Analysis

  • max time kernel
    41s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    02-01-2025 22:01

General

  • Target

    77928044dbc1d642a68cfc170a547e11400b4590bd7f8ce8a2e0e06f14b59e30.apk

  • Size

    277KB

  • MD5

    f9e8501f61aabcc55d867ba8d51ce624

  • SHA1

    2c2dc1c7d48374985379e6a8b68aee52603b5256

  • SHA256

    77928044dbc1d642a68cfc170a547e11400b4590bd7f8ce8a2e0e06f14b59e30

  • SHA512

    d29499aee470fc5c48a53a61543323af8c5bb4a34ecd01719a6eb894901d4b02ffe7b0cab99f260f9e6dcc802b9e761752b2cb56964b33bb2589435345ed51b9

  • SSDEEP

    6144:tSb6Rg0kaYNU7rsZ7QbBKrTyU+kiyXZrm7Y4cd5nlSfkwo/EuG82:fg0VYNosZMVKvybermcdfno+nb2

Malware Config

Extracted

Family

octo

C2

https://skylinejr.top/YTZhZjliODdlYTI4/

https://forestnx.top/YTZhZjliODdlYTI4/

https://moonlightvg.top/YTZhZjliODdlYTI4/

https://seabreezehf.top/YTZhZjliODdlYTI4/

https://riverflowbd.top/YTZhZjliODdlYTI4/

https://starbursttc.top/YTZhZjliODdlYTI4/

https://wildspiritzm.top/YTZhZjliODdlYTI4/

https://dreamcatcherly.top/YTZhZjliODdlYTI4/

https://goldenpathrw.top/YTZhZjliODdlYTI4/

https://sunbeamfc.top/YTZhZjliODdlYTI4/

https://stormchaserqt.top/YTZhZjliODdlYTI4/

https://cloudburstkp.top/YTZhZjliODdlYTI4/

https://nightshadewm.top/YTZhZjliODdlYTI4/

https://earthboundxl.top/YTZhZjliODdlYTI4/

https://fireblazeqh.top/YTZhZjliODdlYTI4/

https://oceanviewjk.top/YTZhZjliODdlYTI4/

https://silverstreamph.top/YTZhZjliODdlYTI4/

https://mountainpeakyd.top/YTZhZjliODdlYTI4/

https://blueskytm.top/YTZhZjliODdlYTI4/

https://greenfieldzc.top/YTZhZjliODdlYTI4/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sgakagak.agakagabs
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4933

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    a7c43363cada4a869959dfcf950c4271

    SHA1

    08e3502c93fc0e80649a2b9a163c770a99ecce72

    SHA256

    7730cc2812e362fe0028fba9a2f54fdb25fa079f5a6ed82e869abd6f1a9dd8c2

    SHA512

    9cf4389b8ee9497de59bce6d5d4578816f8a952628a2e8d3440f865eb75d276c18792d8e1a71d3f4c4a44af2497165e4c9595031a321f2efb4b22ea87b97bfe4

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    60B

    MD5

    b52a508c3c5f0c77436458a9d438756a

    SHA1

    bfbd2943f0baef8538c139583d7d39da2ab9565c

    SHA256

    2554c07d5700919f0e2ed4c63f19f986cacefb969c53dc49a1302e958f88d797

    SHA512

    8ceec4c65b1ed349a7b6a3a6e690dcd09c45a060659affe1d5dc4f9b0591df1b709e9000d24ab5e8d9751ccb04d98c6daeb86c0ceb068a358a1ca98328970cca

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    68B

    MD5

    152c9ed50ab7ba1668afd05d4469b9fc

    SHA1

    741d84df4f21585eca5f5e58956ac80d54ec89d5

    SHA256

    4cca4108b05879e6cb6dc380d3d1268b3ad7129ca1a718d4586f8e3c638ac656

    SHA512

    b3f6384a8a4fa72f621c6df11e1f6aa33df215ca258e8a34b5dc18f0275683daa0de07ef65e3f3b62c25426a9a53ea7bca4c77a0961328815101c0e6a5c20434

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    deb7ce2dd69817678e7604fb007e8394

    SHA1

    f430f399bfc468594c4b29d74ae742bd65bfd23a

    SHA256

    cad3c1412f3a51d22316ff081c33dc1f92db464b193c307f3d9557b70cd15c2d

    SHA512

    bf4f1e39afef94c4877c47f828500369bb5ad4fd5c3575b04f0a879e4a7d8b188c2ba12851ff4daee8f413b6b66f4514a0b5ecb324734166dca91a7c7f25d057

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    68B

    MD5

    3ca52c6aeca00d1c8d6ae0680f8e5f6d

    SHA1

    3d45bb74a7ffa3c27e7d7bab2a1c149f36c23c5d

    SHA256

    2405aa6531a250bd2eb192c3e2d712ef63eacd83e847542ca221f331e216e01a

    SHA512

    61097e3fcc903ecd5479a07b4cf0d14bd3926750db7453f6c86f9da13964723c33840521044318d5aa42d6d091e3360ac2cebeb997a823a832a700de034c71ec