Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    08-11-2024 22:03

General

  • Target

    150beff7e942baa7f366d8f838bfd2a6b13854bee78d2e9cc5c172c1f8a6847f.apk

  • Size

    2.7MB

  • MD5

    6e946d7a99f343dc333170d5bdd38e22

  • SHA1

    47580de8ed7a580c08885435bb389b8eb1d12d36

  • SHA256

    150beff7e942baa7f366d8f838bfd2a6b13854bee78d2e9cc5c172c1f8a6847f

  • SHA512

    1c7833ad284d91c67747bb03fabca033608f634027f9e70da3643a31b7b79b86fd60819f5d004650f4bc9211c7d57c200480b95c39c181665b6f55ae09c80d28

  • SSDEEP

    49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQN:yFjEI4iZaUzYH99yIC

Malware Config

Extracted

Family

octo

C2

https://178.215.224.87:7117/gate/

https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://178.215.224.87:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5004

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    43fa365fee3d5cb60bc5fc8688248c17

    SHA1

    7980774617318cd768e0981e8593b9f4ade91d9b

    SHA256

    ebad36f26bf6cb8916430286ecd071d372693ba4077084c28eea615f79c9a266

    SHA512

    a9bd936a610744ac0718f76178c987b0ea3d24e373e4ba59231e56a895229b00b5a1553848e3e7837d3d50e798ce628f670416d45eab775d9a9952f66a1f8aa9

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    3783cbdd39dfe9f3f086bb49dde470a5

    SHA1

    6208e39883cc34e696efa189f363a2b6906e09dd

    SHA256

    bf339c4ce4f0210f6ec4267bb927a2f4ab0f9c0b42ff0a4432b9629313bdb8ab

    SHA512

    95780df9fb021d582be7ee2606d728bcbc39036e39618790e377c2fcb8c78e2d8a1f8cc22f25479772b6bd892f69562dca1a9d8ed07ad49b62daee93b45f3604

  • /data/data/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    abe450f98d071b9b5eb50779063f128c

    SHA1

    e57eb2aa69b8bb561f464694387fb148b5408fce

    SHA256

    3b711e3e33a38d5d88ee2095097fbe05bca991fcc4c703b43db283548f311735

    SHA512

    4f1affe2b8e61a51578c1e4402f67fb2764b5f5802e69e554ad2cf6bff7546e1b66a79ca6a38a2b4745ea9a441f30437c9867b4a2fecd2152aa55f7053d6030a

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    6cc5cb90a069e0e7efafe3540e533548

    SHA1

    4c79262a62a98e1bababe9bf4ff3da145743376d

    SHA256

    4780bbf94da9f080306c73b7e666bac6020bb34a4c9333a3e49f541b4823fbe6

    SHA512

    1f3f3772c1bb3f9a643e51b4d92abffc0ffcb3029c487419a2f18102c0c3755b7b07f7b2fde71a429c636a9208aee3dfb242993630b37fff445b12fa10c6bc4c

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    e72c6f82fec04b7cb6432409b0597710

    SHA1

    460b12c51eaa52fb86302c1d631b6a3e67106099

    SHA256

    a0742176b5139ed5b5bc7934fc173f27a4a1b5ca41c8c7c949cde04a2aa0e014

    SHA512

    c5b6a4855512c271d088542af82fb92cb8ea48288155bbd5c458881a668cb35b87fc00f979294dae661a4db4b85782728c517da867355e3b8eb10f63363b69f0