Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    23-01-2025 22:03

General

  • Target

    147f5aff75a91f5e8d50950b82ee6df96ad7a6d32396fdb490cd7f53782e6971.apk

  • Size

    3.7MB

  • MD5

    8065b2e6a6e655f89a2c933e3283d952

  • SHA1

    0ba4353b33c739c752248028c557af5d5a8e21ef

  • SHA256

    147f5aff75a91f5e8d50950b82ee6df96ad7a6d32396fdb490cd7f53782e6971

  • SHA512

    cb33bd80d47e85ecc7f137096974c584f179fd0a503c3cafd89d8b53e93ed18d0ef47050c2d86fee52c330a6058138f626d6b99f9743830c4e1770f028529b69

  • SSDEEP

    98304:pZES7azaZZsEzIbVamTwtk4oQbg52r5ysPmKgAKjmVn3oofbqVrWYI5IjCs2E4:YbHwE2CmZ3oof+E

Malware Config

Extracted

Family

octo

C2

https://sudanhavalarbilgilendirme.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarmanzaralari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarhikayeleri.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarvesanat.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarolaylar.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalargezisi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarguzellik.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalaranilari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarkonusu.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarfelsefesi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinrenkleri.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarintarihcesi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarvegizem.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarveyasam.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinduygular.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarplatform.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarveseruven.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarindogasi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinfaydalari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalardunyaniz.xyz/MzhiMTg0NTAwOTY5/

rc4.plain

Extracted

Family

octo

C2

https://sudanhavalarbilgilendirme.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarmanzaralari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarhikayeleri.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarvesanat.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarolaylar.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalargezisi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarguzellik.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalaranilari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarkonusu.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarfelsefesi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinrenkleri.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarintarihcesi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarvegizem.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarveyasam.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinduygular.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarplatform.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarveseruven.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarindogasi.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalarinfaydalari.xyz/MzhiMTg0NTAwOTY5/

https://sudanhavalardunyaniz.xyz/MzhiMTg0NTAwOTY5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.turn.pause
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5117

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.turn.pause/.qcom.turn.pause

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.turn.pause/app_party/ldLDetX.json

    Filesize

    153KB

    MD5

    f049d374e4ce26e2e987996775505464

    SHA1

    6dff2e9dce438c9fcd15153e356a37373c059c3e

    SHA256

    e5ac1a06e026e6e6f3d8f98ce3bb59d9154d6e345dde55382fa185c70f4685ef

    SHA512

    d5228bb02df8486523b36061d96faf5dd9ffb5b4cc67722f758317eb2b2efe5bee0949c9b025e688396eb8d682aca9f5a51ac9fe5325cdfe76f850bb7f186803

  • /data/data/com.turn.pause/app_party/ldLDetX.json

    Filesize

    153KB

    MD5

    154d79a3c73bef27c8148010d732b405

    SHA1

    096bde8931305bb43a286ba4d40d271f76ca91ee

    SHA256

    3b616972ee4485f46cc8c6f2b506c70c364f1473e8d66e3aa21340d0a6f9b9ac

    SHA512

    9e86eed86d99bb5cfae80af8aa3f7dfe04ae7e953bf835a73dbcbef4e3c76ca8552b396260f7e77d92a1cafef59121f78782998ac072879d5bddf5d252879f3c

  • /data/data/com.turn.pause/kl.txt

    Filesize

    230B

    MD5

    320679826297f50a487f9718a470d7e7

    SHA1

    ba9269b0f18e12a8a0a86730948a34422ef6581a

    SHA256

    c010d3cbe9dafd266fc7cd1dde0d48c1b35bb63caff4df90a32701ec2dfc67a8

    SHA512

    4a6740553ee03c492131d64afffc6d1c5bbfc954fae659c7e25489b1e4b046304081ac941378cb43271a15c723715b1213405ea2b80dccb72bd4202686a5638a

  • /data/data/com.turn.pause/kl.txt

    Filesize

    54B

    MD5

    f1b7236b325d35c0ddf9d8ffd40e638e

    SHA1

    e6ac092d7d7aa82d2ca36f7756151406293630c8

    SHA256

    897ded4024106fe75ec7c256baf2f0f76e8506f3bc876496d4d763952a431938

    SHA512

    c75c0f9f977de9ab205b6be2d240ff826c883a8289eb0600d5654b13d9ea6c3906305e712584fdccde30cdba3a7770871a7413755ac8db483ae01904a09bc9a7

  • /data/data/com.turn.pause/kl.txt

    Filesize

    68B

    MD5

    dfed7d2be0163694291a10c048ba6b09

    SHA1

    851c14eb720aa07a6b8e5f7702a021ae00c7d9aa

    SHA256

    bcbefa737cee6c3279b1ade935e662706667ae2c230c6cbe3e4e82af4a47c29b

    SHA512

    d9d562dc038a646b13d6e60f4502a1ab89ac4ac1d1021c7bcdae074e2d2ee3a4c6ff8445fa01d661968768bee29478f0a6654a752f4d4d46ac8e35a9e4176d2a

  • /data/data/com.turn.pause/kl.txt

    Filesize

    63B

    MD5

    3606ed8a8f5668f6f310b43b113e783c

    SHA1

    580c1b1f32afab7da7c5e5de9cee94a27760d4ab

    SHA256

    38b88e16eb4427793216686144cb078a60ea70dcc9ee2a27879eb29ac4aaa75c

    SHA512

    54ebb07d6a1f9b1cfe841c6c4eaadc533cc51076ce9fad4f050b4dc715be47e5ece09d4acba4c8a1b54249c74026f5fe6a6ac2644a6d7e5cfb6d63ee1f0b1a18

  • /data/data/com.turn.pause/kl.txt

    Filesize

    423B

    MD5

    84eab5d9d93f5203f2389f0bc03c398c

    SHA1

    c4b4bf702725afd339cc51fe57c4fe20fd1d52de

    SHA256

    138233216085a71c45ad0dd8c5d77c6326520bf2750f5eece890e9e2f6f1f0fe

    SHA512

    9aab81335a4eefceaf5b3390ff5fa2b3f436a7757a7b26b2a086cef247488e11ada2da9183eeb5a45378d0b53ae2f9f769f17ba1058ff5a01f4877d2a12eda07

  • /data/user/0/com.turn.pause/app_party/ldLDetX.json

    Filesize

    450KB

    MD5

    f910f99c60f144ffe52f8f9c2a65f213

    SHA1

    8950b03c922e5153fd1d990aaddf134177345858

    SHA256

    130412cdd198376aa1cea4d08c1e0067aba1310fd92ab40d59dd469768dec868

    SHA512

    9ba55f0bc25e96b2e146564286f5f464260d394cfb8316469aff9a4c2ac5de05acfbad29aa94f425ac1158b39a27cd0887dde1d0db90dad75bf71e884e188cbb