Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    09-11-2024 22:01

General

  • Target

    e049ab79f614e3bdad841952de58a734ee1425fbddf0d577d6c22a0f9df1d7a5.apk

  • Size

    2.7MB

  • MD5

    eb15f3880854dd0f1cda20c463a09bb6

  • SHA1

    de26840b189d5993828ad469186d5ec6d0e40982

  • SHA256

    e049ab79f614e3bdad841952de58a734ee1425fbddf0d577d6c22a0f9df1d7a5

  • SHA512

    e3efc4c0452ed45991271b9cce3137acbba7b6451cfe7fd2a11cf5b136579613adf2cb9f22d5473d1c5df9b7c716e3238d6b21c2e815cd233c06e3d91fe71e82

  • SSDEEP

    49152:3366Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQA:3qFjEI4iZaUzYH99yIh

Malware Config

Extracted

Family

octo

C2

https://31.13.224.104:7117/gate/

https://31.13.224.104:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://31.13.224.104:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5048

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    1803a71f85a597984a85362e5fedd79d

    SHA1

    0edbcedd63001be6884d627cc5b476681c54a711

    SHA256

    7d3b239093cc52863979d3a69b985d4192458ecd958eaa848d228dc4cb8af56c

    SHA512

    58c778934ebb001fdbbdea8446610fdc93d517b5bfc132eb7d505d869198c1445e21710eafd4b86cb7254ef2bd94a04fc0db95fd44f5a3f1f361f067688fe7cf

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    ec269be031b1d94a1e8efa532c857b1d

    SHA1

    44b75e80e76aceb685cbbbd581fba24237d9c1dd

    SHA256

    45f0673b76327fae8b6990f841a6b4408226e2e8f0276d4dde5d8dc5a719af59

    SHA512

    c8436dc62eca33bfc8c5b4328244d5e16badf890451c09af55bd6383f005eab2df66e6c7c2a32177b0aaa0ca188631b12ee66138fc93c6d13eb1a2a517591a80

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    e5f08f662559ce8f3ea1d0f880113f4c

    SHA1

    fb44b9ae60dcde27f2b495f973bfb9137233256a

    SHA256

    dcbfbc05eb92527a5ac1c444f3083bd06c4d022b9bb9fdebb75cdf5be0250c68

    SHA512

    dab19cfeeaea3d8b1c9a3ffd137858f455c503719bbaaaad751a2e83c89d2f44e3fb9f73b9ad81c1c8440186474ca81503c19c60656f5ecf20fe2fec284b3c9c

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    3b3c71c843e479c9a1dc2ac20b59fb29

    SHA1

    aa01378258af69fb6b87b417f1c6c92a3f7100b5

    SHA256

    a63bb0af4cae101b3bca9ab5ae97ed8dc5be9e325f576b3dd389cc7464e5b606

    SHA512

    4d83dd9c22357ebf6838e201b6a42e45613c464a8ac760d3ccc6782c22b68178ac0d2108c583a0dabb919b63049b5515984a6f658e84fbf66bf6bbf175f155b0

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    b6dbe035811e83babd6f29e78922c401

    SHA1

    c672385d557f26f5c183e25fffa10f65a861f3c1

    SHA256

    d76b5e7e671a3044950a251078a4cf89e77809148c8653ef9bcd0460fff6116b

    SHA512

    629b587c966219ba231167dbb140417d27f1673c961a1a5536c3254e9c0292c1eb4b32d6417c693995516b32338361cf83e1fb9431a23aae0dda77e7ccdcd3f4