Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    23-12-2024 22:01

General

  • Target

    3c8aab0aa12e4a677ec74eca96c1340b7b5ce0a6112657890fca143cdc4d71fc.apk

  • Size

    2.7MB

  • MD5

    29100c93099dc4b0266e30186c1fac7f

  • SHA1

    051afa453bffffce8a12056d7f715b40e61e5314

  • SHA256

    3c8aab0aa12e4a677ec74eca96c1340b7b5ce0a6112657890fca143cdc4d71fc

  • SHA512

    5f30483dca700c0789ab34395106d15b1c5810d317d00136f53e93c97052301c4680a562bfe2182200a5c02b944d12092bdf84c7ade2bcfbad7d8b20bdafdefd

  • SSDEEP

    49152:Rkdz6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQR:RWzFjEI4iZaUzYH99yIK

Malware Config

Extracted

Family

octo

C2

https://87.120.116.233:7117/gate/

https://87.120.116.233:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://87.120.116.233:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5060

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    e3d763f7535922aaaa3984b4d5ebb32b

    SHA1

    5a572e204be7bd47beeeaddb240d6f1c2ae8cd43

    SHA256

    7c0f277fdad840eb8c2f1122c7bb71f36965deed01ebc225153a00a527dcc14a

    SHA512

    12d2532dc33129a59ed24164e55c54e7f1112b91291aaaa5e73c6c05df1fd547cef4937d1fd78a40edb21deed2aa8888751f7a8e616877a9a21248ab09fd9d90

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    8ae47e8e077535c0f15499e91a35e65f

    SHA1

    36c806698351cb3e5d5366ad75ed8fede3ed3f0b

    SHA256

    e97b2d5484a395bfd495350fb54da67deddb45d232e14ba5dec8a2ed9c468f3d

    SHA512

    d4c11a68d4256a5e6b159c114e7b10a0199bcfd4f57f7f22e49dc6654937978e273390257c0dad835798aaabb05c6cec37ef34a6ddb38149bf4b6110eebc47f6

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    0eeb911143b710362ceb38ee44cc7dea

    SHA1

    7c16f84bb8c6df39062a664909887737c9a0ae1d

    SHA256

    5fff4b38fb646b962876ac170cf6a4ea0c6dd0b95190462e6b1edc19152ea54f

    SHA512

    68e408ff39442b60a35bee9e150930e3a9bd2fd4530351d8935171a7b06da0a852d2428d4018a31055682584dfb2208fc20340f3a58e75334fb824eee080db62

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    bbe7812d8388f3e476773cb8fd447c09

    SHA1

    f10111e1ab9aaf407b9c1b5407f13eb9fdb8a527

    SHA256

    649f6b1b8f60484e539f1445a45b1eac04419858bd347915ef02e8b08734191e

    SHA512

    2a6779bfe13cf29f60cc73ccbe4c0c0e523ab91a0be14faa4294bc9dfe2c39925e7049eeb6f1e88e778179284fc729c53b8d889fe225f89798af6fc0dea43037

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    6d265df26c944564c459aa4fda78e3f2

    SHA1

    f77c189e468d2b969ec85d0683242a022d3d1533

    SHA256

    3610fad8691587362e68a3898b1a83cc9bace225a9442a88b3c86c6781232672

    SHA512

    0b80579e8d2c0b9d354e8c27514b3de41f136f3db861929eef094e0eb7b44dad19ce16923811febcaf7e86b7ef9595d59e564e2d68fc7bf774e7f62997271106