Analysis

  • max time kernel
    179s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    24-07-2024 22:00

General

  • Target

    dbacc40b602f706c9a8b60eb335c82a3405a4d1addc676901363ecbfeabbf3da.apk

  • Size

    652KB

  • MD5

    b37afccadd21b86fe95fe0639dbc11b8

  • SHA1

    47228f4752481cc20f82402e8ccdb3b5a32b9a69

  • SHA256

    dbacc40b602f706c9a8b60eb335c82a3405a4d1addc676901363ecbfeabbf3da

  • SHA512

    e257bf865bed49be4adc57bb5b6f1b8f4306973a056be0056e467744b121d30727541307648431536f2842d2b5fdce57f5eb779fe69b3e8bb412f66cb5fab62d

  • SSDEEP

    12288:/J/qwiZYY0Dx9UqWH2NN2sK+r1Aqslwh3vnYEuqg0MsNLHgn6eSdWpHxSeD:x/PiZV0DHUqJNN2TKHdDZgGLAjSWpHxl

Malware Config

Extracted

Family

octo

C2

https://kelebekleroyunuq.top/MWUyNjllYjFlMmQ5/

https://stiviyakezopahaxo.xyz/MWUyNjllYjFlMmQ5/

https://erdinclimarketxu.xyz/MWUyNjllYjFlMmQ5/

https://nisvsorupazuxehome.xyz/MWUyNjllYjFlMmQ5/

https://jekirvorsaapumahasxe.xyz/MWUyNjllYjFlMmQ5/

https://lokusnivepasazsuxeko.xyz/MWUyNjllYjFlMmQ5/

https://tisavorakumahozexe.xyz/MWUyNjllYjFlMmQ5/

https://zekurapoymsivuheno.xyz/MWUyNjllYjFlMmQ5/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4977

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    37f20c3c601f1c60d8d2ead755748369

    SHA1

    9acbac40586865b954b2ddaeb84716436ed64b58

    SHA256

    89d0dd322fe3ef4502d19213988bb19d8e256e2137771806b493f9adb5bbd43b

    SHA512

    fc7c243881c37fc0b6729418882e2759ba4c155d063d262c26bc9dd0eb25cdfadafba62423cba3f0a7888eb715f4775b842cc8a18e0672a62b02de02b3c4bd32

  • /data/data/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    e3f01a00f80d99e4ca80193881e1b576

    SHA1

    4b9abf40fb31e45c49f526f3591c78dabddcf16c

    SHA256

    bb5fbfe7ca80ee72025a95b97f832be3544af1f9e3dfabcd74027b8e473380e7

    SHA512

    ca39cecb88e6b234f949f21c593eb17d80c49ba73681f05c23ab2fe8b593b4fb8de423caa74acb0dad82381a3370b29e1abbaa6f007ebaea41741a35e7eb3348

  • /data/data/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    648b7ea2252966a313254221afb2daf2

    SHA1

    9d9a6692ee32a754e6e546e7d8f96cc467923ae0

    SHA256

    ea29b1a54a7c39413c503dd08540f9f1a7aa4dcd74131ff68229723b81802939

    SHA512

    279d70c0221f9ff95ba268b632baa9eb677bb84ed92fe2604a04ad491a0b4ecf6edd6fca575f538f6a7304040cc2ad2c3a5d37db62cb218b79d920c0b77059a1

  • /data/data/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    922beab0588d99a19c4e76c5d5505a9f

    SHA1

    bcd7d52cb2a1dab27a6723187006e95e112be239

    SHA256

    b97eea1a92471f9b4dedc4f6a555fadd9ce521cf4747ecdc21ca9b2172202db2

    SHA512

    4984d7b66a8e6de8ae7e265cc0f34d78fc826325e6e4db520d3bdf0aab7f46186ca34522eb21df944d060076c20da25e9e793c4919e5c093a1e8fb152f655652

  • /data/data/com.nameown12/kl.txt
    Filesize

    423B

    MD5

    d57ef4dc3e9177fff3eddb84516290ab

    SHA1

    e5d289363148ce7bf6f453e6908dddf59c9b95d8

    SHA256

    9d90b7385ab6e18361e234c7500b4e4622d113babdcaa0e74846b919833c680f

    SHA512

    aa3eb55aec024306412d1b192c305970a673c725c451e8b0d25c826bdc6e2cd4598d9e32f7f39f0f9e1d9857ddd15887d3740bf930807aef057dc09f6036734b