Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    17/12/2024, 22:04

General

  • Target

    99f6f9e3c4214d17ab61f86cf231ff8040e70e4e72c43ec6db70eb392080a9d0.apk

  • Size

    2.7MB

  • MD5

    0396c6131eb4e9154c5debcef4aca150

  • SHA1

    80ff6f6f582988efe719f0c429061a485f41002b

  • SHA256

    99f6f9e3c4214d17ab61f86cf231ff8040e70e4e72c43ec6db70eb392080a9d0

  • SHA512

    efe00542309672dc3d571800f7fbceaa08d49fc0e5e5eb0101b3c68df9352c972ed9bafaf7bbbfc7fbe8b5b3c3035f815fed05a70ca9a0ba3d8ab5790439fb47

  • SSDEEP

    49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQH:InFjEI4iZaUzYH99yI+

Malware Config

Extracted

Family

octo

C2

https://85.31.47.238:7117/gate/

https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://85.31.47.238:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5068

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.nameown12/.qcom.nameown12

          Filesize

          48B

          MD5

          046a414913add6f5bb60072c7db819b6

          SHA1

          451ee4f6809260aec622d772fd329c7d0297a842

          SHA256

          b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

          SHA512

          4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

        • /data/data/com.nameown12/kl.txt

          Filesize

          230B

          MD5

          bbc535dc11784239ec5ac4bff04efc25

          SHA1

          81b3d426cd8738539dcee21ef8f54f3ff9ec9e9c

          SHA256

          60049e4cffae97d0ba82a004ad5b9ab6aeddf85a97ededd3fcb86c837273f0fc

          SHA512

          831b1c7fb8db9babe4f8f7531464f233a708cde1f90ff7be205526ef6217c3c9bf1eafbfc07f999b290a7deb47c7ef426512b9dfd1eccfccdc15b80a863d39fb

        • /data/data/com.nameown12/kl.txt

          Filesize

          45B

          MD5

          efc38eeb5b2be7bbf6679e3999f12771

          SHA1

          bd6bbd8f220aeb6360977b5e6880c6a1f963c81f

          SHA256

          e819f8ebf9629cac7b9692eaa44c50376b9b74bbd67d7f461309b293b844b4b6

          SHA512

          9a6f2aa2490435f37f2f82764aba6ae94d4db551930e75616e5f285a8eb4a84f3ba4602dbf2be3b006eefed009a4e5cf9869b88e4b60676a8ca7bd8f456a8ca0

        • /data/data/com.nameown12/kl.txt

          Filesize

          63B

          MD5

          9e54d78e7c410cf8969132a509437054

          SHA1

          849b292f4a187e6c7c3a01ecfc2ab5689bf02756

          SHA256

          13363230d22fb2bab577dec8406db58d62a3d615dc08333516027f6d80feec20

          SHA512

          574695f964efef93bd38f15fec1fc99acaf928fbc3ee0575e9a4546943ccb04f41d3ecc78e66546e08a2e91d44cf0565211a9f118c394db58ea3422a65ef4c76

        • /data/data/com.nameown12/kl.txt

          Filesize

          45B

          MD5

          5bb267a4b21472322e3745f327204449

          SHA1

          34d159c06ce69888894daee18e51435632f916ca

          SHA256

          be46853728e869ea82c9a5a165d5daaea448e58c944a0e2a02021ac13e9a2061

          SHA512

          e915c85076951ca007a19443fb464c8e6586060ae51863539e83ea9ef8ec6404365d19dc13cef3b22d043f70b2dc7e12e1b82d99ee733afd699083eb6ec7e780

        • /data/data/com.nameown12/kl.txt

          Filesize

          423B

          MD5

          2b2563c57510e9ff8e12ba2b66256486

          SHA1

          3e4c0ac9d16444692ce583826be7954d6fc46e7c

          SHA256

          43d7e60ff787d6f80da5802b393a742f64af80d03c6a64f0db256b5fe2c100f4

          SHA512

          7e122b503d2296ccfca558d184ed15a44be98a4e1030537bb23b19eae1f7368a181f09be064ccbfb2c83c1e08d7108b77255223fdcac538fd4716d1b08b3652f