Overview

overview

10

Static

static

10

a2ce3229cd...ba.apk

android-9-x86

10

a2ce3229cd...ba.apk

android-10-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    14/01/2025, 22:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a2ce3229cd8bb5cc829d34c898fa3abcb05d646c17c0f03e5044e4f2ccbceaba.apk

  • Size

    2.7MB

  • MD5

    e9116b0f208e70c031a45de54ab2086a

  • SHA1

    e9f8755ed185f24e983571270fc86c093c90cd75

  • SHA256

    a2ce3229cd8bb5cc829d34c898fa3abcb05d646c17c0f03e5044e4f2ccbceaba

  • SHA512

    fbcb46a4539b835d5b0a68afdff840eb55221aa76d77eaa2c16c754c3e606588cfa01f31172c7e87b7b941f2c7c87111ed9c148cb8eec0e8ff970637c5ab4fe2

  • SSDEEP

    49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQZ:vhyb0FjEI4iZaUzYH99yIO

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://85.31.47.102:7117/gate/

https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/

https://85.31.47.102:80/builderxxxzzz/gate/
Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key
1
3534353639643261616165373137363333356136376266373265383637333666

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo family
    octo
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.nameown12
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5106

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    142.250.200.14
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 6159
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:01:48 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    www.ip-api.com
    Remote address:
    1.1.1.1:53
    Request
    www.ip-api.com
    IN A
    Response
    www.ip-api.com
    IN A
    208.95.112.1
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 292
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:01:48 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    GET
    http://www.ip-api.com/json
    Remote address:
    208.95.112.1:80
    Request
    GET /json HTTP/1.1
    Host: www.ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:01:47 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 291
    Access-Control-Allow-Origin: *
    X-Ttl: 12
    X-Rl: 41
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    216.58.204.72
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 1800
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:02:13 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 831
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:02:24 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 426
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:02:50 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    POST
    https://85.31.47.102:7117/gate/
    Remote address:
    85.31.47.102:7117
    Request
    POST /gate/ HTTP/1.1
    Packets-sent: 60170
    Content-Encoding: gzip
    Content-Length: 423
    Host: 85.31.47.102:7117
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jan 2025 22:03:50 GMT
    Server: Apache/2.4.62 (Debian)
    Vary: Accept-Encoding
    Content-Length: 364
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 142.250.200.10:443
    tls, https
    1.2kB
     40 B
     1
    1
  • 216.58.212.206:443
    tls, https
    914 B
     40 B
     1
    1
  • 216.58.212.206:443
    tls, https
    914 B
     40 B
     1
    1
  • 142.250.200.14:443
    android.apis.google.com
    tls
    4.4kB
     8.7kB
     16
    23
  • 142.250.179.234:443
    tls, https
    2.3kB
     40 B
     1
    1
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    7.8kB
     26.1kB
     20
    25

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    3.1kB
     97.2kB
     43
    67

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 208.95.112.1:80
    http://www.ip-api.com/json
    http
    328 B
     600 B
     6
    3

    HTTP Request

    GET http://www.ip-api.com/json

    HTTP Response

    200
  • 216.58.204.72:443
    ssl.google-analytics.com
    tls
    1.4kB
     6.3kB
     10
    9
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    2.9kB
     2.4kB
     10
    8

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    1.9kB
     2.4kB
     9
    8

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    1.5kB
     2.4kB
     9
    8

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 85.31.47.102:7117
    https://85.31.47.102:7117/gate/
    tls, http
    1.5kB
     2.4kB
     9
    8

    HTTP Request

    POST https://85.31.47.102:7117/gate/

    HTTP Response

    200
  • 142.250.187.194:443
    tls
    135 B
     40 B
     2
    1
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    142.250.200.14

  • 1.1.1.1:53
    www.ip-api.com
    dns
    60 B
     76 B
     1
    1

    DNS Request

    www.ip-api.com

    DNS Response

    208.95.112.1

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
     86 B
     1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    216.58.204.72

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nameown12/.qcom.nameown12
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    230B

    MD5

    08b87cbd86dd3952563e6dde6066b84d

    SHA1

    4de5faa266cb040cd4c09f66d2f286e5c70292cf

    SHA256

    401def23935d2fa6eb6c1dfc2f261489d33f92e105fc0340f29a74018d99d41f

    SHA512

    900514a2c424804ae3ecfaa1e000d734d39a4e0bec5e3d3e47707cd50cae7d6c11b2773d99c9f250502772052e315dcc7f2f311438a7d91541ea0e7dc250b280

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    54B

    MD5

    5c0d4c556e51cd1fee2e493c7e8b6132

    SHA1

    17b3b6771e15c9df4f9de06b02f0471f3a482122

    SHA256

    ea9d53770b8c4b83fa74ea7755161a45ce35cf4a58f9e5e9d666a5bff958a1be

    SHA512

    a89651e35bcb3a4276686bb8227824439d7f68cacafa9ad64fd277cef5a1e3beafc860e8b0b08f43c53b4a15ae18e8df990d9c42fe4dc4d7f4dae3232d9f02ee

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    63B

    MD5

    5c3b4eb4c4ae06eacca773b151c2059b

    SHA1

    ad061a7234241ece325a9a5279ef984aa0899911

    SHA256

    2b4c65438f739e1229010c68804de1737420c96a151687e865d706c1a9daba3f

    SHA512

    8968787cb7f669048c2c134de7d01ffb6584b17d59fe2bfc2f8ff153fe58ca298b98171d9be20819a6aca1e4de63872ebf591f39bd9f9676f7d7924289617751

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    45B

    MD5

    d7e523b920b76c85ec645400b51e10af

    SHA1

    e239dc974bf9c4e4a5a78b9f92624e0d52c5fabc

    SHA256

    ce6643aee210c87b27ad736dfbb54f84524b7422c117a8e52221ee628d53956f

    SHA512

    53945fa5c3f950fcf7fae5712a0d73d6381a1390c2609c4db669b4d86361be1ca997a568ed8cc0d9338629b7db8a766c65d701821e4cca2f8c27bafac0ecfb2f

    Download Submit

  • /data/data/com.nameown12/kl.txt
    Filesize

    423B

    MD5

    b82396298dbdf4d76fc9ec5df9d9f3cf

    SHA1

    90c9c69f6d4761491e1cb8e3ff7afba665a82dd4

    SHA256

    debaf5fd46600352d08460c8bb5214b588746b15235a6851b9c04733a6eda6e2

    SHA512

    962854721ccdceca45b4247c490d928771e2a4a664d15f64eba372c40bffbbec7f781a85a3f845c84d9365867924bf0e59197e30417f0158bd27b585853e1552

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.