Resubmissions

03-05-2024 05:43

240503-gesezsge6t 10

25-04-2024 22:02

240425-1xvslsfg43 10

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03-05-2024 05:43

General

  • Target

    3cae3d38b64f8dc78310c0ea6b6382711e7c90abe5f948929a7f335693eef8ce.apk

  • Size

    216KB

  • MD5

    ddac0c6ec81bf13e97186753dceddfef

  • SHA1

    8b47077cadf90359050ca989c63716d4467749fb

  • SHA256

    3cae3d38b64f8dc78310c0ea6b6382711e7c90abe5f948929a7f335693eef8ce

  • SHA512

    fdf938b3049b8c8650af2a110feff7835720ed6e9b0a62acb424d66d6fc2c17dbc97b3afd770ffdb96b4389f891838c81c395fce9abb86413ab3a6a62a552d58

  • SSDEEP

    3072:KWBLOrkAfHzoXPlkSldHa4TMEmSDaivg73E+IXiKu0RzMqI0/30KnEvN8l0sRb:NcfT+l7HayMEY2+mCj0/EuGK

Malware Config

Extracted

Family

octo

C2

https://filomarinakiraci.top/ZDQyN2NmOGEzOTlk/

https://cannakliyat.top/ZDQyN2NmOGEzOTlk/

https://uzaktasimaatasehir.xyz/ZDQyN2NmOGEzOTlk/

https://kopekuyuztedavicisi.xyz/ZDQyN2NmOGEzOTlk/

https://hayvanyemekveriyoruz.top/ZDQyN2NmOGEzOTlk/

https://topcularaktaricisisedat.shop/ZDQyN2NmOGEzOTlk/

https://evcilkusbesleme.shop/ZDQyN2NmOGEzOTlk/

https://verdilerbizeikiadam.shop/ZDQyN2NmOGEzOTlk/

https://tokaxtliahmetmotorcukuryesi.top/ZDQyN2NmOGEzOTlk/

https://arackiralamacankiri.com/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4570

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    b2c0e7875b74cb540dc69995c048001f

    SHA1

    6a19783e73c7ef14462bb984455841a158cd47ae

    SHA256

    ae98f38625a78e5bd7239105ccc38ebff168cfb767cf39059655ede7491d34fc

    SHA512

    a7722b4aa0671f2f3940a6cc4865d84e32363b6191787f95245a41b391cde02610940a787cbd9ac6fd417fcc67849166bd9e740b87c788a6d34a3ff5b806c0cf

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    d24d02e5457d02e3975bc360d5805186

    SHA1

    1e99392d16140f175ad223311c26b5aa85872012

    SHA256

    9bd37ea647da8f8fc9598519cfc90453dca10fec7adafdc8f0eae88a4e2b2c9a

    SHA512

    28e0a96e934b15ce616049969c6f64361e7a4f6f1c2eb364e0a1e72b1d4b44f16f574884496e15d84e77dd0f85a78ace35a28e21027d88d5b7b9b2e86deef829

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    84B

    MD5

    6468120045adf36109fc2692218675d5

    SHA1

    0441034fca00226ac307e587f24690e4618d5fe8

    SHA256

    c7bf83f2c26238c7009cf7513c898048fae009a246a2a9a6e1514beb3ee917be

    SHA512

    65be9c5980e4564ca987c2e597f95abd10eb465e5ebf385ba19136070a70e703570dc85a063f39a1ff197f201fe04f4b83ed1f0d3bc914e796488be723b666d4

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    a262c6bda470f20a0c9aef59c914f33d

    SHA1

    fe8d7a15de9bf9d1dbebb70d0735b4a006e394c8

    SHA256

    9bfa642f46dfb34f6ba43679f9f70c1e2adad20d9cd5e99c8db9f5aefbb7fd95

    SHA512

    6a1e70b9b552d8871e8d724191a79f96a06a3ef835d8426be2aba825872f7b990377dc7d67fe9a98fd800d5770d961c425e2028b5973cfb61e966649d7586aa3

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    58B

    MD5

    2790eba1a422aec09c1ce7cf41880fdf

    SHA1

    c94661125f9a5fa27ec6d4ff184398e6494f6fcd

    SHA256

    275bf1f70f19f5fef7a579e60a9ec0c7ef19c23c9cbd87fd5e7c27a9ea657958

    SHA512

    6a50aba912ec38bec28586d26307a86897d8368fc3773231abaf6a97b40424a03ed03b390ce7d683391bcbe659f503079ba5aaf5596b8343cadc0d590ba12c0d

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    9f923a192064816704a607b1f5fe878e

    SHA1

    508a628be20c9c49afae7e10215f86be45829fa8

    SHA256

    b136d5d67dd6307f27d054c078c0f4a61b376c9196846e2e49c83fbee70e04c4

    SHA512

    c69e1dc71efa45568c257e9e5963535cba9c2dcede05811a1093336e1ea672101177faec56e7245ba232b989ee194c26728ac90699f69676b204cbf66cc42ea9

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    195c2d4f1b2007a36b88036f81040563

    SHA1

    a4b107359d2b81a9e88a8872f37b35a3cb67033f

    SHA256

    a48c5da319e84dec9db70030bce1bed708b307e4ee23f3c586b214cde02cdead

    SHA512

    d286311b5132222790eaf9a8c332c447b5989c0e58223bf5f2d32f02102e61dfd940ef48a40ee4421029fb9c4a0c10e311c3ee8782588cf8124df22892224393

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    4779ff06e33eef2a76e9db80a18a1dae

    SHA1

    b67c3e491879e54fae1f2e31f9731b2aaa6403b1

    SHA256

    796b60fb2ab8d5b04ae08bea01233c1e38156990d1e84ff75f7425a2e87be701

    SHA512

    b88a5595c2c7bfe77362eb3af27baa5c8b0bebd13e2797224688355abfd1371d7c66d6763a6b2df97047f78c7d84f79e50aa23834b132f642713b615db1136c0

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    939a1d89f11eae20a2b523bf0094310c

    SHA1

    184a26d2a6ca6791b99068862795cd15077cbebf

    SHA256

    e7435dd68f57b8c911bd6b08180e2261c2009cb544f8002ec1c43ad88aa4c223

    SHA512

    56cd9c20aa026990b5130abe33306fb27705381eab89b519a746b958de6871ae08c5a86e4e9e4abc481568f54a4ad40c02dc9ec46ef0bab5661045bb673cc9c5

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    509f38f4e705a6815ea105231c4c513e

    SHA1

    5f4a9793d21e8786407250ea5d398812efd5adb6

    SHA256

    ec93544e4debe7126feb0187f3ff46e3efb95be42a906b35ab7be33489b22c7b

    SHA512

    db3d040f06160d5d44a7c5700032601aa3b24d08e414e27d06c5371512b2f478aee3628b914468c5c5529e74c56ad77a1280031b7b767ef8e4d7d16ad8e900c0

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    466B

    MD5

    524f3a4196063120c996b6eb87623f19

    SHA1

    6da0f8771454bd48d3c9ff2374c102cd0851747c

    SHA256

    0da6aaed1f6fd266a07cc9d1fa0756403bcd0a5a7729c74a0c8a2105505ad52d

    SHA512

    ed0214a8ae9de74cc35c90af0d0a82486b88d57145657912d22a5458bfee6a59aa56650d052a79ad5fd3d88338b9bd422f9e9e417ca5473824b0b0e3eb3ec411

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    c5d2ec18be571fd58c09ce8e1daf288c

    SHA1

    d656885af3f637bdc500701f33b65013a02cea4d

    SHA256

    8d25a23388bc98418fcd16c6f825d6e3d43706adb8bf9c4524c7ae3d402a5e62

    SHA512

    83d027d669eea8dadeba012d905329ac422c8bfe8f41a70b0f3c8fb47f1ae01b3f01aa8bc4ba4e6e5ad3c68a5d05bc6153de1ce579101d8db13af62f0c7319b4

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    394ecf0b972b9006b72d243be9020e5a

    SHA1

    6d31a1964c9635059c4c8e129e0db09d8d37e2ed

    SHA256

    d176a586c444ef0d0c58fbe2080428e3fe96b11ba22b231e5555d23e9412b48f

    SHA512

    0275476e5d56157ad1ae7c6f24b806409289e5ee7aff06e25f8d6ccbf4294ae5524fddc419136afda7b6a8c1be48fdec78b47fa413c77f94b3eb886aa9aaefdb

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    c564433df7c205df706a5d78fde98a2f

    SHA1

    0f6acb90246c0d7f8e680ecb7f05996ba4493428

    SHA256

    b4ced511f554b0647d4f158c2ac87d69369a216117ebdc1175f6322c05f0a6dd

    SHA512

    d721035a0b09220e9233f32caa797ad6ef2654adc7168be5aef1675b9ddb7ffc313e92f3915ca3469d7945b7a76e58e2c762a2865536cd7bd362bfac373eb2fb