Analysis

  • max time kernel
    64s
  • max time network
    152s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    21-01-2025 22:01

General

  • Target

    092dbd1a4cf25298ea8a47229276df24b6513e5a8c3a4360f67c0f672e954bd8.apk

  • Size

    2.1MB

  • MD5

    3cbbdb33f9e0fd28acf02a03fe479d66

  • SHA1

    05c917c135b15a46bb20bf032f876c625501121a

  • SHA256

    092dbd1a4cf25298ea8a47229276df24b6513e5a8c3a4360f67c0f672e954bd8

  • SHA512

    b121bcd58fa7010f04484689acad7e768a93711fc44887dc7b3c419a5a05953a76802a13d3a63049d93e65fee5c3faaada3a4b48e279eeda95a66ed9fa124cd3

  • SSDEEP

    49152:7qgy3GzLak6jhI6jLU6sr15DtcnxllNt+hzHRfscDpgGF0/D7hdxC5JVLFoSeI29:M3GG66nVsJcnjljizHRfscphFcnA5JVS

Malware Config

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

rc4.plain

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • homeworkout.homeworkouts.noequipment
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4982

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/homeworkout.homeworkouts.noequipment/app_spend/Wo.json

    Filesize

    153KB

    MD5

    c480acac07d5670044e8a7823f3aa1a4

    SHA1

    05f499f2192a859a32df90c18b50f86bf26a663a

    SHA256

    8a3d54220b3eeb888bbe2fddff82d4f6f0f507b290054dab5c2bdfd4398f2454

    SHA512

    a9fa3bf9ab33cbc2489e870f202d016b361142a0458af94a69fc89ec4c0c3b15cbbfc1d520628f18cd1fd296140ee96d3dc1a51aa8328ab6dee923308aea13d8

  • /data/data/homeworkout.homeworkouts.noequipment/app_spend/Wo.json

    Filesize

    153KB

    MD5

    b16fb02d302fbe9d3ab1b261dff91331

    SHA1

    bf28de71f5bc7a105821dc03559f1e7dcd9a1326

    SHA256

    2bac2e99e98f740434944f9e951c6a01eb2bf1289b5b14aeb9a3499cb0f1f623

    SHA512

    44b48f04b3fcf5af67230da383d84646864ce6e6aee845dad5c4d57cf2bc280326993cdfd421e15b0055c24ec6a124ab4d336419e2aaa56b1f41fe1601240940

  • /data/data/homeworkout.homeworkouts.noequipment/kl.txt

    Filesize

    230B

    MD5

    09346015fd3c0f9edbf0ab7b8e061373

    SHA1

    546146a9dbfc6d42f5f07a72df7f21d2f57e344e

    SHA256

    94e74125ef26add4d46bd9c2dc2fdc9984eaf9afada497bb041c4459b8aa11bd

    SHA512

    71ec3cd93a7c77ccc004f936b0470f9ee64d5bcefb48985193ffbfcb7112227eb4ee790d2b851f0a6cc52bef5777171dddce4d8d69c98433d31e39e3644df158

  • /data/data/homeworkout.homeworkouts.noequipment/kl.txt

    Filesize

    45B

    MD5

    5e8c18d2f3f8cb374617ff2b45e8bad1

    SHA1

    38c92a2e416eaaac9fbf64db34247f3fb5245865

    SHA256

    aa9f0038cb2f4742d90f12e5b8344f94857b59d05aa4ac3f36ae02b1294305fc

    SHA512

    38907414aae9cf5865ede877121c2d8a20f1ac87c71e520a2654551074284789c293d9287700d4cb66bc0e8b8a701057a1e8826f13e0ba62961230d4d4cd55eb

  • /data/data/homeworkout.homeworkouts.noequipment/kl.txt

    Filesize

    63B

    MD5

    effc9fdee7ea21f51a0f1d5b449cc723

    SHA1

    100fc6cd962308623290eb7681173aa8b64dd9f1

    SHA256

    c9a81e8020a40c89326315dc5f4a4f1e6516100453585650da4b3a198ad6a143

    SHA512

    80dcba8cb16bdd7ec231ea4268cd689da850bdc51f2280ad3fa755cc6a09270ad06d9e05c5a618bda8628e1dd00d687d18fda04bff9197e574c0185b74316f11

  • /data/data/homeworkout.homeworkouts.noequipment/kl.txt

    Filesize

    45B

    MD5

    9beb932c85af7ad77df5e9e0b11d498c

    SHA1

    839acf021c8c0ba20f85e9a7c7787ab7b4c94a74

    SHA256

    b3c978d444f6526523146835d736b5f71e0c4ddc9dc3f8af8e2a3c0d198103d2

    SHA512

    2729707bce7e9598d0c5a3665c314fb17cc61f4df5f240e034568b7ead77f632761fbb184c6e6bd35c201530267b1bdc9a06d4ef38b821c5bd3750b61635126c

  • /data/data/homeworkout.homeworkouts.noequipment/kl.txt

    Filesize

    423B

    MD5

    6d3a2f72d540b5158677a34c48958a26

    SHA1

    638e756e6db9b3444fd87d0c1b28b2771553f712

    SHA256

    bc99ea24b1901fec386ac2f7910c70a020316276fadc5b09a7b12da334540e9c

    SHA512

    40d489c25e24bbc773cd2435905832828720850efe9b2529027131cb727dee3ad9cb7adcffe8d619cabf021f29a09afcee72a2abe846da2a6cded50a05c2988e

  • /data/user/0/homeworkout.homeworkouts.noequipment/app_spend/Wo.json

    Filesize

    450KB

    MD5

    c186e81d554e3718b88b544fe5e0ab41

    SHA1

    60bc93ba5f26b03f6dda1b45a373af9f0ff59ea7

    SHA256

    9fe9deda80a8fa54b59d75d7782cae2a0b4c89c0ad026f3ff223e04b79d1326f

    SHA512

    1cb0b2fd7517e11ee12b699b97b45ae947a0bfbcedb1be21882680419199ffdc76381a1676abfb0df62ae45d21b607b1ea7356d81da4596e6ab09e6d78ffcd73