Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    04-01-2025 22:01

General

  • Target

    7dbb4e2e21dc00e7da6b804aa05eea80649a7816b607d066c87b846c58df50a9.apk

  • Size

    2.7MB

  • MD5

    0d506d7182265dfe74db3995de95841b

  • SHA1

    7964a7e5ae8dd10b9fcdae53144d5c261fa7df44

  • SHA256

    7dbb4e2e21dc00e7da6b804aa05eea80649a7816b607d066c87b846c58df50a9

  • SHA512

    fff2e5bad8137a39e959f2e537080073d3bac25915af0cc9e7b10018e1f4c3e5b83bc89f1bc9b66b73427af805147f4d4fecc14a11c3ba6ba003e9d3cc0f9857

  • SSDEEP

    49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ+:6oQrwFjEI4iZaUzYH99yIx

Malware Config

Extracted

Family

octo

C2

https://93.123.109.166:7117/gate/

https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://93.123.109.166:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5060

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    dbd10bf23d555176baa91e8cc7b10bd4

    SHA1

    7747e1137e7609a3cf4225029bbc1474e145a979

    SHA256

    885ca0a536d40aef6122875fca9e55970aca220cf47b50815028d27b69162c02

    SHA512

    df95a6106c3ad92acaa18a516cd16ea07328296ecd4a364e6cad1f179134de16b2852fa74911a512e63aa1a2429c8c49c6358f615604510b26a73d7477310590

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    b8b9b2a6e25a750b5ca556d1dec96c49

    SHA1

    ff5c8c01a786fc728437c6d444fdf5c8785f6802

    SHA256

    93bfd6b077879a2bd9b7836578691af624ca5dbf98beed32dec856e92af8a435

    SHA512

    2a26ec49f28062082a720487335405993622d9e9cd9dc03e5c7e8d494b00cddb5d2a820ed2ae010460a2c0bf06e0998af45ee10ef23cc5f70bd5db1686165825

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    139159705c4260b4b493e20b8ac1010a

    SHA1

    80a674ad6fc464b335bec9cd0e91b7019fbb0e8e

    SHA256

    8978fa292f63668ee35b0ddc939a674303063394ec0aa3ba728e7f4ba2dc45e6

    SHA512

    844fbd390095b5dde5e87d0dede43e78f484039568894beb78a86455d530a2b58a722ae263935f3db8698e73462314f5cdb263b02be000f7a9ec6603b5c1f9d1

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    dee3509e17d490474f9c938600290147

    SHA1

    8b3b0a9bebcc5312f7ee3a1ba705eb7c2e1983bd

    SHA256

    18287083f441eba9ba778e0c933d080d4060456a378341f83890d86b99fa4e7a

    SHA512

    acdecd88aa88cad8397746c40365f576298148fc151b1f2ca374b8396a01281ead3121df5215a0ec2cd844d1463fa5f7a91662e9f853c4cbcb7c6898983cf09f

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    595ee9c2fbb38378090de7e7d60dddc6

    SHA1

    d6eb651def1462ec88a7716280d1baf0e524c904

    SHA256

    bef42b3bb0c6fd491b1aa4c49fd95ed72a88d13a033716b8e6db062ac9c75174

    SHA512

    fe23625399d45144905e4f96f29a99fef96670693462d1bd3b16b81a5c68f5dd4fb360e50f0ccb8cb8665233f3ec6e9995b98b79e6ae6374bed7e560ecac62ee