Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    18-12-2024 22:02

General

  • Target

    b70763822ca35217aa969c0c09346c560fdbb57db658a1074f332dfca3b56c09.apk

  • Size

    2.7MB

  • MD5

    00d4d599b386668cbc6d4136cb5e7065

  • SHA1

    cc73e4f87f878cb2446a6335a02ce11bff1f22be

  • SHA256

    b70763822ca35217aa969c0c09346c560fdbb57db658a1074f332dfca3b56c09

  • SHA512

    de596b0b6bed3ee85a7d16897feb81d9db625981f5db87bf9a8a6df3a58a3bb1700640e463f306e3eea9eaf8d9bf8252159dfdaf0b17dbdd94ddc2fda301d44f

  • SSDEEP

    49152:Qc36Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQXN6:53FjEI4iZaUzYH99yI8N6

Malware Config

Extracted

Family

octo

C2

https://94.156.167.73:7117/gate/

https://94.156.167.73:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.156.167.73:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4318

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    f5538f953f8db460dea30f2593f11c25

    SHA1

    ea5180d9f439e2ad399f866d57973e4a6c37df8d

    SHA256

    1ef011a808ccc40fb13cd00605c631b241f9664c73ee5a376107d3189b47b0d9

    SHA512

    b70e5e96d831c95f418b95e998322f193a9e6c5f431a4eb3b3a960fc707c4e38aa5625cfe1f40c488abc4da98edb3651e5ea3d5f2f2dd1dd3893883189b21f50

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    79B

    MD5

    33c7fa2e1b84af84ea70f4bf28bd4e4c

    SHA1

    07959e22bac2d87a8ca78d28672e5f1f5b090009

    SHA256

    71218488d639a9cc6141415426163ad1517e8e7e4d5445e3152643c5a51c6890

    SHA512

    2910cedc05c3271692a60a749a43ff5834d72189b72af940bab319dd2701271639bce09f53922225f849a8e5352051c096bf82e6574e9739b8d88a3d2b622f7d

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    490B

    MD5

    797b98b89e2058d478663a0258da2a43

    SHA1

    3d7cd3f47343e81970f361f74c36ea0e57387f90

    SHA256

    8534a0a33730437a1189824aa63b97b5891f8a787abbd765a5777f7b4541f4ca

    SHA512

    0e86612b578298a140078179a80379af86b0cd77af0e23e83e98307842364a1dce084daafda0e7503a7b7b896e1006a0d161e38c3db16f061ae35ade222d3977

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    4ba1f4e8eee92ac1ab9c728193f1e861

    SHA1

    080919dc53fd91f0c22d4ade1e4d72396ece1caa

    SHA256

    25853e69fc58d304b3fdc36f59d94101e8009a7536a6783be2db3dd332807838

    SHA512

    bda72edd784d7414ad6d8c010c58ec57695fe6dfde8345d2abf737a04c0301440da1b07c51fd9e6dad7422e9335b9c20fe1fa9bd94b0a8ff6a6e21701a948c25

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    ae7e2ba1975263d2aa93daa49244f018

    SHA1

    3b3a03138f769ba71114a72427905410b419fd2e

    SHA256

    24bd0c03a03b18aad867867c157a1d0376e1f82e1a7f12bfe69ff09e153a8e96

    SHA512

    995c3f88fcbe5bcd2cd557b2fb4938788da91c8cabf64a6315908396b435695b7e9a4b09313254f2d54b9c837dc0dfe55e4543fd048c4adc92e32392d51afd5f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    52B

    MD5

    cdc14da53b0787ee7f294a7dc9806375

    SHA1

    9cd7fb87868c26f0af85aee5be3cfb794d60e534

    SHA256

    c5169cda6be03190dfca971db3a07e02899aec2d760caab0b79de50806af4d58

    SHA512

    77518dcf16e95d2a1458fd24fee0d31958b70515590eb010f17ee5e17aa2731deac26ce089982490eb3c24306779e9006e957face4a5d995180a96b64660d72c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    63e9db80ad0edc10f3acb34dc78266af

    SHA1

    cd576aa5036050486cf4ebba936cbd85a505b0b8

    SHA256

    fce511a61d60d4a9876d3023bd1f704fcbfbb7e1818da6bc5fe6da402a3d98f3

    SHA512

    7063bdf44b7c66dee1c24365f57367aa67b7b8d62f3f2869b7662ac96883b7b8a9f09beb7d4d5c66024bfbeda7a1dbd161f4a69d32397fddcea5dc1e56a15938

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    ea90bf4f1ecf0eb9d16d483db616a2d8

    SHA1

    3f301f270c957da261f9f50f46c5837327a233a9

    SHA256

    4c2940c16ab431462ae2d6e6f4efa3f489d004cb8eba9b7b92a811f84380efa0

    SHA512

    33a951af24e45107b2bfb5ebe488398613e4b858e3d308779abc211a726c3fbc885d501b9983fdd0844ae9a76bcafd1eff926bea37a1911fafc58669fefc28a7

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    4aff9437bd62295afab7a288b8493d85

    SHA1

    1b22a3744f2cbb6c49a908c840df66b83e62e3ad

    SHA256

    f94a41672c7edf7b75ddadd3efa215f975ed5be9104fe61ebccc858d4d44b152

    SHA512

    206a27b35140e261ffdbc344c4f63b40d66b1fcbf882b3668876295d8e5e596df1c5a106df30ae984a1fae7b3ca34525509abef102e6b14110232f6b0a4a82b8

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    214B

    MD5

    b83252a9b4055d6884fb3d0a264c0ef8

    SHA1

    1b7e4ade6a5dd1e0b535ff287c06fcbaa1143229

    SHA256

    c298333751028b4ed162ab83626b0c3d057fa4eba3aa5ad4c7db443e8f6b19a7

    SHA512

    de1e059406df9f3f0d52867a723a271676f8ccbe5b0631aa5fd0687700c7b8a56cd75790be3f0eab2577a984470c2980b5f459eb7b34199ea4856f43d22d036e

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    f71745bc15b6ea7ed8c4ae5e6df09233

    SHA1

    725ba91a31420ba0c6b59842832b60d5175ac519

    SHA256

    1648086f53979b5506ace75f95e4ab7d58fec7087522878286ccb4f39e3d4ee0

    SHA512

    d12a3c2df3cd5534f33fdef58a46ca69d61c744de719cf277902312b59dbb69f620e9f6503c71d248f1fa730509f9ddfee41775a6880128e8218e17d43ea1eb5

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    f44301ad561320924b22a1485a93a333

    SHA1

    a2c3484388b67bebac195430eb1f90b3cc7d15f7

    SHA256

    024efa081e2e39edbd381e08d54d8a00b861c418ff0fb0c51701c25f88c30ceb

    SHA512

    3e5311d95690f17921af70484deed4fadada0865a461f49aa3bdc2ecf24a4998227f56c3c65d2f231a6b7524b642b1ab43f32aeb30a28beddf13b3629a9f0fd7

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    60B

    MD5

    98f687548d3cf8760ab92944930a9694

    SHA1

    56a53bd8ce10da16a35d0c6fc8c630ab9cfe5b18

    SHA256

    4009c98a7635ce02ccf6c66a88b2a96a44c656f63ba487d1fd89c70e112d442b

    SHA512

    dce8e10b7e34ce3a0f04eee483e049287295b32052cb92d3b77f6b362e349cb4e9868c2e0eedcb5b420c087da2c8e05d49e8ed63c561f543e4e22732a6a9f186

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    9dcf8c36f23ac0cc319bacf78088d8a3

    SHA1

    13175e714b06752a23c81801e44d46af410d6311

    SHA256

    3afd6ec81b7e2c0a4cad6ecf83ee892f932c95a34e67142718eb9c87332c491e

    SHA512

    cd39517860c897f2b503d1191f2e9a4aafdf74b26c287e5c2320df96e37831996a4ac75abae54fb38e6e8e9ac38f1192586ab9ca2143d232fad8bda33ce0f006

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    55B

    MD5

    a9bfb8d223d24afed37fca42bb69ab64

    SHA1

    a7a641caee018a02478593a3dc3c42b96673a21a

    SHA256

    efad81688dee26c320d9757ae3147ea8bea62f80172ae13e310f55dc0d63a911

    SHA512

    e0118de7b22091042bfb0c12775506681060cce73e94ca26c16ec91bd0ea6560d990cea630c735d884f40cf3e8a40a9ff3cbc81ac84773a4876955a2653bd57e

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    94de4b9caf35c3a32d5abc8c2b2a1f8c

    SHA1

    88b7e286e8e4240422f0bcaa3d41775313980366

    SHA256

    1e7de0d5868da4b230fd51e46fd40ca4d201aad85a6e2514067a2d7451faf145

    SHA512

    f23dec6d317cc145374fcc3d33402d7791d0a6bdad432ee90e65fe653a4f1d17eca9a827ae75a2ea011e859ef845172c953ea5b3ffb1f925479fbb6b5e106d2f

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    70B

    MD5

    ab31bdf7c0405bc86049bbf08500ac86

    SHA1

    610cbc1bef43cdc73db773aa6a6cfc95adcbec2e

    SHA256

    5ef8ea4f908480e458bcc7fe39e2c4c43801b7461b731e33af33d32aba0afeba

    SHA512

    5e4f28489cf71b00ec8948226c872ed5e4a6b27aaa34aeb855920f289b99664c4d849d2222b3f416f3763e455c9eba246ed30ab17cded91d43acbe002774e583