Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    11-01-2025 22:10

General

  • Target

    90402c8ccf7bdc01f93c96bfcd37da8bf00daf956418c6696d79d7994808fa1a.apk

  • Size

    277KB

  • MD5

    70cca44bd24fbedbc00ad10dcdafd9b2

  • SHA1

    5052f249f6961d0addf47d71c207c84f4d8d5ee7

  • SHA256

    90402c8ccf7bdc01f93c96bfcd37da8bf00daf956418c6696d79d7994808fa1a

  • SHA512

    0e4b9772a03f36a41f7bfff63c158d9e7249ddd980fdafbcbd6fe81af100e74e37595fa5207d5c9f520e8fbedd424c1aa81bec21fb03c4b562512a417bc0c048

  • SSDEEP

    6144:CSc6Rg0LabNUpr9nrOgEKsVhiyXZXRtulLu2/EuGLI9:Rg0+bN29nrREeehs/n3

Malware Config

Extracted

Family

octo

C2

https://pbvtckjkrtht.top/YTZhZjliODdlYTI4/

https://rnhzkyhajtsf.top/YTZhZjliODdlYTI4/

https://wahdoyodlydy.top/YTZhZjliODdlYTI4/

https://wqfjxyfuxpeg.top/YTZhZjliODdlYTI4/

https://cowogbebhxom.top/YTZhZjliODdlYTI4/

https://tagfcatwlquj.top/YTZhZjliODdlYTI4/

https://quxvuqeomtbg.top/YTZhZjliODdlYTI4/

https://oxxurakyfksv.top/YTZhZjliODdlYTI4/

https://wfyyzhqbhhwj.top/YTZhZjliODdlYTI4/

https://dmudkwwdjcnp.top/YTZhZjliODdlYTI4/

https://xbqkahsajzkx.top/YTZhZjliODdlYTI4/

https://ukzoizxunhgo.top/YTZhZjliODdlYTI4/

https://aieuvtzzbnln.top/YTZhZjliODdlYTI4/

https://ilgupmccyrws.top/YTZhZjliODdlYTI4/

https://wowkgijjronf.top/YTZhZjliODdlYTI4/

https://oxtggswtiswa.top/YTZhZjliODdlYTI4/

https://nilvwdxwjdnn.top/YTZhZjliODdlYTI4/

https://uxdcwenwowwq.top/YTZhZjliODdlYTI4/

https://tzxqvvayaqko.top/YTZhZjliODdlYTI4/

https://jdjluacmbmgh.top/YTZhZjliODdlYTI4/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sgakagak.agakagabs
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5252

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sgakagak.agakagabs/.qcom.sgakagak.agakagabs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    db4ca8c44ec6be0fc2a5d468d032e2d8

    SHA1

    aa2df3921886bddad3894849e01bf7ca02401b52

    SHA256

    29961a8dd11717ca3b625c6d335ae4ee497596e545414034996b8699ca2ecd5c

    SHA512

    3921dec68692db80e7714ddb73f26abdac87194e0c0dc1faf6c837dbfa403a94d9f5c291e02ba88fac187223369d2743ccf5ffff43ee1de702befadc94b054f9

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    54B

    MD5

    f509c57841105fbe28a0eb4359533fe6

    SHA1

    a462b3af16c5b5cf8bb63ac836b4b97dba6d5c79

    SHA256

    fd51bdcc709999c88a06a13fe7a1a13bde958ae31c420f3f5a4367ba8b2293f2

    SHA512

    108741f921c5d8d9f82a884eaf47498dda29b80df8170b4bc0895a702b2214d2cfae84e485146727e0f83928a826cd0f8bbf93d8f0e4c8f4bd0810f99bfc72e0

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    63B

    MD5

    7aeb0674ca16640c0097a6f4181df5aa

    SHA1

    4287801f3eb522c94596b39dff357aae45c3deb0

    SHA256

    ce6739edf7a535cd513b259145e6eb2ea80beeb957b58c1deda21349712015f4

    SHA512

    eae37cd80ed40b147fa083d16cf4f1c7b2a6d4fd52a72c5b5d2056340f915bdaf78c683d332a9fe4c0e347651fee7d9855186ad9a8f800626e034f29c9c5dab2

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    45B

    MD5

    4587b9fbcdb26587a7bef58edb635f84

    SHA1

    1a6afce6db3afe9a0176b9116ab8f439127dfb2d

    SHA256

    50c6cc5f05ff5efceae7f93b4c540e2e7ea51b2ffb0f1eec583d2fad60055a96

    SHA512

    f476ce35cfdae71488b55db21a7ead1df26ad30b059a128a2c24612be3af7f114533bffb46c78d56163359cd7794211b04aef96d9a6c712a942ab9ce934ed586

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    423B

    MD5

    acc53871dda98ba7a388c5076938ad3d

    SHA1

    6c3ef1e19af773ffa21be6630272693124f50484

    SHA256

    51ccd9a0da61e825b7e2f69e81a4b80c4a2ff922cffac290ac9a6e441a60a277

    SHA512

    7ca86e8abed047f5bedf3bd910b086568709dc208c7b41ab2c35da6c3a942e5f1b7ea8929e0b8a2474ad4162057313c2f25bf45a134e110244253e7a14001dcc