Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    21-01-2025 22:04

General

  • Target

    24fbb897e635bbed64fb0bcf889425671e166be060cc135c81bfde3f875a18c1.apk

  • Size

    1.7MB

  • MD5

    87ca3d61865a1771cd08a04baac457ba

  • SHA1

    577ccb1009876fb0a120158e5a63b1519d8c0b10

  • SHA256

    24fbb897e635bbed64fb0bcf889425671e166be060cc135c81bfde3f875a18c1

  • SHA512

    b53cb9b1d28c7f6bec7131aa8a44651a22e20b1a7216fecd31bc46b1449406cdd1c5e70d9c5e649c2b592eb798504f7743b1e492b6e57ab2d147412fbc72daac

  • SSDEEP

    49152:bmY5X0KyKUpBG+JHwh+1HR+dB298g2Rg2gbE:KC0KQG+Rw8f+j68g20E

Malware Config

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

rc4.plain

Extracted

Family

octo

C2

https://karakterolipsbilgilendirme.xyz/hxDNtg7DB3tk/

https://karakterolipsdostlukhik.xyz/hxDNtg7DB3tk/

https://karakterolipssinemaevreni.xyz/hxDNtg7DB3tk/

https://karakterolipssanatvesahne.xyz/hxDNtg7DB3tk/

https://karakterolipskulturkonusu.xyz/hxDNtg7DB3tk/

https://karakterolipstarihiyolu.xyz/hxDNtg7DB3tk/

https://karakterolipsmasallar.xyz/hxDNtg7DB3tk/

https://karakterolipskonferansi.xyz/hxDNtg7DB3tk/

https://karakterolipsgezegenhik.xyz/hxDNtg7DB3tk/

https://karakterolipsdunyasi.xyz/hxDNtg7DB3tk/

https://karakterolipsshowsanat.xyz/hxDNtg7DB3tk/

https://karakterolipsicimsessiz.xyz/hxDNtg7DB3tk/

https://karakterolipsfelsefesi.xyz/hxDNtg7DB3tk/

https://karakterolipsyolculugu.xyz/hxDNtg7DB3tk/

https://karakterolipsrenkleri.xyz/hxDNtg7DB3tk/

https://karakterolipssunumlar.xyz/hxDNtg7DB3tk/

https://karakterolipsduygular.xyz/hxDNtg7DB3tk/

https://karakterolipsgizemleri.xyz/hxDNtg7DB3tk/

https://karakterolipskaynak.xyz/hxDNtg7DB3tk/

https://karakterolipsseruven.xyz/hxDNtg7DB3tk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.way.author
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5105

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.way.author/.qcom.way.author

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.way.author/app_grit/EAABNC.json

    Filesize

    153KB

    MD5

    25da6345a4ef8b81784a1b5de1f7ed79

    SHA1

    8c350c8db88d7cd08aa4d7011e3c8babf6bc2a26

    SHA256

    2b4a15712f479a2b7fa7211f7c84b66732e50ac930b7f8a8ba2e313a4ffb8be5

    SHA512

    a4afd3ec6f14dca96532f659b8760adb973266de1de0ea8bf4df696bd6156650fc37fda1e697a6af1d2722e4eb3aa95e5db1c3bc847c39605ba43efa3f4ba4a6

  • /data/data/com.way.author/app_grit/EAABNC.json

    Filesize

    153KB

    MD5

    ec31e19a2a45fccc3fc747ac96f6f027

    SHA1

    38d5c0bc8e2de133225ec476f9cff202c7ad1e48

    SHA256

    83885fa020ad8b5c4972406da946619960da140fc83ba69cca0c69c0e4eb07ff

    SHA512

    91725b0a6f6a7bd1845d1e2d93f5b1baf40c40ed5c8bc33222fa28ae09e478f2ef33acbf08c10e8e3c13c9a3f9403968a314c52f66960bc7cba623e5c40bec1e

  • /data/data/com.way.author/kl.txt

    Filesize

    230B

    MD5

    7e33ef9257511587f3ca04a3f3a4fbb0

    SHA1

    62d552aa0b4efe1f4964c623ce9f94590d3dcf8b

    SHA256

    386aa9fa3d821c82042b16399bf434a18695f825d0fb909fd7c38ed74001f101

    SHA512

    941a87b4e85a8ced9465a5ec5ef5375f90d10f903a62ac2777dd4e67b9d2b3e3c3082afc089c50cddd9ffab49a649eaff98768b036792cbdcd6e63e170c44f5e

  • /data/data/com.way.author/kl.txt

    Filesize

    54B

    MD5

    b76090cd0a67856c8c72e30a721d0897

    SHA1

    633965b45b4cfd3971299bbe1114146085b9d147

    SHA256

    8bae82c1dc0cdfa03ad215f4fd09536a9ef6c5878b9eb19a143d1c0f89b73c65

    SHA512

    ac66090f3f07fe8fa2274ec1e396bde379c29fe3495eee5d61c2fa8a84dc3e7f728b50d52f06cdba9d0b4fe372aa89ff2a0d6a2df7af366d40b36cf2e0b1251e

  • /data/data/com.way.author/kl.txt

    Filesize

    63B

    MD5

    e530954ecf6135fd1e0f34f47d44b50c

    SHA1

    d8f256e6c3b95656664f748655e8b74534acc0a3

    SHA256

    d23507e3c98645ec1f6ab75b12be38e264e382d73c01ea77d52a16560039b553

    SHA512

    bf33e7736a25604755f7b2503f06001cfce0f932fb3db7e8491bda80542e8c5fb6e993ef4e4bdba95ccd6b99a26f353332aafce95058026cddf1bfac26ed39aa

  • /data/data/com.way.author/kl.txt

    Filesize

    45B

    MD5

    f12774582fe810bd77c72f07436665a7

    SHA1

    e8e42bfe236eb6ee74acde439fde0ab2438b7a20

    SHA256

    0294af79137edd87cf27214736e57dc0a18fe87e0a44f23307bcc528bbf537f5

    SHA512

    46c496188a681cb1bf54343a06c90cbfb53bcbca394cba1815b0d8c17556bf54317ecfc63de5c7eb5b616ad09e1b3aa733d4e817482050090a8e61661e63148e

  • /data/data/com.way.author/kl.txt

    Filesize

    423B

    MD5

    fcdf6adaf7a2c4c68e5ce1e8864c17ad

    SHA1

    4161990aaf30e015224ae40fa92fb2b0a5e4363e

    SHA256

    376abdd932c2ac0d31998c1beba76367ca7ea3306cd63e09239d95d955cd05ac

    SHA512

    09d21001843f40e5e52fa4cff62aea6052b617e770be753d2774eb703016f9710fe232264f39f53c51ad7675830c0f6ae8fd09bc19912d55264e8cda65631834

  • /data/user/0/com.way.author/app_grit/EAABNC.json

    Filesize

    450KB

    MD5

    2b7206a589c561e00a38c12a5e50b0b8

    SHA1

    b91af49f5ef97dd1a3ade5c532b6684d2df58ac2

    SHA256

    9dd9aab12c3278ec877c88d3ac819c066de53ef6b4ab64c82a35b4e787301ab1

    SHA512

    3eedc6444ee9d9ff446c4c0abf2fd494d892acdda2c5c1798e818ae11733bb6bb8981b0877c3a40259368e162f7b69c5aa2625501222d390147edd9df63bacd6