Analysis

  • max time kernel
    147s
  • max time network
    137s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    03-12-2024 22:02

General

  • Target

    457328d79d735414dd23a59a6a2af66a60f0104125ac4aec4fff7e26bb0b196d.apk

  • Size

    2.7MB

  • MD5

    e32d70aecf2baa2e03ee43a69b445bf9

  • SHA1

    56bdabb0f27a04f9edcdce73a316c4da60d0effb

  • SHA256

    457328d79d735414dd23a59a6a2af66a60f0104125ac4aec4fff7e26bb0b196d

  • SHA512

    14bbb8dd9392e9beaa9008f8c286d33e00a3d3ae2d3d058d91d53788169aa2bcd7b876b8586b3b483b42cbefba88a84d2b90ad52ad6166d9fa076387955ac2ea

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQi:6oQrwFjEI4iZaUzYH99yIt

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

https://alicetvyineyayinde.xyz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4311

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    64f7b7a41818338e243b3367297fa463

    SHA1

    d1413835e735bfa0905650aa5846e25d08405bf2

    SHA256

    f5002e5ceb85415e73db8d361418e7eea6f9c1412e7bc342c7a278518716d7f9

    SHA512

    d65d371fefe2491f997d00a122206569f97ac4ca6838059a122822bdb4ffb9519d4294d6a8e8f4d938185f95ab5408f7cfe1475498a99fda5d8c9a3945ec19ae

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    11aca9eb2048da6d212707f3e7f268bc

    SHA1

    184c06ec89af7aec8b6ccd9bd1c56c908f1828db

    SHA256

    21de9d5b3b7c42cd62ce2fda74b7e2cfb7f9189af18a4e5a1cd6b92f982b3c7c

    SHA512

    f9f1071b8c83ea35b06757449a65f4d4997209c7785c573fcd1d3d3b65cec2d4a300910a28149337ec3b3007ace4c5d790f7ccf6adc9d794c03a9a5da7811895

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    490B

    MD5

    548508e1f5d8091b06b83528973cc6c0

    SHA1

    1fb9bcafd9c5410094e5fccec625f7efb517f015

    SHA256

    a86321b453ff2ab5434b057cb643950e81bbda5922df51d28600dcf78f3cdd6c

    SHA512

    06d02bd49cb60c7e969a7d9e89ea5856bb1e43ed54f85127f287657a265301e05844e4c7872447aa363e75b60270d1d8004a8ad92979b7cf8df37665972d4969

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    c0f3f617717f4d3da42576371c6ce4a7

    SHA1

    3f113b2deb70cf74ed107b7dc51fbc4ef69d0e2a

    SHA256

    0ef2b3282c90a41825ed70e8f5d6ff39bc51ec319d213668702714fbd0bd2b76

    SHA512

    78a3e6b2e77baddd161b89ee9fb813b580b1f7ec7d9516493658867cae971a5d49872ee44052431b8ada32b06e9b7a89b7143bf485e60d534ce95567632dcb17

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    5dd257152e6abd91e89c94317121a4c8

    SHA1

    7ae2d1cd343c70748a87632f9418c8a3dd8d22ec

    SHA256

    5b1b0aaca431e9494148f4a748fbe8a344374fbec6c45606b70d36001d5b221e

    SHA512

    57e663109da63cd12a9912960af4cfc3651ed15cf58bc7544cc39ee8cbc926e5775d90afaf3b8a5f90bc618a2cac01117be7c6a686c597db4951f4d299c98b25

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    c4348a5161a9ede7ef9f207eda2a0381

    SHA1

    f163afe7acde3c3333885bbbc3feadbb71061e55

    SHA256

    0db502775216ff14d97878bba1f6f95f197d81842b0163cb971756fa127b686d

    SHA512

    7d1758bbf3b893cf2af992ed5501507854471184d70aa657be24b1acd0538617c629eaa211eb8df69822dfd096a0f760e051aa217666d8b110679d4d61a80f9c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    ca24d6daf49d75c7dbd036e807cc8deb

    SHA1

    f213af909220bb201f9cf114ac1514df9d42f020

    SHA256

    f0fd11174a8a1fc378f47360f5a927ce734d21aa7a9701ab44d2096a14db6b83

    SHA512

    a6e5fdfb5cebb34fbb6e167ea38360a4580ff01debb1c2f799f327a143d0c8697ae91b93653010586506723c463a3949ec7296b952d43642bdba7b667b48da2f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    8fcde396bc9599f5bcce51dfdc05e444

    SHA1

    ce136188b695a847609f0c7415d8d414d6931507

    SHA256

    6bf349722f54b2f1f0b7521d452a38315609ad1a6618d594309138cd565d7722

    SHA512

    509ee453945fb91d5c29e283f001d046c83a4842fca6d9df95d86ef190b3c5e8af9e98eeee2e9e8244c437b4ef6401a40b7acb5cf20ae47b6b1d5ba3f5a65b4f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    214B

    MD5

    346f60cd2ab20ef1e73ae80adea50ea4

    SHA1

    1dcad013345f70ad5c20c3e6e4f31f17b5a3ed74

    SHA256

    67e3cc2c7a6fe7ce486a0a2030473acc2b16d7ee2edae26fd910e1ecb62c57b1

    SHA512

    919f30d41f612f619cfa37eae73a75aaef6005e2c59639e6689febe957fe996f29c0076409cd6b2bb4997c7cd034e2786c893fc78c016c410955ca4df8aebdcc

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    c140f87ee28346051e0f8a9cbb6face9

    SHA1

    d772ce8ec6dee47f8d30b349d94e85248f884d7a

    SHA256

    4fb99dd9c364bb56d440c21750f8c80308afe762a3e655d610b3f882b2c70f60

    SHA512

    cecd2eecc455881681b2eaf99f028fb2040876b70d0492e28375a2e698345c57f608d89e7c9d100a7f431dd9babea697b877dd4a7a6c091760982773efa67da3

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    d9503fdf8cf326c61e654771b392248e

    SHA1

    e9fcc838d5bb92dbedff5bc20707ff5cacea5d10

    SHA256

    6ed834ff6dd8f2b649432c1802b10570da681d05214830f3b7f523b64fc49477

    SHA512

    2defcda8c6f69b3885f0ae28a41c1841fd9fdabb4ddc84f530f145af596a467bec67c400e70685b724c79c5afe2cd4d76b5908cb4f0235fec49106d591b931b1

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    34c2eeeffda334d8cbcedac122371027

    SHA1

    2a5f05274b257443378a4995867fe355279390bf

    SHA256

    98c33e09f7f3cf69511076913ec87202298afa411017440f1e092003cdee047e

    SHA512

    d9310b3337543a4106f40d994d248cb7ed3146251d6821a96b915d68fa27c23919579d08f852cdd3fe99253a053c67df412a61207c1277abc2f0888c90eda0ad

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    79e8a54512f109b32fa355117f088dd2

    SHA1

    622b959e213796f7f067ab065cf9d17e05e8dee6

    SHA256

    695bb56982e6185d9a679dcdfbdc07856e3d9271c7dff588ca12352327b56026

    SHA512

    52d2c3d3f8a110cee04fccd93a0fe2b12dc98d2dc6e6735c666b63551ffee18186e49b1fceaeb34742f63604f54990dfcf19376438afbe1943f3a17291cfb447

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    15a353cb318d946c694f5117cf8718d7

    SHA1

    63d766119d471a963e4ce3568074f36ecd11caca

    SHA256

    8a1c4ede4d3950ec9f958d529c2b492e1173f1e209549514511b0a95beac522c

    SHA512

    8483620ee877a11776ce7a53b98601c60204d1b827e0fbe888a8c593d55b6fb8631bd24fb1ea596c0a670d2f1d6d0a7f74304afdaa1213823b6cdf984573afb5

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    55B

    MD5

    4c7b7daa6fdb88d9afd8a15ea90e3e95

    SHA1

    7d83afb7fc3e5905a52670e6d18e28f6b258f812

    SHA256

    48f612cf3ef034d6acbb070477d81cd4c053b685d1be402bc0a952e90e1f0b1c

    SHA512

    72153cc4f414d2ba5a79ac917bddf8579afc4a594dcb0ad080acccc241ba04d9f9b0af8135f4b89bff7f87c0cfe0caec8c2b210741779f41cc6dacc65c75a359

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    2f7c1857e3feb33294c804d11c6f62bd

    SHA1

    e7d352381261fcc79055ff5ca392989b0bb560d2

    SHA256

    4c687d1ed24305b73ce705eadc8a876719db585dd63087f277c43d931b55f287

    SHA512

    c58abd23ed1d1b55676803aaee57485eb3e902822fe86707881aaffbe8b9bbdfb8632a5f38119fa448d5631fd7091f1e316f0487e2b842821d2b7c8604928321