Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    15/10/2024, 22:04

General

  • Target

    a316406c294ed2ebc989bf3f306a66cce0f7ff738bba6430966bc03d715d284e.apk

  • Size

    2.7MB

  • MD5

    c6f9bbae866043532987ce2b616ec158

  • SHA1

    f64045df83883a37c29123f5b7a8ae713bfbff1c

  • SHA256

    a316406c294ed2ebc989bf3f306a66cce0f7ff738bba6430966bc03d715d284e

  • SHA512

    92386af9536cf79e5b35d8d4da9875f933bf0f4300a5e633642dd0a5a2c3ce0915c43fd85d6d5f2aa41ab6d061139b2b7fc457475259bcdaf51f6383c7429583

  • SSDEEP

    49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQL:e4FjEI4iZaUzYH99yI0

Malware Config

Extracted

Family

octo

C2

https://45.88.88.100:7117/gate/

https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://45.88.88.100:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4454

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/com.nameown12/.qcom.nameown12

          Filesize

          48B

          MD5

          046a414913add6f5bb60072c7db819b6

          SHA1

          451ee4f6809260aec622d772fd329c7d0297a842

          SHA256

          b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

          SHA512

          4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          84B

          MD5

          44723078db3fab474c6feef4e6f39e9b

          SHA1

          128749b476234ba6a35cb7e537a8f0f9b6663cb4

          SHA256

          5ab0ff0eb9b0c34d365ea8a3b51fa7d5ac53e7f960e5d223b91bb4fa5dfbb952

          SHA512

          3eb1e66d3dbddfd801b817fa747134e30853ed1cbbb03229a5a78f6812cc207e3934131d95c9a3c9b07a1900cb106f6f51c43dc057340fe7ee1a9e43a854b944

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          68B

          MD5

          44f26646f1d9afdc658ac3ac8870b794

          SHA1

          3d6605f0d59380ccc18d6684b3805eeeb36a0147

          SHA256

          4ae643e1de4fd23ad910229210fff78a4cc94b21f775a03ff7c1b3b905fb77f3

          SHA512

          7dc2fe9415c82b001c53b13a36f02887c2b80ead76f6fe4ac3b4b9a5df3562b49e9647862527db98fd6c9433fc155383044d13aa198f27cc6761783086dfcc3d

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          68B

          MD5

          a7833df8617a207b1463427e123a4e61

          SHA1

          286ca518990e5d16c6f45f2bbe13eb7c77e3c271

          SHA256

          f168bd11116777f4d7502da17bec787fb35ded8027c9904180abdcf5220e4701

          SHA512

          7e53b78191f3149b38328cd9cc18619595caf68c79ec022ee48681e8ccb16a279d5bda03f07bbfba0a85a879230dbf84e806b7a4b32e5263d2b0eea3983b5a96

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          214B

          MD5

          18520f58248ec7db4fbbae1e7af7ced0

          SHA1

          1904082fd939200c48bc45a149cb9f0e4f7929d3

          SHA256

          99b2a2dae0540212b43bc928a1ad716cc054866cb130018de4a0bacd2acd73e9

          SHA512

          eb25193001bd3ae3eab176b75254bef179ce8e7e68e1cf81a4a2a36b40648132891d8f2ff8dd16b5aaaf756e2b91d4633abd72236280684541c78762d663dd86

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          54B

          MD5

          db0f694c6b4655cb468386eafd7ac5df

          SHA1

          3862cf0732ba897fd59223a455923a00a424d4db

          SHA256

          1537cad0548cfbf23ed22a576966cb3593c0f7a4432c8dc6d79c3dd4f0395063

          SHA512

          f08261b57065e1573ccf4758f5995fa9692e9ce3cc13681f33c92def05431bfb8da4e139440f6f8b180d72801425f722c9d5c8677e817220824f48a8f73b7458

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          68B

          MD5

          991f633095df91dc4fbf9f06e1e050ab

          SHA1

          8cabaab855c1e48e73a665db0ed3094b373a8d9b

          SHA256

          377bcc219d380244f2693e2d6095d40d44eb5b83ad9b22bdee1e6aa5d5d92901

          SHA512

          e1688d6482b3687d132ad6b975db70666996009fa7d06465b5591c3bf0167919a8ea336124eb63b0859ce16f058d2967119890d60581b388b814d720d471f227

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          52B

          MD5

          3ca1c5e96b01f19fb5542dbbb84ac0f1

          SHA1

          d85e8f9a7cead45cf473a038a6f1c01abe3034cb

          SHA256

          c683c391c3c455f8e7fa8c3cf1021a896c948f0dcae9c4b56d7b1249d5cc0a12

          SHA512

          53a799635e86202ef831a3432250568cbb2a7cf2ef52c40ddfaf65c02801333d86b37e3c29e878a4e217715a97c843882344cd43c1ca9d98e1c8f9a3abe918a2

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          490B

          MD5

          8751fcbbb533eab3d2c100e1fdc7a275

          SHA1

          0300a1e6089255235d98b7cf829701e49873253d

          SHA256

          9894daa20b2ce6f8afc45291bdb6637e6992b42a00f2b0ce3dfc025daa24f76b

          SHA512

          2322b390c5dedbedf2d6e19ade0c7a76d41554a0742c4ff93081d84cd9ba6b707fae67e9bbbe7479477e17f1c370b4d2524a893eb2377e90a76a361685e5adb1

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          60B

          MD5

          9b1219bc5782e7f43a92f468e691b49b

          SHA1

          58549b36d3894a182929d7f62e1353241d174a75

          SHA256

          06b20d67e88c66669044ab527c2037784a54310f1fcb4b76aca03561c4a4a01c

          SHA512

          32014c2f3b65bc396c315fdf7ef5a6c638a1ce4ec5b0fc19da1deed6d20c3970fde3247267707a1f53d5b239b90c2bd374ac827e94fca8d6938c17274399c376

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          52B

          MD5

          dca8e1c7670e389444782f1c97c3f1ff

          SHA1

          9c59cfa82dbe7313fc3990928e89c7e7f2626fed

          SHA256

          e8ae39b4d00f715433f04553913bc1822e3c760beceff63f2ea358488ab0294f

          SHA512

          3219ed47258f882b2981c5ae8d2750471ee4e69c58f66887e079e5a8828684d6deda7f962cd81fff8754d89496028a7775b70a73a083115de613e91b7fb21a81

        • /data/user/0/com.nameown12/kl.txt

          Filesize

          66B

          MD5

          b09913dfb639cdb15802c725c75d8350

          SHA1

          f254cea5ee8608f5e5c1cd08d898b55fc3a4a7ac

          SHA256

          103c91b39f739451053078bf199aa125bb7a7d2b24f8ef2bdb1db904fe12c4da

          SHA512

          bef8b8397493f41de0fcced60851af7cf7f385fe9faf5778f69766848d5899cee664e72d21f7c2cedb81b3e1335937078f1598e1e568c814769d7bc970a042ac