Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    21-01-2025 22:00

General

  • Target

    2a23054dcb029c0820b2a442618f9d2374f0ec32b8402dde123131e99b1605d0.apk

  • Size

    2.5MB

  • MD5

    a72fe16554fd42185885177a3e7825d3

  • SHA1

    b796a9755c887e91534d13c507160d4bf1ffdd6c

  • SHA256

    2a23054dcb029c0820b2a442618f9d2374f0ec32b8402dde123131e99b1605d0

  • SHA512

    ca890e5aa960e03b79d684c62d78f5f6c4c772438cf4303d171e1c76e12aa78d622c76ba285092b5a5d1ecc7dd0e1587cefcd98fa2e7251693f468b25df3bbd0

  • SSDEEP

    49152:LyxKyZ9zhlqRaMrR0wSR95RvqKW2o65plOSI1OgL8LxodbnpcDGTBjufyK+6lxxV:/yHzhgrR0nR95pqKWE5nOEggLx8TCDGW

Malware Config

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

rc4.plain

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • homeworkout.homewosrkouts.noequipment
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5071

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/homeworkout.homewosrkouts.noequipment/.qhomeworkout.homewosrkouts.noequipment

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/homeworkout.homewosrkouts.noequipment/app_liar/Jqcb.json

    Filesize

    153KB

    MD5

    85a94d29758c5ad9dda1894d4ad76f04

    SHA1

    f989b4b29a622e88c74c28358871fb7226ca55a1

    SHA256

    5c1a7a101f0f3c9d79185f63ab5e1bdb1d76c61b1dcd753ac2ce65117d9d8f07

    SHA512

    8c1f238ce1067e1bdb5e3bf267d94a99bd863be532cf4a90ddae46ced8a6c872a7721b6b44f719dde11ffaf4d5d0ec2279b776d259a8cfb43f206a5fae277433

  • /data/data/homeworkout.homewosrkouts.noequipment/app_liar/Jqcb.json

    Filesize

    153KB

    MD5

    1465597173ff7efa6250d1fab99270f1

    SHA1

    5c68f2ad4eabdcf70043f5f51e1893b6e6907458

    SHA256

    cb9f950ca87a29d0e870ebc8e1227bbdc716fdb8b1966355177a240143098370

    SHA512

    e46da7ca7615f7d54becf1d44fd36763e033a7edcce4334b6990129158e9a64e1bd36a7493e813f12babb81347db88a6c13fa32cc47a99609f22ae19c3b1de7f

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    230B

    MD5

    a07c5d7c3768694e39a40ad59b9a4a50

    SHA1

    9d16a830b9d5e023e3de0e5dfbe164fbc5dfdfc5

    SHA256

    7cb09832f6979c301bc51af927c9c7fe1945b13376e9943760ce30a38e8c6937

    SHA512

    46554f7a81929197d62a3bff57eac562344a831044e7cf8fc803a73c08bca9d3dbb54fb4542fb3758560e7f1fe25988b6620895a08f51b0e5e27c613ac0eb6ab

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    45B

    MD5

    14b635b4b58055a4f09948decf0da35a

    SHA1

    5a1925826483e998d4636a792f6f62e7b7ee15e5

    SHA256

    9883c993c229cec19e1ec5e63ee9e1a0bfc7e3fad5973240d2cd088d765117ec

    SHA512

    9c635c954b1a951281e06bcd229b71ce94b464a18269970ee5ae3ea51f75902f886f1bd3c249470fcfae010c3ef2a4184382d0814652133d470328b9d34fac71

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    63B

    MD5

    fd1de4ec528b944362ac664ca790444a

    SHA1

    dd07e7763f24ae3c0b57e76c71a85870f022bf6d

    SHA256

    fcbfee700dcb5f12ae633c225cd79a8e282cb8ac1494382bec1846ecd14b4de5

    SHA512

    991928db4fd877bd810bd99546f056c800d1eb22b26e6ca70c309767e898db51ddfb595c52f79b14350a1cb04edef97c94c4d2603f3386c6951ed535036c5b79

  • /data/data/homeworkout.homewosrkouts.noequipment/kl.txt

    Filesize

    423B

    MD5

    7b42f2b1fcfdfe4b83258ff94f0d2708

    SHA1

    1929d44d6edad84a336180ffa9ed545036b8e36e

    SHA256

    37a034ceda183acc76c936e534d72d9aedba3580536bcd8d8fc2f2b2c73a04ea

    SHA512

    95420c32c53d1f5914ebe5a2cf030410bece71ad8eec03d440c696a4bef13fcf0bdfaa96beb5efeaf3dbb70a69cc6bc5fa3e2ebb62a88f7115d312c9056435c6

  • /data/user/0/homeworkout.homewosrkouts.noequipment/app_liar/Jqcb.json

    Filesize

    450KB

    MD5

    6666d3b2a41fafb1a0a6520a3863769d

    SHA1

    d83248a52e6d8a5dbbae0104418b1cd16e11ddd4

    SHA256

    23f92d2e21bc96e7f730645ca80ffc9560a17567991628d82ace4e2ab872545a

    SHA512

    f9c405f05e6427c645b4ec10a7a04bb4df150fb96a463b932c278cbb717db7db090787e5c67769c06fdf356f2c4b6707829c1a3bd804b75330bb45b8978fec58