Overview

overview

10

Static

static

6

2fd251b032...86.apk

android-9-x86

10

2fd251b032...86.apk

android-13-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    12/04/2025, 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2fd251b032260f3ee0eceb4fd4a6ca792d98e9f6bc0b924e5fae4bf37b23e686.apk

  • Size

    4.0MB

  • MD5

    9284df4b44142e4658b86bc67b6c2dc7

  • SHA1

    9583df8868cfc7668725c3cfa7d69476f8d782a4

  • SHA256

    2fd251b032260f3ee0eceb4fd4a6ca792d98e9f6bc0b924e5fae4bf37b23e686

  • SHA512

    e0eca707bfd251d26a36c210b9712a1e05bbda4183174ad9fa290611e15303972c26447cac5057d9f67cf6623f217b523b63195bd5b599e8802109c9aeee20d5

  • SSDEEP

    98304:8dOdd6jymO38l8AoebZCkvfYsd80HMw05I0ULzmco/4kSWqn2zWqnJcqN:Ld6jAvAxZy0WIjo/4DYl

Score
10/10
octobankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://hizliveguvenilirshopbutik.com/MzMxNzE5MjExY2Q3/

https://pre234232iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://pre242252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://pre221252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://3413pre2343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://532343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://63343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/
rc4.plain

Extracted

Family

octo

C2

https://hizliveguvenilirshopbutik.com/MzMxNzE5MjExY2Q3/

https://pre234232iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://pre242252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://pre221252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://3413pre2343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://532343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://63343252iumserviceds.xyz/MzMxNzE5MjExY2Q3/

https://3345veguvenilirshopbutik.com/MzMxNzE5MjExY2Q3/

https://hizliveguvenilirs355334ik.com/MzMxNzE5MjExY2Q3/

https://hizliveguv35354334pbutik.com/MzMxNzE5MjExY2Q3/
Attributes
  • target_apps

    at.spardat.bcrmobile

    com.google.android.apps.messaging

    com.android.mms

    com.samsung.android.messaging

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Requests modifying system settings. 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.formgrowyhst
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4343
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.formgrowyhst/app_cement/Yl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.formgrowyhst/app_cement/oat/x86/Yl.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4368

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.formgrowyhst/.qcom.formgrowyhst
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.formgrowyhst/app_cement/Yl.json
    Filesize

    1.0MB

    MD5

    4bff21c4d3bc47896412344d66011549

    SHA1

    78b3e8ff517d9ffe5e000ac390d5e2faa62dd196

    SHA256

    d7c450a8ab4e88b718903b20423bd899b0f371c80e48093a4b22632df2b57f45

    SHA512

    bd15f5a3ccaec1e23d8f1e186e7a3ee9d5fe51cc7235fcfd89a78f1a73af626cbbcc23e75d8f97f2fdeef86c2d2021a9f0cd523dfa677f5f22f4c6c9b9081e34

    Download Submit

  • /data/data/com.formgrowyhst/app_cement/Yl.json
    Filesize

    1.0MB

    MD5

    9ccaab69660bd42a5cbd0f3e04d218aa

    SHA1

    b9888c1630531c13227154010380fce3ae36b5d8

    SHA256

    b1d633535f5e4d89f702c63643af8d75d3e7ebb7b75aad863f4994c2d8283b4c

    SHA512

    43a9a3a6a7a020c473e841c42c0d352962b2fb5c47a52364ce0d7990f7f1bb897eb817069d1fe0d4152f53f3076bbaf70a3cfc71849bece3bb7454ad28f64f6b

    Download Submit

  • /data/data/com.formgrowyhst/cache/fblbpgwjuavcjdc
    Filesize

    977KB

    MD5

    977c589f339a9059d7ccb24353e335cc

    SHA1

    7cb293eb9d3b8a3cb1aa0c39df1e06802d39f507

    SHA256

    068509a91a70d4368b956e3071e55a81bc02c691ecc9496a37d2728bd6d7606b

    SHA512

    f5f79c6e9c6dea8a2599c87380e5e6e000f6bc1fea0f20ecdd5289954fc45dca6979df608f617fb561a571384a333e82bccb1dc8f19f4936c5418e2876a06865

    Download Submit

  • /data/data/com.formgrowyhst/cache/oat/fblbpgwjuavcjdc.cur.prof
    Filesize

    480B

    MD5

    d222300db7393f0f6983b84c04524939

    SHA1

    bd91169dd7741753c8428376ad7b1776e1341f0c

    SHA256

    4e40aecb646f103644972b38173c09a7cdfd17bfb3c07ce5843830c01087ee1a

    SHA512

    9862e49fee4d0494b99c6dac4f3a29ff47f62b79d4cb9905dfd28f7ad6596e9a45a44cb20b8af545269507ab23481b67380b3e9bf651170b5c678c4bec14d9f6

    Download Submit

  • /data/data/com.formgrowyhst/kl.txt
    Filesize

    237B

    MD5

    407cd5d2f940cdcb9ba852c092cfeaa8

    SHA1

    8cb7ab68f2ede303e532b57738a7f416d0348d32

    SHA256

    9a2b33c56aceed34b84c5a7b7a15ee00b11ce155eb32d02d8e2eed088428dbe9

    SHA512

    8a0bf2232cfbedcfa4f6f38494dbccb319046c526236e7b9361d548c643738a68cd65807cf4421ca20bac869288d164afdb56cea62e9e995fe31bd792dfaed6e

    Download Submit

  • /data/data/com.formgrowyhst/kl.txt
    Filesize

    54B

    MD5

    9613e00e697a6e7e71fe7d536a77d109

    SHA1

    84ba7ec44b8a96f880fde46b86e05558dd340839

    SHA256

    0c525f16f0dbffd0f0faefca82d5dce68f4083ac9196f182f2ea79b77d544108

    SHA512

    505dbf33bc9bc563ff96ed6837d7a19e6052353dfcd1ccd195197998942c6b698467cfd8ab856b9ce416846796ee712c1b93a8114d2ab1a6c9c8d717226af75e

    Download Submit

  • /data/data/com.formgrowyhst/kl.txt
    Filesize

    63B

    MD5

    59fcbfad5a69c2e5fc59a091eeb5e689

    SHA1

    ca4b8f0798faaef15ab6d17a5a4d237e60dcabad

    SHA256

    dc780060e7badc758ca82b914f45f135cc811506e8d4417fb87fd87b92be4e44

    SHA512

    c66ca164c067722549e693b3e1e7bfb7f34a734beb3fee220eb06092859f40441ea1c3e31e7eff676ff3486365b797a6cc8e80761c5cabd293dff84b0c233dda

    Download Submit

  • /data/data/com.formgrowyhst/kl.txt
    Filesize

    45B

    MD5

    b44787ef9015eab5f995eacb3d7d5dd8

    SHA1

    82504dfc7f821f03f9737f29ac84d3fe35610521

    SHA256

    40624e31a777f1a04cc7fb193ffde384ccae2f2fa6f0c59334a10a1d2b69a126

    SHA512

    5a0e2a874e9cefa19f4d73a2f2bcd8d2ed8e00f0420f59f3e7fb86d070492c2801950dc35a30a36a726ff5de9ce51884ef599e25cd5d5ab30d6da8203f94c984

    Download Submit

  • /data/data/com.formgrowyhst/kl.txt
    Filesize

    437B

    MD5

    0bf73ce67150a5419bbb6bcd2533135c

    SHA1

    4901602b93f400caa91e58621e16a319b74608df

    SHA256

    c1d54975dce17e049db64c4d8603edb3cbaa8f9f631b3003b65aff5f0027ca26

    SHA512

    0e0118573552e063bf0c1730f7808610fdd415c3d94589d248dc6f6a51082ef178dffdaee6fd1033aff50d36d28e76eb95266118cbf0b08340936c905980357a

    Download Submit

  • /data/user/0/com.formgrowyhst/app_cement/Yl.json
    Filesize

    3.0MB

    MD5

    5bd9434ba769931b2025a9c97576ba25

    SHA1

    53da560af7dfaf41494bec8dae058232988251d6

    SHA256

    77ccc833b164b3aa26794cc319bad49ce52222ee6153adb67a8f48418fcb513a

    SHA512

    056b123c99b14a9ccea4a869f3d75fe9fd81c4d5a29bdf27c973a9f3aac10498bfe96de84307083e30d7afbbc2bcc271658de02a3fcb25fbf6672663c61c6a95

    Download Submit

  • /data/user/0/com.formgrowyhst/app_cement/Yl.json
    Filesize

    3.0MB

    MD5

    6a37153ecb3827ad7d6b218664cf3fe2

    SHA1

    74d07ce63973f0f5fc9210860319d4a6c77367b3

    SHA256

    7fd217c2ae6c6d9ced1e8c09d148ede5aff65b049cf899f0eb5c834cb7ffbfa2

    SHA512

    ddd50f2594f644bbb6b896c67e577f5afb7ad86f7c778de175cdd69fa8f7ffc9200c82eba70241f48243b0aa3057fca3a47e6a616c603a6ecb9c608b92fba82f

    Download Submit