Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    26-12-2024 22:09

General

  • Target

    3937dc68e6b625da06c11abed258756be3be278b93d1f62cb3655f0f994c2b03.apk

  • Size

    2.7MB

  • MD5

    5ef30f517a903f6f52d6cf01c740d3a8

  • SHA1

    2482d0f8fe7cd7b72ee52be81a11488b05c07dd1

  • SHA256

    3937dc68e6b625da06c11abed258756be3be278b93d1f62cb3655f0f994c2b03

  • SHA512

    9781847420dc07c95bb50e177a34d9f75ce7d8d0f627e4ecd50f35777d4cf83a9a0cb6372787251f0a9645650f68d14288f822febe14cea1565a45f21f9a7451

  • SSDEEP

    49152:Qc36Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQO:53FjEI4iZaUzYH99yId

Malware Config

Extracted

Family

octo

C2

https://94.156.167.73:7117/gate/

https://94.156.167.73:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.156.167.73:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5228

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    9403e1d977642691b5b8d204685676c2

    SHA1

    c466c4f4ea7777652774326a070a281631a20090

    SHA256

    7662530b6c76488028fcbd4984b6accf302fb357b98bfe5c437d9cd332983b4a

    SHA512

    18d2830f2d95a7b8a227b2594011e7ea69b336478f5416a0f781a4c67c33c0ff12f9a07d5df27c9f8a1acbdd2d07bf6044dc1b294dfad309489d7350bf658817

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    6c578e1d4aa5f7d1f09f84ef7b352c15

    SHA1

    fdb85db4f0dd7542ae3000b9802a5fafde214404

    SHA256

    47d9d45295174864fa72d1eace1699d57f8f15b41bd548abf5527e9445f389ea

    SHA512

    99b679c3e9a186dfe469226c5617f3c99802ec15d87077b7dbc2423da3334cfc26a3ef5da19e7e9913de0635351d922af2f378376cb82f4aec3dd327e2bf6a75

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    794469947d21ae4a4ecbf9325527345c

    SHA1

    63354f5b6527ccebd078bc40d861794efbd2da85

    SHA256

    9edd7b907dbfe91cc14dbf1276aec03840ef10d815cc0926e3c6a0275853d158

    SHA512

    ee9f599727e71a4c5eb556976abf5ebde2d25116dcbdbcee5b5c263392659acd0c038e917ac341ab058c2916a679f046234a7591217e563475f4387c014079af

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    35a8da9cf0a2cb949b04d4e82b23e116

    SHA1

    5c0474cdfc419a2cfbc99be2a099f7b556784411

    SHA256

    3e1e6dc7b4630dd8e07bbcc2c5503ebba1a8582273403a3ab9e15afa3967edb2

    SHA512

    965e4e5149dc52bbe0123d31a01ab8567a67b386584c5b5a234ff16ee0bf9c2c40bcdfdd95f8df7d8ce4e7beb264a20459b1d3b1db9902b2b27471692662fd5d

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    4e0b3076b3830eb72f70c979471aa30a

    SHA1

    53cfe2c30ed9c3a1f8634974aac09286076a4baa

    SHA256

    8202bdf5dff2d56056d3766ed40a66f46984eaec193f6b3099adc9794ebcf5f6

    SHA512

    71ece23ab620b08df5c70af9f764b63812abb92206a1c2771f9af6618f860a84a0bb8e2307d7a1efb0d874aaa3dfc7ba9d5afe28ac577fac89c49dddd1342fe4