Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    03-12-2024 22:17

General

  • Target

    1305a8ecb85c73d6454b06c534b56b3469dfc3da84b2d0d50db1db446525c9f6.apk

  • Size

    2.7MB

  • MD5

    e1feddf2ecc3d4e12a16a1e0d373c40d

  • SHA1

    f320585af80dc6166dfe30692473d40bbb6b4933

  • SHA256

    1305a8ecb85c73d6454b06c534b56b3469dfc3da84b2d0d50db1db446525c9f6

  • SHA512

    a96f60a7455142fe8d345933ad8a13014f928cf25d4960e44b669eb76fc369a6c4b170a11dc5cbad4333947fb1884148c187f449cc8f4457c8cd02fe9dfac63d

  • SSDEEP

    49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQf:e4FjEI4iZaUzYH99yI8

Malware Config

Extracted

Family

octo

C2

https://45.88.88.100:7117/gate/

https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://45.88.88.100:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5048

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    0fe0f48182b97d5a5c52f025c5a9d2c9

    SHA1

    1e322fd1e3e6b4b3b0ba25575c701c7c8ad57908

    SHA256

    cd6d0ef4b7808774cdccfda6017f98a3b8a5d8f140eb4ab98b92f4459918232f

    SHA512

    4799a1a192125fb5c37d1c5b499836610ded03758b32c4bb3f08bf0b481754a43f16a4b06fe0863c3e3f950f8cd7d182c18e320282137ef76f809aeecf2deb8d

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    4d7d7d5f6885b5891afcb7c9ada4f9e2

    SHA1

    9ef5fe89139bb0f206d43935228b9892214291ef

    SHA256

    a9f11ad5e1a27313951b4e488a23c0e01481df2843f135d2c6939d6c8fdcdeff

    SHA512

    e41e847a725bb1e3eeb91a499d0853ded5057d4b3d0be4ea46e0778b9a4038b017a58217fb5f8ab9c0c1d870b11ce643c2e0f6f1ad7eb66e6699b1d9492efc1a

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    404c5cc5803cbfd29218a035cd53a6c6

    SHA1

    fcdbb3e844f3d6e00074bcbac78d4cde8ab02595

    SHA256

    ff089a5145af4606d5d38581c5c82b632fed428074402f8535b0028ee7489414

    SHA512

    6d86ba241c48ac866d97694eeeed9b4de94f1a7589d60a2cdb69e1dc33db3c4ae8d7ee181034c16ee05ea40f17e68ddacbbac0f81d91a527c6dd8de7e4101eaf

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    2b94d2f0d1990f910eec192817cd962d

    SHA1

    85f704f392139dbc294a9806f0670ed70abe88c8

    SHA256

    ed7cd270869bafe86afd9e12e9b02bb94d626dd4c648f3842eb22713ab8a875d

    SHA512

    d929a5f33b3db19df021fe2cd480f7ccf64a916d82682bb8a11787424fb05ec8b8853496b74eb2bcba4833ce57a0f10329111d9399f9e8ac0ad4bf27ccec07b1

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    820c48850ce21bb5c2a4f398a1dafaf7

    SHA1

    613be37e2d0fe95abcff34c2520e07f62b05b190

    SHA256

    703ebe0c95c349d8b1b083696245e8cbfc9ecacf9f2fc50ed5b7ff39b030a74f

    SHA512

    9dfb8ef8afdef7c3d013a6d2e7f2ad5f7e6f535b7ad5c7c30689b9265bba956b555430bfa02a6cad2d5b2a69b1ba72bfeb8d8617803cf170f8bf0af3302c7f5b