Overview

overview

10

Static

static

6

dbacc40b60...da.apk

android-9-x86

10

dbacc40b60...da.apk

android-10-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    142s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    24-07-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dbacc40b602f706c9a8b60eb335c82a3405a4d1addc676901363ecbfeabbf3da.apk

  • Size

    652KB

  • MD5

    b37afccadd21b86fe95fe0639dbc11b8

  • SHA1

    47228f4752481cc20f82402e8ccdb3b5a32b9a69

  • SHA256

    dbacc40b602f706c9a8b60eb335c82a3405a4d1addc676901363ecbfeabbf3da

  • SHA512

    e257bf865bed49be4adc57bb5b6f1b8f4306973a056be0056e467744b121d30727541307648431536f2842d2b5fdce57f5eb779fe69b3e8bb412f66cb5fab62d

  • SSDEEP

    12288:/J/qwiZYY0Dx9UqWH2NN2sK+r1Aqslwh3vnYEuqg0MsNLHgn6eSdWpHxSeD:x/PiZV0DHUqJNN2TKHdDZgGLAjSWpHxl

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://kelebekleroyunuq.top/MWUyNjllYjFlMmQ5/

https://stiviyakezopahaxo.xyz/MWUyNjllYjFlMmQ5/

https://erdinclimarketxu.xyz/MWUyNjllYjFlMmQ5/

https://nisvsorupazuxehome.xyz/MWUyNjllYjFlMmQ5/

https://jekirvorsaapumahasxe.xyz/MWUyNjllYjFlMmQ5/

https://lokusnivepasazsuxeko.xyz/MWUyNjllYjFlMmQ5/

https://tisavorakumahozexe.xyz/MWUyNjllYjFlMmQ5/

https://zekurapoymsivuheno.xyz/MWUyNjllYjFlMmQ5/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.nameown12
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4233

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

4
T1422

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    16c6714d7565090dea7e4c70eda6877b

    SHA1

    24d5f27b5440ba38f09a19ac987a75188fe02005

    SHA256

    31379bbc3b95f151c9a533191d26d23f1ce0b9efaff13a7e447b188024c736be

    SHA512

    c3e81c02643733622eececadcafe055a25fd8d3c2461cccdafde98a07dd9601c76fdc11c3147c734c308933cf5a71cec02ed3b48d5175a2347b1dbe3496a37a8

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    648b7ea2252966a313254221afb2daf2

    SHA1

    9d9a6692ee32a754e6e546e7d8f96cc467923ae0

    SHA256

    ea29b1a54a7c39413c503dd08540f9f1a7aa4dcd74131ff68229723b81802939

    SHA512

    279d70c0221f9ff95ba268b632baa9eb677bb84ed92fe2604a04ad491a0b4ecf6edd6fca575f538f6a7304040cc2ad2c3a5d37db62cb218b79d920c0b77059a1

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    79B

    MD5

    2e734fa8f76109cc30811f70ef27ee87

    SHA1

    2e20bcc545b714dd1de79ebad692ac7acc70ce80

    SHA256

    4266320157090d3ef320860bf1c62336065601fa5a45e716beb16a6b9b9ef5fd

    SHA512

    7fe1888b62d808f7ffe6260c95c6eaec6c68b07f9879b365e2bc898fa45e5d6ea39c34682ad78e005597a04fea602ed71de56be1641667f9732b533411271f24

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    2176e0a0353fdc6d6acf6858082c763e

    SHA1

    8363ba57a192fdbe07d4827a50a992a72a597323

    SHA256

    92d775e623b3f74c5ff7c78eb2d88af89f4eacc9b674aa570a09a928c1a152f4

    SHA512

    7fde9802f480b2612e66f3f6d0880cbf24d80c9369790305550fd1c4e8132e49aa2b90332a4d579b4da708c89884d84be5790a9bcd27612d51215ed2ff691ee7

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    423B

    MD5

    f6d4e0ac4cdc49483889a3b158a2433b

    SHA1

    fe23ed02e288ebab01b85b085589e1624c2c64e9

    SHA256

    0479679eca3a55c06a568d227d339e8accaaaaf3ba938206d3831d64e4de2564

    SHA512

    22a88442c81b25afc3833d5b99a782474957cbee0e20d6f54fec9623df5f5beec647b29edc6cd94d7f1fc7e25e0c9f62bde6ea1f28bd8de8b6a87cdfbbe71985

    Download Submit