Malware

Oscorp

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Questo servizio si occupa di collezionare informazioni generiche sul dispositivo, come: Le app installate Il modello del telefono L’operatore del telefono

Initial Access

1 technique

T1566PhishingEvidence2

stock_injection : Save the injections (phishing html payload) provided by C2 in the Jedi / Injections.txt file

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

run_application : Run an application

Persistence

3 techniques

T1546Event Triggered ExecutionEvidence1

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

T1546.008Accessibility FeaturesEvidence1

i malware per Android seguono tutti lo stesso copione: inducono l’utente ad installare un servizio di accessibilità con il quale possono leggere cosa è presente e cosa viene digitato nello schermo... Questo malware non fa eccezione

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

Privilege Escalation

2 techniques

T1546Event Triggered ExecutionEvidence1

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

T1546.008Accessibility FeaturesEvidence1

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

Le stringhe ... decifra le stringhe ... Cipher.getInstance("AES/CBC/PKCS5Padding") ... Entrambi i parametri sono cifrati

T1036MasqueradingEvidence1

This usually takes the form of an imitation app or a WebView launched “on-top” of a legitimate application

T1070Indicator RemovalEvidence1

delete_message : Remove an SMS

T1070.004File DeletionEvidence1

delete_message . Elimina un SMS. delete_application . Rimuove un applicazione.

T1497.001System ChecksEvidence1

Le applicazioni che contengono queste stringhe nel loro nome sono disabilitate: security, pcprotect, totalav, clean, virus, junk, malware, anti, guard, boost, scan, trendmicro, symantec, protect, avast, kms, avira, eset, lookout, drweb, cleaner

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

Credential Access

4 techniques

T1056Input CaptureEvidence1

“The Overlay attack is a well-known technique implemented on modern Android banking trojans... This usually takes the form of an imitation app or a WebView launched ‘on-top’ of a legitimate application (such as a banking app).”

T1056.001KeyloggingEvidence1

il servizio di accessibilità permette infatti di: Abilitare funzionalità di keylogger.

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

T1649Steal or Forge Authentication CertificatesEvidence2

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

Discovery

1 technique

T1497.001System ChecksEvidence1

Collection

4 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

il servizio di accessibilità permette infatti di: Abilitare funzionalità di keylogger.

T1123Audio CaptureEvidence1

screencap . Avvia la registrazione audio e video (dello schermo) attraverso WebRTC

T1125Video CaptureEvidence1

screencap . Avvia la registrazione audio e video (dello schermo) attraverso WebRTC

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

La comunicazione con il C2 avviene tramite richieste HTTP POST.

T1090.003Multi-hop ProxyEvidence1

Si nota l’utilizzo di due server STUN, utilizzati per aggirare le limitazioni dei NAT nelle comunicazioni peer-to-peer.

T1105Ingress Tool TransferEvidence1

All the injections payloads which consist mainly of HTML, CSS and JS files, will be downloaded from the C2 server in a specific directory

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

La prima è l’invio degli SMS al C2, all’URL /app/device/sms ... Il ping contiene le statistiche di uso del dispositivo, oltre all’id della vittima

Impact

2 techniques

T1490Inhibit System RecoveryEvidence1

le azioni di queste app malevole si “limitano” ... al blocco del dispositivo (inteso come blocco dello schermo)

T1667Email BombingEvidence1

forward_call : Call forwarding through the code *21* + number + ##

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cleafy labsNews

Jul 27, 2021

Oscorp evolves into UBEL: an Android malware spreading across the globe | Cleafy Labs

Android banking trojan that performs overlay attacks, steals 2FA codes via Accessibility abuse, sends and deletes SMS, forwards calls, launches apps and URLs, downloads phishing injection payloads from C2, blocks apps, records screen/audio via WebRTC/STUN, and can set itself as device admin.

cert agid gov itNews

Jan 27, 2021

Oscorp, il “solito” malware per Android - CERT-AGID

Android malware that abuses Accessibility Service to steal credentials via phishing injections, capture keystrokes, send and intercept SMS, make calls, forward calls, disable security apps, collect device data, fetch commands from C2, block apps, steal cryptocurrency by replacing wallet addresses, capture audio/video via WebRTC, and steal Google Authenticator 2FA PINs.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Oscorp

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Questo servizio si occupa di collezionare informazioni generiche sul dispositivo, come: Le app installate Il modello del telefono L’operatore del telefono

Initial Access

1 technique

T1566PhishingEvidence2

stock_injection : Save the injections (phishing html payload) provided by C2 in the Jedi / Injections.txt file

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

run_application : Run an application

Persistence

3 techniques

T1546Event Triggered ExecutionEvidence1

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

T1546.008Accessibility FeaturesEvidence1

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

Privilege Escalation

2 techniques

T1546Event Triggered ExecutionEvidence1

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

T1546.008Accessibility FeaturesEvidence1

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

Le stringhe ... decifra le stringhe ... Cipher.getInstance("AES/CBC/PKCS5Padding") ... Entrambi i parametri sono cifrati

T1036MasqueradingEvidence1

This usually takes the form of an imitation app or a WebView launched “on-top” of a legitimate application

T1070Indicator RemovalEvidence1

delete_message : Remove an SMS

T1070.004File DeletionEvidence1

delete_message . Elimina un SMS. delete_application . Rimuove un applicazione.

T1497.001System ChecksEvidence1

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

Credential Access

4 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

il servizio di accessibilità permette infatti di: Abilitare funzionalità di keylogger.

T1556Modify Authentication ProcessEvidence2

switch_sms : Change the default SMS application with Oscorp

T1649Steal or Forge Authentication CertificatesEvidence2

2FA : Launch the Google 2FA app (then Oscorp is able to steal the codes abusing the Accessibility service)

Discovery

1 technique

T1497.001System ChecksEvidence1

Collection

4 techniques

T1056Input CaptureEvidence1

T1056.001KeyloggingEvidence1

il servizio di accessibilità permette infatti di: Abilitare funzionalità di keylogger.

T1123Audio CaptureEvidence1

screencap . Avvia la registrazione audio e video (dello schermo) attraverso WebRTC

T1125Video CaptureEvidence1

screencap . Avvia la registrazione audio e video (dello schermo) attraverso WebRTC

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

La comunicazione con il C2 avviene tramite richieste HTTP POST.

T1090.003Multi-hop ProxyEvidence1

Si nota l’utilizzo di due server STUN, utilizzati per aggirare le limitazioni dei NAT nelle comunicazioni peer-to-peer.

T1105Ingress Tool TransferEvidence1

All the injections payloads which consist mainly of HTML, CSS and JS files, will be downloaded from the C2 server in a specific directory

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

La prima è l’invio degli SMS al C2, all’URL /app/device/sms ... Il ping contiene le statistiche di uso del dispositivo, oltre all’id della vittima

Impact

2 techniques

T1490Inhibit System RecoveryEvidence1

le azioni di queste app malevole si “limitano” ... al blocco del dispositivo (inteso come blocco dello schermo)

T1667Email BombingEvidence1

forward_call : Call forwarding through the code *21* + number + ##

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cleafy labsNews

Jul 27, 2021

Oscorp evolves into UBEL: an Android malware spreading across the globe | Cleafy Labs

cert agid gov itNews

Jan 27, 2021

Oscorp, il “solito” malware per Android - CERT-AGID

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.