa8f303c6881cc645efe97eb006b1fa2940324c02b5a28ad

    SHA512

    9530d6d64fbff5b8984b86a979453e6337f77b314bd9b489c945dc181f01fe11bcd8d17cb630f2e124bc5368164b9645440756cee1452620ceb2f96b4ae5d449

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/app_fade/RxYcxQ.json

    Filesize

    153KB

    MD5

    cb04565da3455a072499b4deda23aff6

    SHA1

    bc47d40ba214809f82038a828ede9162a37b6a0a

    SHA256

    3eeaf7baa394646fb46b6f10c3b020313b7af9d23ea93946f99f8f8e2808d5a4

    SHA512

    a9ff848bc386f298ecb073afaa904d6ef80068c24e2926a07983050ff41ca8db015d2bcdbf9baa5cc7300c8a8e1e1ec006b56e9a88b1761a427bcd36cd7eb4b5

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/kl.txt

    Filesize

    230B

    MD5

    56b1a9b48f29c1864b6cdf246a7529a9

    SHA1

    17bb62d9ed97a3af8550cc4a9995f2c8a7d7f273

    SHA256

    823e9199361d2054f92022ce46d5424fb120b271b434364509ddb24ff8ffd27a

    SHA512

    22de525dae957d992eea47adf549a451f7e584d6fa9878cc605aece3753e17a3b566d10276f04f5b193da9ff62be4fdc1d06c4b81e5c7798e535f09367ab1c25

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/kl.txt

    Filesize

    54B

    MD5

    b926b2499cdb04902c51a1246401c838

    SHA1

    1e46bf42868d12c9e1ff6aafbf4617b89a620e0e

    SHA256

    087c953cd3c95b9a75482825c550d1d34de621dd4fe7cc4bad532434d5762541

    SHA512

    b1d3a7d77df8467cec7c89f06387ad542824d05c5c48ddd7e72bc988c89678d9b6e7a4e4c03a3ec54a4740b0dac99d172775d16d5ebe403e3684db0687cff784

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/kl.txt

    Filesize

    68B

    MD5

    49f42c1df4249783494b567d754c3a99

    SHA1

    abfa4f00ee80fe791995b14a4a39e7af3441694a

    SHA256

    e5cbff19215b4d1f26e56fd49856f605d692770f362d4a02d69d4c365d5ac958

    SHA512

    16d014c895f1ac1d8825aa02fd6f4460683751e022b7c289d6026580718e77cd04ab05a94c33e008c11748c2dcc6d088debb65905100010e28a72e1f24e2a78d

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/kl.txt

    Filesize

    63B

    MD5

    445c671cc9698d00fde85264f5514ede

    SHA1

    39faca9cbd8d2c41a249e38859e7406e8100e921

    SHA256

    17310c4c187856cb1dc307e4bbffff19fe1a4373b197763f82142caac5abb6bf

    SHA512

    71718e160f69e0ed7d3ef25b85ced711b7d50b0a995e3a71246d8713cbe783b84ea2d255f9ef47f3bc2ec550a82557182e5109a756cc5afade46c7418500614a

  • /data/data/nt.neoscorp.anxdroid.valueweaslletsd.solepe/kl.txt

    Filesize

    423B

    MD5

    eb2a4ad6635fdc760ad4f3e08d70d094

    SHA1

    6c6376357cbbb3b0566ce8ff8c54d109f0fd11ca

    SHA256

    4e913b7a1938f5f5129bb81f4227d486bfcc1176b69a6d399ba0a6faedb24902

    SHA512

    9348f9db9dc15c8945637944ad687d98b7e1ff08505a1f1fb94e36d7ff7262d80ba5ca0a2fbe464b3f5d601be24e942205632e8f6e1fa7ebff40dc10eecd1d4f

  • /data/user/0/nt.neoscorp.anxdroid.valueweaslletsd.solepe/app_fade/RxYcxQ.json

    Filesize

    450KB

    MD5

    89243960818c1c09c1cb24b04f67faec

    SHA1

    593160660db3c7042ecea68687b63a454d19e440

    SHA256

    c305a073d24953c41b175ef45d02e03f73419e6809a7ab1b0f774550f768fb73

    SHA512

    52ae77c8985026d89ed84601e9a6e072f0556839e207866f9e053068858e68be9a814d2ebf7095c2e0814252edeea4715557818e029ee76fe1eec575f7aa8601