Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    13-01-2025 22:02

General

  • Target

    c587e4beae7fd5612e0db85a45a304c0246d021bf244f7a5db481ff3bfffcb53.apk

  • Size

    2.7MB

  • MD5

    17ca9ce272a2f06ce8506e1eb63f8abb

  • SHA1

    306f0223f47d64d9bb0956647bac82e38a68719a

  • SHA256

    c587e4beae7fd5612e0db85a45a304c0246d021bf244f7a5db481ff3bfffcb53

  • SHA512

    43c0b819817d00e2788b219e8cfe271c2cc5c1c1be6f8c29f21288cabd34772bc3bc2de880e1b93d6876139605bab1cc670199d3ae155bf85fa0969049cc4897

  • SSDEEP

    49152:IAI6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ1:IZFjEI4iZaUzYH99yIw

Malware Config

Extracted

Family

octo

C2

https://94.103.125.53:7117/gate/

https://94.103.125.53:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://94.103.125.53:80/builderxxxzzz/gate/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5098

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.nameown12/kl.txt

    Filesize

    230B

    MD5

    dd70be84d69385c2e8d8b3f6de4d556c

    SHA1

    02d8c58c56bfcfb54bce49263669470f371cf69d

    SHA256

    f4252bf7139a79d174d4969aa25ecec5f5164427870ea833b0f48fc000d19eda

    SHA512

    11271013f0af698f375e8be0dc309af5544a7ca81046af47e776014521f6fda7bafa23e96ba07af14d18bad43d43d0f51523978b5df95fd3adc8c6ab67679ed0

  • /data/data/com.nameown12/kl.txt

    Filesize

    54B

    MD5

    c6ad150be6b29a971fb696519a2eb8e8

    SHA1

    f07a34c2c017a94b56a342036608b73185b55c2f

    SHA256

    08f5b8c9a7ebb7a5e2ef7444ad46925ffd25fa99a9cca52d3cea569509f06ed6

    SHA512

    57880a3543bddd76e56a2690729c2c61ab486927fc8425b8e895616de1f8427e1b359ec70f2bd1cdd7710a118908e47aaaf1b549a558344098514364bf8351df

  • /data/data/com.nameown12/kl.txt

    Filesize

    63B

    MD5

    8591cd6a0ffacde6cd68143713a6ad13

    SHA1

    cc9cbf9bc255d2a2ac7de7cda24d7267b4290b6f

    SHA256

    79133a2da93dcad60ef5987dcfe7d5d9da66fec8022a8db1e45682b1ccda12b7

    SHA512

    68a79da7064723093466416410aed180cd78a9ae2849471bea4b201904a6f5c0ce8ff6e96751f21554ff13eefa893c3fe52da7d5e857c7ca1bb95a2207c57f3a

  • /data/data/com.nameown12/kl.txt

    Filesize

    45B

    MD5

    5939921ebe6e0407ed87c54fafc273ea

    SHA1

    c5294ad6b60fe302ddc12dc28c510357de1119e3

    SHA256

    90379f0ee9019e810a9f03fde02eb03ffffd7457d3d950a94a3ecc3ebc40db79

    SHA512

    2873045559fec356d80b9732cc865cb1a75ce8b557574c8c67204de4bdb24745c8a3e686c19b2370c6464ca1f6da624ec1a667a0ff6edfc9538d895d71cdd8ef

  • /data/data/com.nameown12/kl.txt

    Filesize

    423B

    MD5

    59a78091e8e20c4c2a6be5b482780a5a

    SHA1

    84bbc8125196544ff12f7b29fdd8c8a6d0011d8e

    SHA256

    3c356e6139f2add89bbdaade04a65f03deefc6e02eee8aee0abc4c093034b7a5

    SHA512

    c113e25174c4d0a67180023325266b2623af7a8d34666c8cc576acccc02ac07b9fc84d7ed6bc559155092b97cf0541ff5f2a015ea138f9e6445b5f3c4760e371