Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    19-10-2024 22:01

General

  • Target

    7028e24493930c6bb59a042c9e2081afb1e54cf05942fe55870976031475c40b.apk

  • Size

    2.7MB

  • MD5

    05a2d990a1f6710d986ee221b6e9f83a

  • SHA1

    66369e848adfa680a25912724c9aebf541ca45a1

  • SHA256

    7028e24493930c6bb59a042c9e2081afb1e54cf05942fe55870976031475c40b

  • SHA512

    f10db1d68a08e69470db2b5897e988854faf4b480b52865216a0487ef447bed88149028e5ab1dad7e453cb1ec0b0cbd08dcbb5fe64b1923a09692a33374ac263

  • SSDEEP

    49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQr:e4FjEI4iZaUzYH99yIo

Malware Config

Extracted

Family

octo

C2

https://45.88.88.100:7117/gate/

https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://45.88.88.100:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5043

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    db03afcaba7b6f4eda17a54e2e548021

    SHA1

    e4bc5301530b73c5eac06072ae0a16e5d9b12f11

    SHA256

    4fb7da9a04db2fe637ee7599fffb9aa144d0f7dab3b6f9de8430c1d2c614d99e

    SHA512

    3e178aeee4596221b9ef346d4be7e1a7c52ffe9b205302e904eb5387cc5631072c567ffd4d461d4cbac639f60aa7cd676eed36c255bc55668a10424e3013c014

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    70b9b50cbdd4e62d34af3eb24e32b830

    SHA1

    ff6a3867967aff8c9ddbfd6739fef3ddc849e4e7

    SHA256

    6d26b61c39bdb12b001ae8f8b515a85c20e70fbfc98cf76f18fc7b1e8a22a9d6

    SHA512

    32bc1d6d09c0f4db52d7f806f817ef5639dbd3cec960f48b4deed4bbdf2bdfb127a3133393ddbfa102ae6d7fdc3c4b7a365464bf11064083f11ebef6062124af

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    8811e8a165dbbc663592916eed39cb04

    SHA1

    67a27adce15a9ebbf4643c4013574347409c56a8

    SHA256

    d927fa171e52bb80de13f47bd3addfbece75ab28b8387b52f7c2bd1a13e4eb59

    SHA512

    935e49613cbb4043310e35eb321175d97226842d128963d4f70e936ea5213ca7349c71e891efe0d7991bd9c8dbb3fdfae92a86c248bf8c6ddf06954eb2f1bfe2

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    f3d1ae788259328c8d402c16483eb30c

    SHA1

    4aeb6fdada7b664496ee931c80fb5dd0526ae147

    SHA256

    2923d26b97ada67a90ea2dbe960ad46c7cb96ff75aae3b6f3e8d67aa90689e7e

    SHA512

    20aca4d9a1e93987724c29aec4c9d03b77c606b97ee666fd2dcdd849a95d853358c94eae185b9cc6c7e39f7102c78b4d379318f4b126481d4c22cc53fde622e0

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    6b17dee1a0c041be53a915dd391e996f

    SHA1

    0c637854259faab9a21ce52b235d5683d413353b

    SHA256

    4f6d7a7c82c52918b18aa3d2ec5d13ed5f7ce407af580b169d856a6c0915e8e1

    SHA512

    6f7901959f6229f90b6d4d285ef404307a136d0e3cac0a360502472bfd5e3de0046f9b4acebb5d4313e03acfe940ad9fb4451b483e07f758eb5c8b4828180efc