Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    19-12-2024 22:00

General

  • Target

    37ab8b4cfbeddadb846dabf78c252414dd6f1dde55ec0b38c824d357f3764a62.apk

  • Size

    2.7MB

  • MD5

    55347ea81a1cb4d8b7c0770d3e963db3

  • SHA1

    e8bfa0a1ac79c41e9b18c564b606f5c62bd1566d

  • SHA256

    37ab8b4cfbeddadb846dabf78c252414dd6f1dde55ec0b38c824d357f3764a62

  • SHA512

    7b8100d71edbee9a8cb794c9a7f01ebdfb371c426e9e2a7a7411c08b2eb9183e25699685babb7c27cf6dd29659c202f39c87f395ca56fb8e2750fbf73d3a0c54

  • SSDEEP

    49152:Qc36Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQA:53FjEI4iZaUzYH99yID

Malware Config

Extracted

Family

octo

C2

https://94.156.167.73:7117/gate/

https://94.156.167.73:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.156.167.73:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5071

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    bd75ee3c3e7d3f473d8f2de88b57b053

    SHA1

    fafaa5681aa31dca48ea50d944c6d54c6a40e7c7

    SHA256

    953ba2ded6fd9aa820970c04fb3ae76c8a21918c312d36456c7a30caa4cdd0cc

    SHA512

    f5179b1e042f0268aff00fbc1d94d5bd90d8200f75b2628089f829e275cc23a6ca43fcd37d6c6dcc271b0857af9be6a749be081a7dd03c37e4902c890a2ddab5

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    c07e906bb6c6f9316cf61c80f61ff97c

    SHA1

    47b7b4efa4508a65dd7fd2bd545e2e53e5de9db0

    SHA256

    1d33a3c3e49e82cce14ea59ecc9a114a1aad943c84441d2d2f8d5543112dc533

    SHA512

    809a7715f1f241bc9c54497c4264cc0762763eb6c04a9541bb9832a65b284336c0c41b22ed8fadbda57999159cb4c2ce447871af3e63c157aa855997d0c612d2

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    9cb5682e13f9571412969b8c32001d6d

    SHA1

    d963589c7d534c6d63c9e40786c4efb7a7a98455

    SHA256

    e4082bb10984dcc47d813dd96b8074e785a40e2a2f0e619596014f943a9f3162

    SHA512

    93f51a80df38590756a05683bf4bf625bff1b07da4e446ef78e6938eeac7a30091cb1675a674eb78223db66412b2ad705fedafbc1898a3f3e23c65268917dbb3

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    e5be3ae7f50f57df1a22fe0f13e5ab83

    SHA1

    42f0b455be91d14477a947dd5b43449c2a49b48e

    SHA256

    674c729c4f2de001024ceb0c06e40087926aac2b1fe82c3e1764c9117a97da02

    SHA512

    d1b18956d612f5ed1408492bf76c2942eb202c276d9c02f95013b76be6f1e5d05404e67c18abecda39a21b5836d1874ba5627525b57780fe433abc7623310f23

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    be0cc0abc638d3365e79284ea7209181

    SHA1

    c65d774c34689fad46e35e78c1cfdbc2d57b9b45

    SHA256

    3ca6a8dfd453bd2765148278b4849b2250182a476bdaf0e3995ee1fe79e59077

    SHA512

    2d78b0e426e85164fea00659dd53e0fbf99d795794b0d619cbce148111557079a11655cc09105650cc382ad9714a0e44f1c1d91918f4063095f66553fd6967f5