Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    05-10-2024 22:02

General

  • Target

    124cb0a052386723bac278fe8e9bdbf1d0400f17b9d2ff96633cb6587a9b80bb.apk

  • Size

    2.7MB

  • MD5

    9af579cbac4228087d8788e9ee3ccfcd

  • SHA1

    48d97a74924d82517e35088ae8a8dcc3336fcff6

  • SHA256

    124cb0a052386723bac278fe8e9bdbf1d0400f17b9d2ff96633cb6587a9b80bb

  • SHA512

    546b5ed51893a810355730c22332dc0cb6bfa824585a4a965464792f019a819122bd80ab42b004bf637f50680c3de01f6e91a25deb73385a0d1ff632e665a06e

  • SSDEEP

    49152:7wg6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQo:7ZFjEI4iZaUzYH99yIR

Malware Config

Extracted

Family

octo

C2

https://31.13.224.141:7117/gate/

https://31.13.224.141:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://31.13.224.141:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5068

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    5202266c6bb9aa36116564207dbac8fe

    SHA1

    fbdf0c275fdd5804b786aa100f7fb51469e509f2

    SHA256

    a0ab3b238be14d035faae9fe3a9975f300d704538c7c0bc6daf31e52bb30a3bc

    SHA512

    f9c65732709b65659d2febb3164fff6966717ffaece605c5ae7563f4bfdec84abedb8b165dd63860ccbb192717da3f7976091aef0194c655acab74df7d31c379

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    b2f880be6e5502be1ac29cc271e1d106

    SHA1

    c15813d1175752c67cb550fd4ee45a78bad87c1c

    SHA256

    436d533980102c64a5a8bf9a37850b2ac6acf5cfd299ef1b1762c505322eac2b

    SHA512

    f4739cb4f2310d5a0d4752e10f0826e33fe5abad254e0b034c3e5776e65e9cf0357fe4b290c66636b5c21ce046fde42a4e70de95e50ca76ff8a3838d8963890d

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    3f864c963d29dedd439ce13bae459b1d

    SHA1

    7d2301696bc54efc7e42a331c61e742af121f85f

    SHA256

    be647d30f6986a2e3e0f3e52861ddfb53a54309873848104850c3a48e50b8990

    SHA512

    3a8d835c4e7407b9843829b30afe379ed2492f026ea53cf23ee98933da5fcc685b35229275a3ebc6be768082b6846c00aa5ca7a29f8b628e6a363d101b693765

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    1c04d63c6dcadc070bf5463df978eb7f

    SHA1

    6e4cb123dedd2612e40594e54ed87ae4f361123e

    SHA256

    a4848fc09faea952d1b08c954bc4de039cda2c1c360541b71218cdfc4f25eacf

    SHA512

    80382ede3a000f763e7c8baa6696cc803273d7b5306bdb08410536f81b5749ef41373d538423e79d382d30061ad7ab7bd9165d73403ff77a7f546a1c69cd529e

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    2cd72e2e606b9847ee9d442452fdd4bc

    SHA1

    1748c4483f15b1afa610e2a7c35b17c3e8c5c7a9

    SHA256

    440676d20cb55799c567bf291e5b7c7f58656a216531226e54df367284a2f7eb

    SHA512

    cfc35066d365c1fa0b08030b3281aeb4a69c27ebc9ea54f4f93cf5b83bc88279101fac4bdc6a8af489be6de1f390a0113af8aaedd83d450368d9d7116872122d