Resubmissions

03-05-2024 05:43

240503-gez5tsaf34 10

25-04-2024 22:01

240425-1w9kdaff8z 10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    03-05-2024 05:43

General

  • Target

    87d22ab5648bb020ea373d493488839c9e5440525bb1f2f2075b89ce99ae703d.apk

  • Size

    216KB

  • MD5

    6f73e757b94e3a4854ba11ea99bf840f

  • SHA1

    499fd8b5fbd0793bcc9398933905f4aa330650db

  • SHA256

    87d22ab5648bb020ea373d493488839c9e5440525bb1f2f2075b89ce99ae703d

  • SHA512

    01b8d1d8b098e081b48f68bc229f23bf5cee9e9fc9255d3a91604e1d18ae6cdab298d881f687bfa2cfa952a5b3e673df665a83a86423dc02dd6baf536e8762c8

  • SSDEEP

    3072:DWBLOrDpfHzoXPlkSldHa4TMEmSDaivg73E+IXiKu0RzMwI0/30KnEvNQ2It9:iYfT+l7HayMEY2+mCJ0/EuGM

Malware Config

Extracted

Family

octo

C2

https://filomarinakiraci.top/ZDQyN2NmOGEzOTlk/

https://cannakliyat.top/ZDQyN2NmOGEzOTlk/

https://uzaktasimaatasehir.xyz/ZDQyN2NmOGEzOTlk/

https://kopekuyuztedavicisi.xyz/ZDQyN2NmOGEzOTlk/

https://hayvanyemekveriyoruz.top/ZDQyN2NmOGEzOTlk/

https://topcularaktaricisisedat.shop/ZDQyN2NmOGEzOTlk/

https://evcilkusbesleme.shop/ZDQyN2NmOGEzOTlk/

https://verdilerbizeikiadam.shop/ZDQyN2NmOGEzOTlk/

https://tokaxtliahmetmotorcukuryesi.top/ZDQyN2NmOGEzOTlk/

https://arackiralamacankiri.com/ZDQyN2NmOGEzOTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4410

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    66B

    MD5

    abcb4ac6d2d74fb8803c340238fa5f2d

    SHA1

    3299fe5973a92467640b1689d8588ec04abf84d9

    SHA256

    161454b77155ab38b3bf9438d79fe20b2e4ede20f237ec12aac25944b23fa808

    SHA512

    e4bed562e4de87c0f3e72d0bcd2a60d6756f1bdcc7ba7afad7ba15ad27c60d171ae47be8631e46e8c0700ea85e7e4ad1c93b0750a3a87a0424ceec2df1dab9c6

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    37baadf17a158c74400a6ad79ebdef06

    SHA1

    4eecc87ec986482269850e24f2ae5fb6b07252e9

    SHA256

    fc60243a679878b08c77d3b738193d5e82b121a34eaa1080c22e72c24016abc1

    SHA512

    8b3f733bbe6da50a88544fc38c81b1cfc4c2f38f11bf960758cc567b4df8ea7bdfd99ec9a36010a224506c875770e1fc5c703b13c732d1bc1ac04a8161600df8

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    84B

    MD5

    ff47753868a047b9f59f05109c9b54e5

    SHA1

    a3290d4edd2a2d8830417699abe97ca188236bee

    SHA256

    e693cd6eaaf098eebb67096f9e94662dde83a274bb18de688da7e8e46c47aab8

    SHA512

    16df51efe500b52ff4f5fe74e81a82ede9fdce57b1807654db2dbf905e2a1010b9308d2b90512872da5dab75dff7baa5a42f90f8bb5eef12aacd0dd04e3ce0ad

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    3b5426e8d18b70a24198917670beff28

    SHA1

    a72fa2b24546c423b9236c8462e401a0e2cfd9df

    SHA256

    c1bf6bcbd1a502d39d1022a905b09f464a1576d0ef9eb2ea3801c950103eede3

    SHA512

    7f1b28e78e7b06c4955e2d72be269247b990bb013c7c716050226c4b7ab6cd044815a763ae7cdf807626f412b7cfa5ebd1413169538bf43062007cad2e1a68fe

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    0e1e867dbfd01f4e378f26e44f31788d

    SHA1

    cecc80390cd7626480d95c76192fd20425caa535

    SHA256

    a8551fc88e92822ede8827383c287bbb72b494069b30548eec21e7475a714cfd

    SHA512

    b2a511f74732552289eac9dac302e1c7e57678b4f66e6caa1c79e5978c7bdbcadb27aa6c1c214bcd66257df7775f09b22b7962817f618490f188a8788f5d8956

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    0e66c82634e0d218dcb154b98ef2c8a4

    SHA1

    934bc11ec079a507ee10bd3ed71758b113f7b607

    SHA256

    348632ccaaeb512c76989f06760b89d50de868ad984b1985472e614ced94cf4e

    SHA512

    02c6eda1b7ebf03b76c73e820da1063a1e3dfd1072c7d2b5d63a259eea81c2131b32b1c69ae6b9c717655597e2ccc11255f772059aac2810587b07bbe57c4265

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    68B

    MD5

    76f08aa579ce3c53f8d7fed18ada0bc5

    SHA1

    86feee9056917eff90bf9c3872109ca8698f488a

    SHA256

    d0329e0148a713f6d816c753d3fa2542ff29876799d4d4f20747e56eae02ae0a

    SHA512

    b38815e487319400cddae1e72652cd49f6097c0acbedd28a33ca51760a10bf74ac092f5612ec94d782b75c7e4f3fbff1cfe4a1629cd8b4b576ed00a2314a3a9b

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    ed91504e7f234c5a9bf0a2e4948f0372

    SHA1

    df07181189e099ce431e55383a51d3bcd6953eda

    SHA256

    3c9d6db87e910c36c0050bc6b5b4c4abaafdc71a660f6560245a38595ea8fbea

    SHA512

    241fc4b22725c586897aefd1e31b4386f7b8a8824ca02d9e6ce2916ce6ebfa66e242158a77d8b2b8d0f40f96871c04b631b0062da84a24c231768585e1d3002b

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    466B

    MD5

    ea8461b9b73fb546fc9277c0ffeb8fa3

    SHA1

    19fc1a2cf718a80fdbd67ad6fcf091c2346b2e7d

    SHA256

    8d6ac38659703fd80d0e1e2f38b1c4077c9b1d2fbc5392bf74e21f433adf3a78

    SHA512

    43d92443bc58157d929412bb244472a9bb98c27bdc6143615852e8f63cc86d6707ca2b86e77821a47a4e9ec2d7eeabca011bdb4556b64c995d16bb99943ac178

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    b643cefacb27c46d368428df22f7692d

    SHA1

    8299d65cbb607db34723c7d2135a9aee9b1db070

    SHA256

    c5615d10819a5a5cc8b1bec318cac991ce8a9d3f087d4a9f142e70999ab1776d

    SHA512

    46803ff5ccd2710ae4d66c8c386d433dca21c01792c2f747f131db826fb5c4e63ef0f79a55b2f64dfff47ac076690588e0904fe14882c03cc1ef722ba9b82366

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    906fcab4d523e5461b68aec7942e5534

    SHA1

    df3c2fd182358fe9145858e96750927598c98315

    SHA256

    60a9b4d0be91a46c638ef0cd5bb3ef4fc4abe26cdc120726a05c9336deb7ac7d

    SHA512

    981b249cc037ea449cd25dafa536ff5d3e5599a394ae65f42acc9174cb73b8dd30690eec8a012c6aa5cd43078637c396c0d748cf9e46db21e4ebb61a192bc9b0

  • /data/user/0/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    6d705c5c68fad252fea2cc77176f1e2e

    SHA1

    447fb2abf6c56dc0b284c0667e30971d47870b12

    SHA256

    45934b096b3072181270c432ff3e9c367f34f841c0c3cd42dda993e4d381df14

    SHA512

    6f0e9131d728a3334028bb1f9d38b2b6ace667ff43af77ddd8f43890607899970b7d50fd8bde75d72a7203826e1fd72cc9a013ea39fac711c82348eb896ee892