Analysis

  • max time kernel
    149s
  • max time network
    165s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    11/04/2025, 22:09

General

  • Target

    7a02fec77c8e49b5cda238a3af6ad2688570c38bdb296562ef20679d2004beff.apk

  • Size

    2.9MB

  • MD5

    140f4aea0e8588d718c4f2d8b73839fd

  • SHA1

    569acc5177caccd6b062727b6af4bf4f546c5723

  • SHA256

    7a02fec77c8e49b5cda238a3af6ad2688570c38bdb296562ef20679d2004beff

  • SHA512

    2943793ce481692fa2ada9a15f91380028305a9783bd747d647fcd28e2a80331ab0ee9c2e55d0a107cc293b77815ca87063681f810c6d891c02caed11717fab3

  • SSDEEP

    49152:MqbMTgUyiJYJtjc6IA01IqcdeEnTIll/z/xppr21Mg1bCjEA8O0VjZIe1Leo0ZWc:MqbMsUyKSdcFdyqcc9lBbxzaz12jB894

Malware Config

Extracted

Family

octo

C2

https://vurtancanerefsaneleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerdusunceler.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerhayatizleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerzamanakarsi.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersanatkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkaleminden.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerhikayeleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancaneranilaridan.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersezgiseli.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerleylabahar.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerdalganotu.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergozundeki.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkosusunda.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersesindeyiz.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergercekleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersonsesler.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerbilincinde.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergezegeni.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkalemligi.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerduyularda.xyz/MzhiMTg0NTAwOTY5S/

rc4.plain

Extracted

Family

octo

C2

https://vurtancanerefsaneleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerdusunceler.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerhayatizleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerzamanakarsi.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersanatkulubu.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkaleminden.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerhikayeleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancaneranilaridan.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersezgiseli.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerleylabahar.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerdalganotu.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergozundeki.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkosusunda.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersesindeyiz.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergercekleri.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanersonsesler.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerbilincinde.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanergezegeni.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerkalemligi.xyz/MzhiMTg0NTAwOTY5S/

https://vurtancanerduyularda.xyz/MzhiMTg0NTAwOTY5S/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.remove.odor
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5079

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.remove.odor/.qcom.remove.odor

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.remove.odor/app_enact/QlJleT.json

    Filesize

    153KB

    MD5

    ee04045b882ffb6dcd618063ff2326ee

    SHA1

    3b89cb8482059d5220ab34502e8e3a558b407e76

    SHA256

    b0200e4a1837f1a2d83ed0d39fe84835b4cedf640a54c1b782119f82ae7d511b

    SHA512

    adb85fb0d055dc499d02e1ee4b9caa627ff8eac91db1b58d79c95721101554725442a7b3b7635f1b223d64c01221b270acf7c7fe58df488ec03c935838fa12f8

  • /data/data/com.remove.odor/app_enact/QlJleT.json

    Filesize

    153KB

    MD5

    7cdb9b1450e1d76dcc21f5f382ad24cc

    SHA1

    c3ce040bec50c93d25036c3d0c5471fad330b7a4

    SHA256

    4c64b29211fb9d8c128139a99b4a87b8442395475fdea6d9fae3bb9e5780591e

    SHA512

    7fade798dda115d11bddd8656bed3f05abb727a0306c14f5143173398f83d28301be8509d8ec460b237d046870b1d46ef8f1b11ff8ce721521c3341d769df9e7

  • /data/data/com.remove.odor/kl.txt

    Filesize

    45B

    MD5

    757b66fe64ae14b03e448b514dd356f1

    SHA1

    f17fe0166524e4a2714789c9ca202230233d324e

    SHA256

    5e030cfa4abff36e140d3c0f764f6b5a2b39298295b1deea38d218a022d585aa

    SHA512

    6a963db79b2d11277de569018bda8e96094efc9a340b4ab1332c27bb3d8e90e8bf2604871525e57e5b1a968e5868a3b13871f53da6533e9aa1c6826715a213ff

  • /data/data/com.remove.odor/kl.txt

    Filesize

    66B

    MD5

    d4c2bcc362872d96134f535e49343397

    SHA1

    16d0b7c33015142ad76162a5c8634623b4e1072f

    SHA256

    6fadc24231cfc7d492101942bc9fa98886ecae52da99c229d745868fee3c87fd

    SHA512

    63101be919e160c990114dc2748a88e711383baa204e29b838e5e7601a6b0cdec1f527c39db75f9a9b4a7c290eff73ec471dbb87104db5dcd061e7d755c093f8

  • /data/data/com.remove.odor/kl.txt

    Filesize

    45B

    MD5

    a7200ba20ed67841bcc0a3e80aec160a

    SHA1

    921d7d0178a91758a6e129a014e93bc033377aa2

    SHA256

    92b4729c1eb644f2162123d91a7f7ea2bdb0424c2896ef089380495d6c1fa44c

    SHA512

    f6a4e78cf7e6ab1fb698b87083466364c26aafda18b37324bb2a754224d175fa751972758c2e69e6660d0f9de37f8acd9101d5348bf90ed71429e9b62f04cd58

  • /data/data/com.remove.odor/kl.txt

    Filesize

    84B

    MD5

    e15bc53358f5a7f87d71e8f87013adb8

    SHA1

    d0f20f2a3f22e0462fc2a46d836800cd27e90cfa

    SHA256

    5cb193421a6d7795b187d92eaf2c9f535aa0d418e33ff1989774d42787f32203

    SHA512

    328ab7602ae15441c9bb74a42241c15b4ab6ab6bbd4710b83ba1adb6342bbf304f4bb6498143704842859b34141199c89188cc57fff1ad6d451d58ce509c8a9b

  • /data/data/com.remove.odor/kl.txt

    Filesize

    68B

    MD5

    62cb9ca07760d2dd48c366745f48101c

    SHA1

    7fc635110aed41ad0ea5c2e02c237015aa3b8e48

    SHA256

    8591e93619e30f911b3deaaf759422414e343111db3e87ecdeef72185e4980b1

    SHA512

    a33353a2be55672f5e1b404d7b9ef8290d57353ce036f1a910185f83612dee9cd07b8a74a5c54c3c7b687b773f65dff8fdc94728481d83c3b58d1e4083623503

  • /data/user/0/com.remove.odor/app_enact/QlJleT.json

    Filesize

    450KB

    MD5

    66621deb3d3175450cfaaec87bff6a86

    SHA1

    28edcc9cc0c3651a862f197ec377edaa0685a48f

    SHA256

    753b3baec26ebe4a3b69280bd6b0fc67875063900ccdd97b7c089c1932729a6d

    SHA512

    bc25635fa93933e8a1141a23d0d4136fea5c6ca078b85778a1813fd8ba1693a86bf6d0887b76eaebda4ef88a80a2a0a94e8bee36b96cef3093f4b4df8344760f