Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    30-12-2024 22:05

General

  • Target

    8572788823547d16570791c5e895db960be5f10dc18e53be5abe85bb75eef163.apk

  • Size

    2.7MB

  • MD5

    c50be2d99ca62991f87f550620a25419

  • SHA1

    a4423318c330e7c8e59841ae243550d40f7ab90f

  • SHA256

    8572788823547d16570791c5e895db960be5f10dc18e53be5abe85bb75eef163

  • SHA512

    52fad894dbd5113a00139562169a16b74f4e22181ce1b46472ab9969d96292edb3840562eb9f64592ea4999172547167dfd756d4b378fd74bd83309165cb0dc8

  • SSDEEP

    49152:KFmU6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQo:KFmUFjEI4iZaUzYH99yIx

Malware Config

Extracted

Family

octo

C2

https://87.121.86.196:7117/gate/

https://87.121.86.196:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://87.121.86.196:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4787

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    84B

    MD5

    2c447f7354c8c625f82c5b74805e14c2

    SHA1

    904e2c4942bcc1f3d2fd7ce996ac058ce9b8c182

    SHA256

    87b3cb2c9660aaf8a3d2740d5be68efd1cd0df20a1be7eb103caf6c744b546a3

    SHA512

    04b97921fd85adbba4ba2a385c10f1666c43f3a6f49950e3678b56cd60faaa89068ce44dff5f6a6458b2c9bc571b017d8cee2b8b9aa671818ac2af720a46fab5

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    68B

    MD5

    1eff774ed2b63ce09334484d96117c04

    SHA1

    1c4df1edee652207d63cdf00d1aef0c5b74f9068

    SHA256

    1a39fca25730ee58edf55abeb85cee12adf99f91799f92da4fa010f3e6c09638

    SHA512

    cd99f838bfe55c5965d463c2d32697613f98b954ac70f5a0890ca3a33cb2cca3a4e21322b0e3122aed54bb337636bb7a113b416fbeeae77cadf4b66b5537e691

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    af9e94f269333a8fdb604602d9c61358

    SHA1

    1dacea493c5399aa3a03a10c0a4812bb52455c16

    SHA256

    f673f299f0b10fe45a7054289306b808d6b1dcc76cf9a794a55c687e68074406

    SHA512

    67ac39755baf5d1b382209a23a0f25f099e919b84f08c471a0694f4a780bd3162c260278d1a265a6e19945e7fcf4d1f6408d19ae257cf0230a6fbe9246a0c27c

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    5b0b4b1b2bde5e7e0b0fabd3e2e65efd

    SHA1

    965a7935a6e9afc77bbee3e06ab8149449043455

    SHA256

    aa191b7a56cdb2f3556a96921ba95933f187f4f997d45e92e223b715a7ea7985

    SHA512

    5bdc1b6bd72681929481bb87170d4181756263e63eb3e651ae1cc9a14d1ceee94e671e4bb285130c08e31cc38962bea69e500155c633ac369184abdfecfe2649

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    ac30b3bc9409d8234396e3d983dc6bcb

    SHA1

    86c140811aca6f752f5605603ded9446563f536b

    SHA256

    ff644a351af86983b39b244b2b601b4d20157dab1c25c019591c84028190fdca

    SHA512

    6c9d9eaf5dd4817a26061df7c1cd871618a1879774ac7e7db0aaa5c9d72e31df7908b5d8261a7342d51c226764b8acaebf34a476ba184657315ce11a5bc2f3a2

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    c88c2bc7e9cd635d11f6d88169e4ff63

    SHA1

    f59c5ba8bcb3ccb359fb0a791ce5655b42668c03

    SHA256

    72dc6d232f4213fc97e89f0ab95b479f7a62bf2a138e45dd9533bc85f78d1312

    SHA512

    9ad260ce5cb5088d18d167fd2208f92932c80ac1e720fdd71cabef15c21ba07fe0e1bdd8873b100d1cd75d3819003eaab6ad8e126a5024beda5e27c61f4c0138

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    466B

    MD5

    d02cfdcd0bd60ebcb2f3a911f049df65

    SHA1

    8f1e5d734b58f2a3451d51e7ab7e8901de136e78

    SHA256

    0b67bc19160232733c04878abf55dae364dd01f459b4243235f8ac337b78a52b

    SHA512

    388e64d740574f1b6c3c75b6b9a4c57a0800f14edb1ca7d17dac5d6d383b311b5dbf3839c27f54731cfc3409c867fc68a325e57243e30a913d8987cc55d87a98

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    627e08f55981bd56ddfa932abbfab116

    SHA1

    62507018426f9826f0e26916c63bb0cd600cf330

    SHA256

    ecef70741b87aea78a969ba3df9588f1cc768d50bc19f5e7eda667303cf3d95c

    SHA512

    c03281c25a482aabc1b4bddd9d9db5c0a33635cec29a2d8ab371418d8b3ddf09f98796847c1bbd650bd0d346912bc32fb07e01b7aa7e634273e7dd3e6e9cfe68

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    66B

    MD5

    4e39a90818badd287bdc24141fa81195

    SHA1

    e65ea57e0bec1477d826e94c1852e3319fd9d3f8

    SHA256

    af4888010107a0ab30e876ebf4930c5ee17241c4b923076fa6bca80c8804a8f6

    SHA512

    5498616b9a7505838c1c3ec6d80f74b974bf82e34010f664e3c8c2ee40dcaa3358bc8de88a7a2911fae2bfe5bda265c403ef6b5a85ea17485e3b6d5969242f69

  • /data/user/0/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    719f1aa07da7f4c77f52192bc97c8f6e

    SHA1

    99faaa57fc0f1022aba73af3a6c2ba3877aade6b

    SHA256

    1204c5d4960bffecd3a287ea7aa1407fc1d8185b1aeda67d348275f9ed1f6274

    SHA512

    eaa457577fc4e33b552f72093648d241c5162a011c44fae711f96df32cc716ed281fa939b32b0e794992fc859fbf0ca954b21061ece630e1a6d38adca180cb36