Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    08/04/2025, 22:18

General

  • Target

    3710c55b667618efeb7a3390993ff480a740fc73a38f6d6c7e1970cf38e325c2.apk

  • Size

    2.1MB

  • MD5

    73813967250bd6df19d65674445cd9db

  • SHA1

    27893d72526fcdb3a9802df896a79835777f7ff7

  • SHA256

    3710c55b667618efeb7a3390993ff480a740fc73a38f6d6c7e1970cf38e325c2

  • SHA512

    e7a86dd64040f6b220038dd47756644119edcf545ce9c1200ac450bf1cf659e31de9c7d60bc0b7ec9712ab95d7d3bbc226802b5f527d966e711e82c27611fcb7

  • SSDEEP

    49152:gPgVLVCLKjfy44UVzsbpbeYhvKStGcTgC8IOQ3eiWiXofbcwgQGJDx5eX:goFkLyft3YbpxlKShTgCAifXWjgPJvg

Malware Config

Extracted

Family

octo

C2

https://tonbaliilezzetustalari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitarifmutfagi.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliigelenekseltat.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliisaglikliyemek.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliidunyamutfağı.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiseverlerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiustalarinyeri.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliigourmetlezzet.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliisoframizhazir.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliishowlezzetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitariflerdiyari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiyasamkeyfi.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliifirintatlari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliilokantalari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiseverlerklubu.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiessiztatlar.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitoplumlezzeti.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiuzmanmutfak.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliibaliklokantasi.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://tonbaliilezzetustalari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitarifmutfagi.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliigelenekseltat.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliisaglikliyemek.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliidunyamutfağı.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiseverlerkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiustalarinyeri.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliigourmetlezzet.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliisoframizhazir.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliishowlezzetleri.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitariflerdiyari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiyasamkeyfi.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliifirintatlari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliilokantalari.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiseverlerklubu.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiessiztatlar.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliitoplumlezzeti.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliiuzmanmutfak.xyz/MzhiMTg0NTAwOTY5S/

https://tonbaliibaliklokantasi.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sort.strategy
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4797

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sort.strategy/.qcom.sort.strategy

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sort.strategy/app_tortoise/ljNBiZW.json

    Filesize

    153KB

    MD5

    fe6e66fb592c9599ac0672cc9e632420

    SHA1

    bbb153d11ea5b3df7336d78fc26a0a9a0edb4ec6

    SHA256

    9179afd642e007833bab373f3f35d25ca9be8a55bb63b8410a247bdafa2493b4

    SHA512

    a7614a5779ed2b4124be3c7fe729088111d6e3c6507860e11324c247691e177a3c97758eb4c0c25236d4609a7691ae63637adb814cc6adc24ce557d2ad56a70c

  • /data/data/com.sort.strategy/app_tortoise/ljNBiZW.json

    Filesize

    153KB

    MD5

    41c3e87635c28fb2d33f9885b8025b19

    SHA1

    84dd4b7ce9ac33262a286118887dac8c1d37806e

    SHA256

    bf5165124f37cc5513f88552c559efcfd4e055d4d2eb777d4596d33ff466b4b3

    SHA512

    76f568c00e81c104ae646d2ce3222e97a3f8d75fd537483db3dfaf80a55c27c4e8a712d53312fb0957cc61dffaefb1c97b52f5f7100d220afa56c0d28ce22d76

  • /data/data/com.sort.strategy/kl.txt

    Filesize

    230B

    MD5

    ad16167f71d1392fc83eb3a41c5b7889

    SHA1

    ce401b4e35c6dd2719660aeae6ec92dd10501771

    SHA256

    5d06791064d025cbda919f4356652b92423ffce817737c91f5603e158747a98a

    SHA512

    0d675b2122ce005583263892a915d609e50ec51aef035afcdca14a905e4e6874fefcb146721a01725065ecc6aad85af7109f277f7bd430f36b755faf2f71d21a

  • /data/data/com.sort.strategy/kl.txt

    Filesize

    54B

    MD5

    0126458e9f98c604ce2c7212961001ee

    SHA1

    dc18fb9e333aa201b2ba05e8bd01baa9a2b8f8c2

    SHA256

    ed16cceba3a2d87831f326fce41a4527fda55b96624f68135bf4e67df753e182

    SHA512

    05a1ce1799810a402699e45bba0aa29cc063eb226acf0e0d11201ec85410a86976c21c6c96f1a79a979515e82d84d8e1bfd1a7e3110218a075371bb80adaba5d

  • /data/data/com.sort.strategy/kl.txt

    Filesize

    63B

    MD5

    10b1876c9359c33bb103ab09e17d2134

    SHA1

    22ead805cedf49e9cf41a7327afb72ccfbd3efec

    SHA256

    9ec2e19c08e146c73f520ba5496afb39302503890f72246bcb740b89f2503d8a

    SHA512

    78cbb76d4942650aa4679884ceafd085987d920a87dc6712a1237755bd9abab98a3d3edd385fae18fdef41b3887d0886a99454ec93e5273eb4d0bb1c7e0b9abe

  • /data/data/com.sort.strategy/kl.txt

    Filesize

    45B

    MD5

    af0fc548c97a387263b2e0bedfe4f7db

    SHA1

    a4ed3960847afed6a5b0eba65f250c939090389d

    SHA256

    82341134b8af9c1c16a511c30edee35bf15dc21e1620b35b20a82bb144cf99bf

    SHA512

    4b713e787642f9dbb4ee0489498ec87ed79d0e2d49021718622d4c3b7aaac37e7e4a573c4d62910185e08fc945f17dd04c98011679000f00c13829f7ff1ca3c4

  • /data/data/com.sort.strategy/kl.txt

    Filesize

    466B

    MD5

    3100e5ccd102a6980a5588103ed8085b

    SHA1

    7899164ba47af13b9fdac3331ba94c94a343c169

    SHA256

    ac72507080ecb42915854e52212cc5691e4086535345a0d09fdfa24f65ab5955

    SHA512

    9952c3df35c396286b137c80f9d03cff1410a0a46c5761dc43bc411187592ede52c414d77b74100b94ddb3c3cbe9b1fb0f4d893fdfbf453ccb38634e9cbbcb38

  • /data/user/0/com.sort.strategy/app_tortoise/ljNBiZW.json

    Filesize

    451KB

    MD5

    2a22e03b69c82e52274181882b3b5de8

    SHA1

    ccc1656436ee7f68e1670ec99e390671401a9e2e

    SHA256

    21a92940ed8942cfd99464629c426d6d2329e1fe947a51d8422790cb6d5cdb26

    SHA512

    7448243b0407e4e9891bd55fce68ec6cd00a78cf443023e2f8b0913569ec8cb0ca1be14e2a1b983c1690d248ebd8fd2bc6da7590734e13bce61217822679cb41