Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    19-10-2024 22:13

General

  • Target

    c2be2dce915cf5534cafd17e788a5e7ba6a43052ab0ba092aad6f389f3eb3e31.apk

  • Size

    2.7MB

  • MD5

    816a5afcc92702e5d94a3284b259600b

  • SHA1

    48a312dac631c854a13fe80b52c771db4b11c100

  • SHA256

    c2be2dce915cf5534cafd17e788a5e7ba6a43052ab0ba092aad6f389f3eb3e31

  • SHA512

    310c8c62aff87607db0b122d28c8f62950fc6201e76998f7b6aad3c2f5946287302a92f657c94b03786704e6c01ac7f3e666218b55a5ef6c12ace32cbe7e30af

  • SSDEEP

    49152:Eij92W6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQH:Eij92WFjEI4iZaUzYH99yIa

Malware Config

Extracted

Family

octo

C2

https://80.76.51.192:7117/gate/

https://80.76.51.192:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://80.76.51.192:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5065

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    14dcfafbd860175439e3ee3f053b9866

    SHA1

    51364dfdae3de83d90151b3a5c80f10609da9a65

    SHA256

    0b4c4967b43207b58afae5b0a2eaf763304043a70c0a908cb233cdb0883706ca

    SHA512

    6878937d50c8d10a936accaa8f00dd6cc1490adb6d01548b0c6f27bab1715397802779f894b507d3709bc7a87e6d96b16bb310b24ef77f833a6391d33826693e

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    b444b170ee3d7fd0992ebaa0515b514c

    SHA1

    412858ab1494dd1ef1b0dc6f6b2e49816dfea529

    SHA256

    3ce1dbb24a1549b4ec4eae200549576dfaa5bfd7d2faaf3f1999a45c9d877261

    SHA512

    4c1aba195d0288653f3346d3c41267a38e6661e1949a1f306e141754f6f4e1d40dd0f690643822f88c660ef6b8bc762d1b4e9466d14092166a1dca6173b3076b

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    0071133f7424c7ce318c4f7f84fe9799

    SHA1

    10195c1676b2d8ba3d7cf42b3ecd8c07210ed24f

    SHA256

    787e19410678d5efb29f2da29c75fedab089b19c5f5c559ba38c6d342eb2107f

    SHA512

    c80e081acfda3e3c8ffd88713d6f9d7fc02ebe12324139f0d26fcbedcc59d6e0b062bede1634451cc74e99db69dfa599b4817e512b178ec455cf32f201a68268

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    fa421b3b53804ff2286ade8488ef5e42

    SHA1

    bdf48c4e31e27ddb07005dc43ef046882019f82a

    SHA256

    1ffd3f75545d08485946d9dd868c0265083a3acb949ee0f2822be5c9e58753b7

    SHA512

    7ed61af3052248665b9373a71ebf49aa1bd3893ce2d4072ac50de40661c17b12c4cfd128e3489354e16c030317ba0c5a5b69bab5332318b37ccdc81707b347eb

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    73127c783ca83dc323121676f4cb5a8e

    SHA1

    ad38c2b92bfed3e1d0a87a419d88a06ad59e33dd

    SHA256

    e192e971dcde9428e9457a985771046f6981618259a1ae511468a82727bddd7f

    SHA512

    203ca161c7ee09e6c1dc664c63ad11e41925b6ab3a93549c758dc8799fcce39d2f6e0a462fd7ca134725c67bec96f7c417ee68b3a0ff82499b52a43624bd4776