Resubmissions

03-05-2024 05:43

240503-gev6wage6w 10

25-04-2024 22:01

240425-1xjqcafg2v 10

Analysis

  • max time kernel
    152s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03-05-2024 05:43

General

  • Target

    bc8605574b1239942141235ab7f5e6c98e5744ca0e4e05797792c03b96fbb2dc.apk

  • Size

    216KB

  • MD5

    664262ec087d9324c802832c8d111259

  • SHA1

    8bdfb1f91c01ba14d0b8dc19067ab2631f480ff1

  • SHA256

    bc8605574b1239942141235ab7f5e6c98e5744ca0e4e05797792c03b96fbb2dc

  • SHA512

    eeff74f7a40f658c99c4190eb38ed47c4d91d2557ac8e6523d2a23a8ecbaff054a7c16d269765dd8ce4a1dd7738f65274880ec0f87c3ea5ea8cb3c554731c799

  • SSDEEP

    3072:lWBLOrpjfHzoXPlkSldHa4TMEmSDaivg73E+IXiKu0RzMqI0/30KnEvNrdD8C:o8fT+l7HayMEY2+mCj0/EuGF

Malware Config

Extracted

Family

octo

C2

https://filomarinakiraci.top/ZDQyN2NmOGEzOTlk/

https://cannakliyat.top/ZDQyN2NmOGEzOTlk/

https://uzaktasimaatasehir.xyz/ZDQyN2NmOGEzOTlk/

https://kopekuyuztedavicisi.xyz/ZDQyN2NmOGEzOTlk/

https://hayvanyemekveriyoruz.top/ZDQyN2NmOGEzOTlk/

https://topcularaktaricisisedat.shop/ZDQyN2NmOGEzOTlk/

https://evcilkusbesleme.shop/ZDQyN2NmOGEzOTlk/

https://verdilerbizeikiadam.shop/ZDQyN2NmOGEzOTlk/

https://tokaxtliahmetmotorcukuryesi.top/ZDQyN2NmOGEzOTlk/

https://arackiralamacankiri.com/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4683

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    0d8b29eb07b75ef2eb43cc81e4e03d28

    SHA1

    dc6284d6433a35525b377140451739aef220f5d9

    SHA256

    917be2ab3925ae54a273580e40522fb4d3e5f78c1b3e8292f74121edfd843ea5

    SHA512

    d87afda6c017e671ae38a1a94a94d0412e7bd4802d6092d49a56f93cdabdd30aad659e8884f8a4290960499b4680b3b61d67c95f3f16bbbd2110665642b1b6e2

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    66B

    MD5

    986dad9ae370ad8c2866b8251f52c807

    SHA1

    c0abedefb6c2dda7b09336a9fe6277e2aa0a6b0b

    SHA256

    edf3fa664309ddbd4a3f12341ae2603783857e15f1024e38c0eb7e9e672dc0d6

    SHA512

    6be46d75e2662f50f0a1fca5a66229959a08d3744f193f997dcf2e5b983a10d2b181cbb1783a3229d11947e9e14afaaa45fd3f20ccd13cfde3eec5219a3c872d

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    84B

    MD5

    642ec80e299ccb1d43819257bba81327

    SHA1

    1ab7d085adc0fbea8fbbb486df01e370379dccff

    SHA256

    61ef5950f2b212c34f0809b47dd57d62cd87058e9c23def471998671cdc713aa

    SHA512

    276fa998627d067e7724dfd7523230aa01c992a9172d147d16ed8c9ea67d9cf4cb8d7935729fbefe1024cd0875f64b7b6d473a284858e0ca53c3380f4412ba02

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    a2ffba42d86f339bfcf06919e94ca0ba

    SHA1

    64b0c21b0274bc506c9447259a033a0affbe102f

    SHA256

    4431cd0657be62496cfb6a906aa803325a878bebc81fb332c43f0ee40774eff8

    SHA512

    9a252d4b5fd02f5ecd05c9cbcf6cb106cf9ec12583983f34b5725eabf1503b7cacb02949d1971848b432318c23fbe8ea972584fe551d7b7b705053e70a2d6ff1

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    58B

    MD5

    18128070a6b817ca83396f980f232711

    SHA1

    ea4f0f618f63de68d1c3c2ac3e8bfb4834703e0b

    SHA256

    ce6eb0afe78a448173f0edc666c7f9901c13bd1e8a6f751f3524056e8b284b81

    SHA512

    5ef07cc24e938bbeb38181785ca5e087015948dcda17f8b9f695163526d90c4c166dc5d0044322be4785d505cfb3b7d8cf14908ebf474b3649aa417493498b43

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    cebf83e052b6b52f16b2f88c97145beb

    SHA1

    db46b2c6e8b394cdd2d3d6d22e8dbb394fe9c0d9

    SHA256

    feb918d34f6e5101e36cb3bee7f54d6b51dbfce32d4a23355314a97367e41f82

    SHA512

    7f43a85b2b6647101649520b17fdd9d2537e4e69cdb31df84ef257cffe9d2984a41ef0836bed150b047b45fc5bff3b4815a34b27c6fc6f8e9f30d7d9ca909e44

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    ad4f4528a01396b6f2fefba3ec05ecb7

    SHA1

    795c05302acbe187d7a77907060be59564bf1bc6

    SHA256

    e873e0cd9f63d8adbf6e1e80fd95e9f4640942b0988b051d14a279115ffdbf4f

    SHA512

    afd66e9b6ae1a606042cb986c3f38ec7208294b590f728369d6b856ffbbddd5dee6e9c582f95c3e5c84aca4a711b16924a61f3f0545ee942c914e643e46adcbd

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    7f88c7968137c3f821bee1e991781009

    SHA1

    4071c7a61c71d1fb800ebb04607905042f8cffbf

    SHA256

    4c1e1ce9002c319a82283e9f4eedf35487eb9caec9921dadcefa5bfeff577600

    SHA512

    1901eb462e3f4fbc5cc46fb43a0d2f5dd25cda9557a26fa8335810b53e978c20164d5054d11c9aee9be39ad61de9eddb103d910d1262ec2029c902dff75b494a

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    d27fac66c6d9ac28851d4dc5243057e0

    SHA1

    b7c650d2daf89d6de02b28f1c1a77e0c768fa5d9

    SHA256

    dac7c5b3940518290830943417949a5d17abd62383ae15cab0a670e0971374e5

    SHA512

    71406f9686bb75bd6b9bcb6432d14788f59eef0060f44c4c5a407267a6f83fb33a49b9333867c47ac98032871ca5fe8db8081e4314ca17b3ceb9b6b66fe6461a

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    9590c3a66a8a46d2c466dcb4b39e25c9

    SHA1

    432d91f3f118af49aab3ad81100a38c844447ee2

    SHA256

    d000bdf8707a33264eb30fd2f32df1f86241f7e3f348c6cdd2d8adb7ac80a4f1

    SHA512

    c7d2e82d764d5d3a4c8ac680c0cf55c22d9a35a93ee8fcdc458f89bc37d55412729d937fda96ff3bf0c0adb7bddb252220ad20e69932bae38f444cc7f2f4c8bf

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    466B

    MD5

    5e73467c4924c913d633595a1c86722d

    SHA1

    5fd745b5d533afb960cbc2f5c371d6eb1b53fb2f

    SHA256

    616adf8a96f8fc3b18abea778ecb606002c458be6136a5a61d266a878d7bc035

    SHA512

    75f788cc9a3e5d6c2cd8c720177c45abf4d9a50ca562642aa79a413ca25ba44f2b51ffc7092e114a44c535cf8c8f8f05d3416f7f1de7cd7ae9db9a001528e928

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    6f0d652439fa6ae10bd8f60f6c4838ef

    SHA1

    169894c5ec24bc952958ac446f71b84b8b6a240c

    SHA256

    25443200e2d4f8e8edb34c1b38c48c285c4d8dff247d5651d113a245254be072

    SHA512

    a24eaa72ad1546b208376975e6129024288c3dd3bd5600e54a76153d6cf6ec23b98e8b6dbde3baa182b2a6f1611db90fecee589ce10eb10bfc9a8333a6009866

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    58B

    MD5

    b1d8c9e5bad2d575e2c7d64f74136b14

    SHA1

    af51a63586ae3faf4221d8593fb9fbaed0ff3908

    SHA256

    ab3ed2ae7f4a7dbcef4967e2a44b9f41ab158c66a72bcd8c74d680595ebd022b

    SHA512

    346d3830f42acadba77cb0dd6c0b89376490dbfa95552fbeb7e1318adfa1ff5c156da5a48bd9ab87580de1f4abe717d5728b1d4846a22d413bd9c3810a6fcac3