Resubmissions

03-05-2024 05:43

240503-ge2cwsaf37 10

25-04-2024 22:01

240425-1xagnsff9s 10

Analysis

  • max time kernel
    159s
  • max time network
    167s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03-05-2024 05:43

General

  • Target

    7fe4034acdba4834704d57533f82c13115ff452b85158be5ca94243db9eba61d.apk

  • Size

    216KB

  • MD5

    fccacfec5d0b394c824edc2b04b99548

  • SHA1

    44c0419c30286492b59bb84f0256d6c66f0e8824

  • SHA256

    7fe4034acdba4834704d57533f82c13115ff452b85158be5ca94243db9eba61d

  • SHA512

    46742b540a84e0c1c71d52c9a10bcbad20d518e855604a447e7ab16c27e3965ffd266ba02a7294cd3b18fd3be03cf3ac22b77fa6df4fb0cf0a82a07f99111d10

  • SSDEEP

    3072:mWBLOrAsfHzoXPlkSldHa4TMEmSDaivg73E+IXiKu0RzMqI0/30KnEvNtwulav:5kfT+l7HayMEY2+mCj0/EuG6p

Malware Config

Extracted

Family

octo

C2

https://filomarinakiraci.top/ZDQyN2NmOGEzOTlk/

https://cannakliyat.top/ZDQyN2NmOGEzOTlk/

https://uzaktasimaatasehir.xyz/ZDQyN2NmOGEzOTlk/

https://kopekuyuztedavicisi.xyz/ZDQyN2NmOGEzOTlk/

https://hayvanyemekveriyoruz.top/ZDQyN2NmOGEzOTlk/

https://topcularaktaricisisedat.shop/ZDQyN2NmOGEzOTlk/

https://evcilkusbesleme.shop/ZDQyN2NmOGEzOTlk/

https://verdilerbizeikiadam.shop/ZDQyN2NmOGEzOTlk/

https://tokaxtliahmetmotorcukuryesi.top/ZDQyN2NmOGEzOTlk/

https://arackiralamacankiri.com/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    f4e84061f520c9fed197ae4c9129f2cb

    SHA1

    41ebd2e88cccfb13307abe1eca868f3e15701ca7

    SHA256

    5c969e088091c42ef4f87b2f028ffc3d06a633d450d0028a65290a604289e171

    SHA512

    514e78f92f8c26e154a70ba6f1db84f7ae3212d55a8a4bac52952c153856c67f83d1901b38c48b505e2ab5fa735a94a8b5de09b040fb9594187c71dd6a0f5ca5

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    84B

    MD5

    085eac3c66a5044a60ac0af4d20ec083

    SHA1

    d079365b703e304813713e6f5dbcea48758ee6a3

    SHA256

    77aef3262b5a4eb6ae4bb001664606ceb9f63851e4870fcd9059f1dbc2f81b7d

    SHA512

    e674cb9401d6c9452b17abffb87c54650ec69b2aec5e7cf4606e2b055a4b369b2d8af64d1f6122d6bdc8aa6c65c97b81da37e7eb4fffbc439a82708f7fcadaf2

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    68a8e17658a53cc15707114f4f052597

    SHA1

    5a7946c579696e13795ec74e4fe0d62544a15f78

    SHA256

    dc7cdd1a340deb4f441ae443af970ec2d3453af15eca1c995465c94316dcc74e

    SHA512

    0b897dee997f693f3877082efb64e65034c1f0f1cddb74be2a16c63c7582158666a475789da789d990d7d3f5bbd4a7b277f08836d27110e2bd68787fe45859f7

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    6d9b049d0596275251406459e2d21813

    SHA1

    8e9012742466f735d26b86e1a420f59860175974

    SHA256

    88e82391ac2fa6038e1aec2a6034eb03acdae352a072e96f3fe36e5ec47d8751

    SHA512

    64853f14a9ec8e46b779fffe3bbee03764c08307370f74e17fdb3f615661b0233e867f9c47afeaf9d635b2bc6027cc432a5a355a063ab72baf5ece9c7c1ca746

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    ca50e9ebe6c5afc0b301045544d2c1b4

    SHA1

    df26d451c7442c1e6373147f477977d034a9966e

    SHA256

    c31c1968d4e271a470f71d953d6023a139e0c9d9cc4b1d45a926519e4a44482f

    SHA512

    664e257832968fef21f2077ce04658f62c853da82aa0416ab13edfb5ecb83a1653af26af0211713831dba84a0a03bb2fea909e69b247b8281e2cfa74d7435b1e

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    26539a98171299bbd6bae7d77cbdce50

    SHA1

    7ebc6046f7eca24eb0b3f8c18dccf5d622e65236

    SHA256

    ffa06e86580982ae91fac51043e93287e3be52eeb22b260fff42ee8068f92ebe

    SHA512

    8c50285365c2e19f8cba6d3f471a8a3130331c161090af46f450c1ac18d0af73d6b1a896ba778c077d18c8dfbe2e84e86d2f8d3cd9cc20cd4508abcfdd6fbf8a

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    3cf272d4b6212dd28ef7731fceec00ae

    SHA1

    bf0eef886dd59a58213492df95ff589ee76fb2a4

    SHA256

    ef051301639561a5ca52b1d75c670e888d9174627182de6f7e4f619d0ee26d0d

    SHA512

    1d0dd07f5e56f2395067c1c746a07c5aa2351d22bac21667ecb89105417277fcdb18a6f9011aadcf2b8c1bd5a087bb7d303a0e3aa706adcc786aff2632876dd1

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    466B

    MD5

    edf65ba91169431d67a74474c7e7498f

    SHA1

    a6105930e24a0df6a1dd738137ebe8c81b1e1cb0

    SHA256

    dbbe9f3a81867d38188d78f44fcf5d2ca3ec8ebbffb01b90db6fb7b5891bcf1c

    SHA512

    6cac072fbd884401c4fc9d6b266d43518ddfcab9f4524203976a5c199a089a1e2651d06866f9e568a3e265e39ba12dcd14f3f7c5fe8a12e4020a5c7ba8fbfab4

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    15eaa4432a1e01608964acaff5aac587

    SHA1

    6e2468f9857f493aece91f4489b6708c15f76748

    SHA256

    909603cf5f470597d4fd3aec773b4e2026fe3a339741cdc2ec05455c6480ca4f

    SHA512

    205d05e4163d35c5e43ef178382d82cf81b770aed6266026f094e260343d46dba0d5686397d9510c555a357f9cc2f5e83d9a3c2493646b96ba6e2d8b217deff6

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    bfc37af19cff146ff052c6a71a8cc897

    SHA1

    c3657f58a698035a582f316e30b9e400db8dc32c

    SHA256

    b421e61d458fc84265292253b6160b735f4613b091b0696e22de7cd385a01000

    SHA512

    8c3912b6f999a89c12cb2bc8fba79db6f1c37db191c811b1d75f58f7b80a117fea4f91646554b7c771f88dddf19ba2bd18997f4a69372fef5f9b5267978b7f7a