Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20-01-2025 22:10

General

  • Target

    3528e827e85165c819c22403c7ad9d00e2d45aafe7d5e8ff7d4622e11ad8a0a7.apk

  • Size

    1.9MB

  • MD5

    33644f258904390fea04afdbfae8310b

  • SHA1

    f5dfe2230ffb4d2ef0dd6d0604821c6a63c010b3

  • SHA256

    3528e827e85165c819c22403c7ad9d00e2d45aafe7d5e8ff7d4622e11ad8a0a7

  • SHA512

    568aacd021b9443e765ce8a56a821ee483ef3a73622dd45f892ad415300ec3e89fca83d125e060be1e033b88ec0776f83d0d5fb0edfedcab1e71a699d53e30cc

  • SSDEEP

    49152:rou2b/iPVHsgSrRy0MqGdYZeoJSpDKoBRHfkNkrbB8YdY1mqVn2zWO4Q/Lpp:rou2bwItMqGdYZeOSj2kndY1mqV2zWQX

Malware Config

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://hastanebilgimrehber.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletisim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkapsami.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtavsiyesi.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynak.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyolu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimgucu.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimguncel.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyonetim.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdestek.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimyenilik.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimtarih.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkaynaklari.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimplatform.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogru.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimdogruluk.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimanlayis.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimhizmet.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimkalite.xyz/MzhiMTg0NTAwOTY5/

https://hastanebilgimiletim.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.techvision.smartapp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5092

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.techvision.smartapp/.qcom.techvision.smartapp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.techvision.smartapp/app_lava/sJNjHpC.json

    Filesize

    153KB

    MD5

    f15570d6dec917bebad9257be3e19215

    SHA1

    2a20f09d50e0b4a4b4230cc6da9177ebe039c97b

    SHA256

    ad1fb8cfb386a2a9c20cfe6edb9d5eb1784806b1054daf6372c7923accb4689a

    SHA512

    ab4af1c34e944e5b33b3a4e3803258a7edb2d056f313f967950910933309948973e724cd568ed4df439a33ac880b6678c39a856dae8e422efb0bc1af76b814ff

  • /data/data/com.techvision.smartapp/app_lava/sJNjHpC.json

    Filesize

    153KB

    MD5

    dc290741a054cbeac9a6c4ae651b37aa

    SHA1

    38570fd2244771a384bcd3cb2dc16b292997e211

    SHA256

    5cbc56af95f61deeceea70fd47912461f41fb7b29da547d0c7e62204af28ee48

    SHA512

    ef45b5776a06b19f420b9b0ccd7b97349f3ae144751df42b2f7da8ececff01f0f7cad0f8cd9ab7b2abdb69fc6343563e18594a9a84bb852672ab4cb055e97548

  • /data/data/com.techvision.smartapp/kl.txt

    Filesize

    230B

    MD5

    6f7e4c9541d97e9ddf74f128780f28b0

    SHA1

    e3ff72b8773e105e5e89bdc368094d008af6310c

    SHA256

    1389ca720e01ed1802cefd1c3433e1acaf8289c13635452b85c1b96db512ef47

    SHA512

    2a33fd99005731400f61c839607c8e367525d3fc995928fb94226e6b022a4eafec852c747acf89028d36c6125eefec476b4b033d97ab081f2bd27c777863010a

  • /data/data/com.techvision.smartapp/kl.txt

    Filesize

    54B

    MD5

    0c8799306bbf88da0f138df34850b60f

    SHA1

    c214bee094f565965500d130b0683713e7b70c57

    SHA256

    65bfdd8d933484f60778b80564cc9ec3d96a16bc58f404cffa064789fbf29e1f

    SHA512

    50eec5eea93664baff62b81b6a9a40c52248356e416ba6c565649b5b3ce9196ea42b7aebb30df1f8c998c41b3772c66b50f89f7b87eef9bdf0d0642872732c28

  • /data/data/com.techvision.smartapp/kl.txt

    Filesize

    63B

    MD5

    21c86984ea749d9805d891ac558d4198

    SHA1

    49f69108d8447a8f2a14f4716e2b17665f082741

    SHA256

    9f4320378572a4b37c340c1aea8c3a105c7ce556a6f0b66b1b336063300d3c1f

    SHA512

    e7221664c56edef0f14ede1a62cd81a5c15d668ea9594017fb73009e6b2de95036c7db98e201dec68ab0ca9b7d7b026e3273827c8b4a460bc059c548213bb112

  • /data/data/com.techvision.smartapp/kl.txt

    Filesize

    45B

    MD5

    8788926a7f3facc3bb67f7583149c05b

    SHA1

    728162e371a3c4a8d22ca73962682cf3eb546242

    SHA256

    205df9f39531cf4e3f983b42cee310f26fe14f23f5b8c7156b12f2b3c4317b20

    SHA512

    b8622dd1f16545cfc4a5134c521ab25a45c096a971a3a8ec30e121de983df071e62e9b1a82225de66f7d87fffa1af53fc275c250a1d7bcfc2af4014d5399bd8c

  • /data/data/com.techvision.smartapp/kl.txt

    Filesize

    423B

    MD5

    d98532a27fb666de5c16e387c8cf843f

    SHA1

    6a0966b1507927acd060dd9bd26b1bdda1be152f

    SHA256

    50ab87b9c721377e7d3d39f7303ec78ae96f9c64f45445d80528ae4eda612580

    SHA512

    cb86df6033eda8fd1696c290e1629bb7f2c6d7b99e53d7a2f954715517abe8283acc8dd10d06f6e6bdc6d8cbca81b2ee19e0eee48bfa371f333e9a883bfdc0ca

  • /data/user/0/com.techvision.smartapp/app_lava/sJNjHpC.json

    Filesize

    450KB

    MD5

    a26559217d84c32c2c8a0bb59f1ce1d8

    SHA1

    f0ea68ad2bd177d8a4216b21db87500f5e0d25ee

    SHA256

    2e51decdc36ac38ab36758a65dc87817eb319eff59b95f9c36abef0805671224

    SHA512

    cea40a37df07feba39b6b106c9a9741b4b026da56af50b63352c440c4388c4be83c5477eab690a8c33735201ed3e1f2eac344b3262036c2a4f948154132f759a