Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    28-11-2024 22:02

General

  • Target

    4de4f3f2bb809910d26b7467142c4658aba5293791b848a555f2e398eab39778.apk

  • Size

    2.7MB

  • MD5

    eee94b96ea49bac4f314124bf602427c

  • SHA1

    df881b84c8cbb4fa63231f0a90bae778be3d4b34

  • SHA256

    4de4f3f2bb809910d26b7467142c4658aba5293791b848a555f2e398eab39778

  • SHA512

    44ae22451d49c652269544c681ee4efaf61882266f689b9bf4a572633bee829483eff57332bd21a490ddb4e80dfa77a0c2ac3e824d530bb1dbde170ffa022a53

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQg:6oQrwFjEI4iZaUzYH99yIH

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

https://alicetvyineyayinde.xyz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4499

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    298815271e92438d4cb8096d0ab6d806

    SHA1

    c66d9f0fc41285ee8ab4f8b2178cb5102aabd575

    SHA256

    6f3ea589795eb07ae4b2cee4b9182b723a6cf432488ae08859d88d2aba67ec75

    SHA512

    952634ca9c8c868a50709b53ed031c835cae7b665b0772b0a15623b1a97fec67e1147ad57c73fd906ff7aebcaaf77f313014c16624542f7b19d8b6c19f819804

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    4f2a1b85b715956e5f7ce4e9ea0f5589

    SHA1

    9808233ccde227ed2aa4d1b93007ae021f963290

    SHA256

    f8e911bd09962881521ea170ed283e76b284343c3b7f469dac55e5a98bf343e0

    SHA512

    ef9c17eea3c8e2a03973bb25a4feff967c8b8fd63f24e1373afa6c9146406f975276d864d5f175eaaf8c9ea1588d595f421768699a4905f1064c3ce517b0eb6c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    214B

    MD5

    a3390f3f0c985ef656b8f929cdc35e93

    SHA1

    11eb03dc19dd1c67814df3cd98b3632010c42eb3

    SHA256

    146dc1e95f490e0bcc4f8432259772b16ad24caad9b4824366f78c1e8bff7554

    SHA512

    c4d2e4912e964c9f317f17cede67c7d037f4e5ec2803c29fd0661f1e7c498c40a78646f59d4349b38280a05942bfdc4cd21e11a14b31a76c7cf5af08b7a778fc

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    a1cf013ac3e0015e8f491654c4ce3479

    SHA1

    bc4bce1eb092a9849d007c1af6618879ea8c5fa4

    SHA256

    b9cd99947a3348a1709fba375269cedb9928aae933e52c48f98d30bd74f64fa8

    SHA512

    a6d4526d3adf9822d29d467694d7a8d90f4a247a6c511d8b574c3a811ee678e502f1e687b6fcd3de386f51b0dc1a658718b03128dc3194d6dc1e696be6ef55d1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    6d25be73f6ab9aed7152f94f115318da

    SHA1

    f76dcfd87e2927bf81dd04dab904ad9e1cb71e78

    SHA256

    532d10394b6a90ce8c279cef495f922f3751be171b2b4661d85ddf44a8c98e02

    SHA512

    b6adf804352839d7c647e4fb284f11a51fcf985c31cbd86e7dc63fcb1329c60d28885114de63f79fc1b49ab9a84707a5e53de6bc29e11ccf60de0a8b2ced19a1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    1cfa55faf1977ba84522235580543b7c

    SHA1

    ca410d6e00525fb7bc53ff27fb14a5e7047fb127

    SHA256

    b04f168580efa881bf702aa1a4687ea3cecd9d621b4a7641790c703ee1913771

    SHA512

    d7114a50daf593b1440c2236f1295a42b83ade803c4854def1c129e21146e35fb95705359378a735f254cca3546a6866d48e0d9b69b1064ec163f0edff0e75f1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    490B

    MD5

    897c4e8d65363bafc0b2ac646b92f86b

    SHA1

    54a68154c2d0336548a94b115af01bc2f487e6dc

    SHA256

    2df516ebf7f837db5587ec0f6a55dee87af0ef367583d26cf098271b3f78bc2a

    SHA512

    247106503d9af0f728379a260c28d700eab8cf138af4635375ee5f6143086fdff3cced3a6a07df35a2c55c51e40fbb4c8f415a7dcbd0ca21162ec06b209caeab

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    7368cd4f2d2bf3efd9894a9b63e3f5f4

    SHA1

    9ac42cac439d4e559ad7c269bebe6dcb53839640

    SHA256

    ae06c85db8bea6269bc54e8119017dada57ca2e00260e55272a0dd91a375b35c

    SHA512

    7322357bf096b09b75a0c2e09f5fd9dd405edc3896e264f3c1ca3a8991cb50baf5e39276d0f4343290296945ad23267dd425cc608370eb2460f6f997decd7db1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    01bb753135d5ce83b68e5110f7429235

    SHA1

    b5241d92d63d4a9aeae1a31ccf7e75377ea9887e

    SHA256

    d460f984f1528f8df1630a975d6a13a18689fe938a05d042ccd5d039fc59f61d

    SHA512

    0835abb1065aa7e761c26301191701711e281e446301d2e7dd50f7672f4a95888872d6a9d06db652749fe4b2167352bfd5d12f3b1895a68c664ccd9e64129231

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    8014a8db7b4149c57c81e13eb2f919e2

    SHA1

    64ff1494663b29f0d7435d3c76cb4ae3480b045d

    SHA256

    9bc4f90993d9fdac34b970395918492162ba1ddddcf557005ca27487bc29280a

    SHA512

    e84c86481bca11d7dc914638010669149a0a4fcbba330dbf9913973c919f92350166a445dd1689289144ffbc0051f88751b341025440ee793174bee34f40d3b3