Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    05-11-2024 22:03

General

  • Target

    c9e1bd5f088e68fc9f5cdff1c8feef973151a569f1d62ca3e55b166761bb023d.apk

  • Size

    2.7MB

  • MD5

    2bf96859be38fc9f8719a65ee7deb03a

  • SHA1

    e17b30d372175aff02b37920a68d88221ab3aa19

  • SHA256

    c9e1bd5f088e68fc9f5cdff1c8feef973151a569f1d62ca3e55b166761bb023d

  • SHA512

    f0ed3816bbd566329f6e24bfcd511fec6342f6d77052deaf5127eabcf7dfba7b9f7b772761b32cf62a526272874aca0303edc1057c74550b8686a93dfccf0ad2

  • SSDEEP

    49152:3366Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ9:3qFjEI4iZaUzYH99yII

Malware Config

Extracted

Family

octo

C2

https://31.13.224.104:7117/gate/

https://31.13.224.104:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://31.13.224.104:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4995

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    deeceb77d19dc6e16a00706527219995

    SHA1

    57e69526a9d995147aba2ae76f981a3dcb77570a

    SHA256

    4ce9cc906ce89dede15ee535bf1dd1fbe92126628acf0209303e9b7c0c81af43

    SHA512

    19c0e48a8f92e9eaf6068755acf1071905e855fc26d9423fedf4c757ed4d06b7bc1ee8f790afd06e382fa0fc7cdb827c61c9cc148f6595b443e714d92c4cf32a

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    25a0a7ecbf169fc5d33c042238809fb5

    SHA1

    8d856919f22b6421e4c5e092cd5ff4b089f3ae9a

    SHA256

    c5854f02b1151aeb959136294465d412ed38283a88952728cda81164f439cbe8

    SHA512

    62feb9d6f5cccea837b07669aeaea0d6e09b7b0d742df86ef3b7d4a44e1eb8145ed0e0b07c1c7533921ce6a60c4e6f9daacb76d45cf6279e38a5f126fafc1bf0

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    e10cb7931c0863dfff55dbd9a759ab13

    SHA1

    1a1298912242dfa3ff8261bc6226564d7e41fd2f

    SHA256

    69fc78bc55e2d9c83279de24b65766422ffd6f9cfa6d4e25cca3dd3c5dddd8c2

    SHA512

    c98cf1a4ab31a704c11aee6abdbb6eea8a1bbdeeb26ba13a437e09b3afb54bc9da23f68180e2c230598bebbfe7b31d607cfa5a865b1c94490291ce8506b1246c

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    fb1c0b001733b6ac036dad5ba4b21bed

    SHA1

    52b91af6e010818e6901472d15b3e208bafae7f6

    SHA256

    b305aa250868fee43699c570bbfc1abb07419a609b30830588d95ed549a0a299

    SHA512

    7ee37c4a2230b1d49ba01e63710db04c1dd40de8708c95a91d7379b0db169ce64adcb88f7781275a6954d7fb0cd169d2bfe55660aa7eb8b5f172d6431927e2cf

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    1189711bca89c41b417a2a9c1f5d6898

    SHA1

    1b725a488e51186de573bcd504377277f9c316c8

    SHA256

    909b116c2b5b207fcc61f6415225a957a913ffedd89c618ec567f7271b0c905b

    SHA512

    21043e0399dc5ec3dae22b4d8e037046d37899f15f3960168d4eb7adda9fe1d84b1a16da76a18b456a45558a820de10192f925e6fd757c5ebad87010dc1f4e59