Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    20-01-2025 22:00

General

  • Target

    9550871b333d7f620c02cb56822b91b656940fa7f833cfb48fc40471f6870664.apk

  • Size

    2.8MB

  • MD5

    9433bf8cd7c5f227289114d891da9224

  • SHA1

    0a48ae20673e4938e8cfe4cc062eb66ef522110a

  • SHA256

    9550871b333d7f620c02cb56822b91b656940fa7f833cfb48fc40471f6870664

  • SHA512

    b82edce3b092e048ce56a6c56b32b3401a0ec1005fe8284e56d756ee37084da7f48b85a9d5581f2ae1eef602ba9006ec8acb465cdc73b107e918ed7b3b0a59b4

  • SSDEEP

    49152:KvuEPfuOMJszChUUi7gL9GHO5gk4Y462Nn3mZc4lmzv+J1Fzi0taqMsAeeM5K3Gq:KfPbgL9w62Vmflmzv+J/GMAQSOTWsOJ7

Malware Config

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

rc4.plain

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • homeworkout.homewosrkouts.noequipment
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5061

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/homeworkout.homewosrkouts.noequipment/.qhomeworkout.homewosrkouts.noequipment

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/homeworkout.homewosrkouts.noequipment/app_system/EjwiBaj.json

    Filesize

    153KB

    MD5

    65e6f2182a3424638a74716c089449ad

    SHA1

    f407ded28688059071fc054540a676c20d1bd237

    SHA256

    faace5580b30af5e05906a37e24decd9dfd69c4bd63686c9f26aa5fe0e3329bb

    SHA512

    05cecf36ae62d723adeeab057ee22763ef41e71280f7e6b9a30bcc11bb6eed1b03debac4ee4f96ae7aee7783b18a338a9f5c5c80ffc40e6fad5e9ecb4a9bfaf3

  • /data/data/homeworkout.homewosrkouts.noequipment/app_system/EjwiBaj.json

    Filesize

    153KB

    MD5

    a5d36a9ed2c90e42b1916a068729a3c9

    SHA1

    3b3e14047ba10db18bf5675b48abeb5d8e7dc614

    SHA256

    dca40b9c20b3c7df8b8f7236cab5d89fe6c78a7d0e80049593254ed8cb1637d7

    SHA512

    6bfc7a1d85f8279704d512375246e885c72d53a54229115418de42b1e3afe0f7d3c1718d00e62093bf4cb3e4f2dd0caeda7ae24d4fe861a4d2a9a943583ad1a2

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    230B

    MD5

    853a2d4dc4d095796b98cf6afcf1a531

    SHA1

    8128ba7c4f0038931379bc1f3c8db1e05aea1bb9

    SHA256

    19b095c649d4ba03eee9d3a44ba0a537cd253bdec6623d8467933417dce0fe35

    SHA512

    437a29c5355ddb22457fe4e22ec2c24e97ef586e7d97e7a6d384b6dc075a3885abf3ef43694cd3155a4c42dc28e466dfd52a89947f04c06b42413913bbee95a7

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    63B

    MD5

    03b12aa99d1e3c71263aa7d86bf522b7

    SHA1

    0bd8bac98d06e3592193e3c443dee8ce644887a9

    SHA256

    8100c04fba0ec64aa90b3539b3eb28223bf90735aa1255d55a98938f1d9e7d16

    SHA512

    2cd970f7a47e6afea16d2e9e810a62cb5f8ef5e92fa5b6dcfabe937d91992f3f3511325612890f7a0e37f0dc9c82550bc255376508e4dc141c93f0de26fd5f83

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    60B

    MD5

    37a67d3d5fb72ad24299865af5c62cfa

    SHA1

    498ed17de59bd04ff2bf58f96420dce222f67ad1

    SHA256

    83e50937d5b578b42d2c558abd673285f9a83e5fc0d7f0e7860478f448b2e141

    SHA512

    9411d630242a902d260611d7c19be67a1744d076d0c4b415f29c4fd060515eb066949879122814b1ef0ba0f64373eae18f126e001a7ce677489c8a4bddb52681

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    423B

    MD5

    89d3a7a2b6def11d45f4705f9455678d

    SHA1

    ddacfb7304a7223d565a2f94a71d0791b3391943

    SHA256

    6914a0dfb92b7f5f6840923453b2f27fbfeff768a57123a3010041c294eb24fd

    SHA512

    bfdfca08bb668e7095f3686dfeda786458ce1292480e3aa4ddcaa1c075e6f4f1b10b5b06ebbd8b9554fc03c1c3b09f513da7dbb7f6d32dfafe42fac0494cae39

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    84B

    MD5

    15522de2c64f71a354731e54f81a4bf0

    SHA1

    e9bb1962cb21905ea33128c75aed89563ca61c86

    SHA256

    5e53cbc4523a619663b4ade7d35c793c047557c2272c0d7752077f91fb23cc74

    SHA512

    d02872b39f111eaaac780c249b9ed7e32458130ecf0996351010be2848fa1cbdabcc409286bace28b0eb84300405450f8b8200b0576951139a900c6e24abf114

  • /data/user/0/homeworkout.homewosrkouts.noequipment/app_system/EjwiBaj.json

    Filesize

    450KB

    MD5

    6666d3b2a41fafb1a0a6520a3863769d

    SHA1

    d83248a52e6d8a5dbbae0104418b1cd16e11ddd4

    SHA256

    23f92d2e21bc96e7f730645ca80ffc9560a17567991628d82ace4e2ab872545a

    SHA512

    f9c405f05e6427c645b4ec10a7a04bb4df150fb96a463b932c278cbb717db7db090787e5c67769c06fdf356f2c4b6707829c1a3bd804b75330bb45b8978fec58