Analysis
-
max time kernel
146s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
18-02-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
1e9300f1e1015b6d458763a3e4fc726b215186aec0e740f920a71b9c5af5ada0.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
1e9300f1e1015b6d458763a3e4fc726b215186aec0e740f920a71b9c5af5ada0.apk
Resource
android-x64-20231215-en
General
-
Target
1e9300f1e1015b6d458763a3e4fc726b215186aec0e740f920a71b9c5af5ada0.apk
-
Size
541KB
-
MD5
d90d667fd6b871ac9d1a450c5cff9c86
-
SHA1
11322e60737f52a8d0479c931d31ac8caae8587f
-
SHA256
1e9300f1e1015b6d458763a3e4fc726b215186aec0e740f920a71b9c5af5ada0
-
SHA512
cb376697a0f05c94cde7f472a47b93acc3d8773481d83cf7adc21fa69efe4add4224b49794e5fbe7ae13eb3dfe6a11d4abc4e6c7579db07e0644950c4debd59e
-
SSDEEP
12288:fpQMRLSDIu8w/KpDYNWiswE8YN0eY61hmM/7FXYl0m2knq:h9d8/KpMTscG0z6jJYamJnq
Malware Config
Extracted
octo
https://91.240.118.224/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditionksla.net/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditionalsk.com/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditionpskl.net/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditionctfm.com/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditiontsma.net/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditiontols.com/NjQyNDcyMjE3ZWU3/
https://asamanaproductioneditionkdna.net/NjQyNDcyMjE3ZWU3/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
jp.co.netbk
jp.co.rakuten_bank.rakutenbank
jp.co.sevenbank.AppPassbook
jp.co.smbc.direct
jp.mufg.bk.applisp.app
com.barclays.ke.mobile.android.ui
nz.co.anz.android.mobilebanking
nz.co.asb.asbmobile
nz.co.bnz.droidbanking
nz.co.kiwibank.mobile
com.getingroup.mobilebanking
eu.eleader.mobilebanking.pekao.firm
eu.eleader.mobilebanking.pekao
eu.eleader.mobilebanking.raiffeisen
pl.bzwbk.bzwbk24
pl.ipko.mobile
pl.mbank
alior.bankingapp.android
com.comarch.mobile.banking.bgzbnpparibas.biznes
com.comarch.security.mobilebanking
com.empik.empikapp
com.empik.empikfoto
com.finanteq.finance.ca
com.orangefinansek
eu.eleader.mobilebanking.invest
pl.aliorbank.aib
pl.allegro
pl.bosbank.mobile
pl.bph
pl.bps.bankowoscmobilna
pl.bzwbk.ibiznes24
pl.bzwbk.mobile.tab.bzwbk24
pl.ceneo
pl.com.rossmann.centauros
pl.fmbank.smart
pl.ideabank.mobilebanking
pl.ing.mojeing
pl.millennium.corpApp
pl.orange.mojeorange
pl.pkobp.iko
pl.pkobp.ipkobiznes
com.kuveytturk.mobil
com.magiclick.odeabank
com.mobillium.papara
com.pozitron.albarakaturk
com.teb
ccom.tmob.denizbank
com.tmob.tabletdeniz
com.vakifbank.mobilel
tr.com.sekerbilisim.mbank
wit.android.bcpBankingApp.millenniumPL
com.idamobile.android.hcb
logo.com.mbanking
com.openbank
com.google.android.apps.walletnfcrel
com.samsung.android.spay
com.cardsapp.android
cz.bsc.rc
cb.ibank
com.bifit.mobile.ubrr
com.bssys.mbcphone.ubrir
net.bl
com.bifit.mobile.bin
com.webmoney.my
com.polehin.android
com.bitcoin.mwallet
io.totalcoin.wallet
com.quppy
com.sharpdev.fxcoin
com.advantage.RaiffeisenBank
hr.asseco.android.jimba.mUCI.ro
may.maybank.android
ro.btrl.mobile
com.amazon.mShop.android.shopping
com.amazon.windowshop
com.ebay.mobile
com.idamob.tinkoff.android
com.akbank.android.apps.akbank_direkt
com.akbank.android.apps.akbank_direkt_tablet
com.akbank.softotp
com.akbank.android.apps.akbank_direkt_tablet_20
com.fragment.akbank
com.ykb.android
com.ykb.android.mobilonay
com.ykb.avm
com.ykb.androidtablet
com.veripark.ykbaz
com.softtech.iscek
com.yurtdisi.iscep
com.softtech.isbankasi
com.monitise.isbankmoscow
com.finansbank.mobile.cepsube
finansbank.enpara
com.magiclick.FinansPOS
com.matriksdata.finansyatirim
finansbank.enpara.sirketim
com.vipera.ts.starter.QNB
com.redrockdigimark
com.garanti.cepsubesi
com.garanti.cepbank
com.garantibank.cepsubesiro
biz.mobinex.android.apps.cep_sifrematik
com.garantiyatirim.fx
com.tmobtech.halkbank
com.SifrebazCep
eu.newfrontier.iBanking.mobile.Halk.Retail
tr.com.tradesoft.tradingsystem.gtpmobile.halk
com.DijitalSahne.EnYakinHalkbank
com.ziraat.ziraatmobil
com.ziraat.ziraattablet
com.matriksmobile.android.ziraatTrader
com.matriksdata.ziraatyatirim.pad
de.ingdiba.bankingapp
de.comdirect.android
de.commerzbanking.mobil
de.consorsbank
com.db.mm.deutschebank
de.dkb.portalapp
com.de.dkb.portalapp
com.ing.diba.mbbr2
de.postbank.finanzassistent
mobile.santander.de
de.fiducia.smartphone.android.banking.vr
fr.creditagricole.androidapp
fr.axa.monaxa
fr.banquepopulaire.cyberplus
net.bnpparibas.mescomptes
com.boursorama.android.clients
com.caisseepargne.android.mobilebanking
fr.lcl.android.customerarea
com.paypal.android.p2pmobile
com.wf.wellsfargomobile
com.wf.wellsfargomobile.tablet
com.wellsFargo.ceomobile
com.usbank.mobilebanking
com.usaa.mobile.android.usaa
com.suntrust.mobilebanking
com.moneybookers.skrillpayments.neteller
com.moneybookers.skrillpayments
com.clairmail.fth
com.konylabs.capitalone
com.yinzcam.facilities.verizon
com.chase.sig.android
com.infonow.bofa
com.bankofamerica.cashpromobile
uk.co.bankofscotland.businessbank
com.grppl.android.shell.BOS
com.rbs.mobile.android.natwestoffshore
com.rbs.mobile.android.natwest
com.rbs.mobile.android.natwestbandc
com.rbs.mobile.investisir
com.phyder.engage
com.rbs.mobile.android.rbs
com.rbs.mobile.android.rbsbandc
uk.co.santander.santanderUK
uk.co.santander.businessUK.bb
com.sovereign.santander
com.ifs.banking.fiid4202
com.fi6122.godough
com.rbs.mobile.android.ubr
com.htsu.hsbcpersonalbanking
com.grppl.android.shell.halifax
com.grppl.android.shell.CMBlloydsTSB73
com.barclays.android.barclaysmobilebanking
com.unionbank.ecommerce.mobile.android
com.unionbank.ecommerce.mobile.commercial.legacy
com.snapwork.IDBI
com.idbibank.abhay_card
src.com.idbi
com.idbi.mpassbook
com.ing.mobile
com.snapwork.hdfc
com.sbi.SBIFreedomPlus
hdfcbank.hdfcquickbank
com.csam.icici.bank.imobile
in.co.bankofbaroda.mpassbook
com.axis.mobile
cz.csob.smartbanking
sk.sporoapps.accounts
sk.sporoapps.skener
com.cleverlance.csas.servis24
org.westpac.bank
nz.co.westpac
au.com.suncorp.SuncorpBank
org.stgeorge.bank
org.banksa.bank
au.com.newcastlepermanent
au.com.nab.mobile
au.com.mebank.banking
au.com.ingdirect.android
MyING.be
com.imb.banking2
com.fusion.ATMLocator
au.com.cua.mb
com.commbank.netbank
com.citibank.mobile.au
com.citibank.mobile.uk
com.citi.citimobile
org.bom.bank
com.bendigobank.mobile
me.doubledutch.hvdnz.cbnationalconference2016
au.com.bankwest.mobile
com.bankofqueensland.boq
com.anz.android.gomoney
com.anz.android
com.anz.SingaporeDigitalBanking
com.anzspot.mobile
com.crowdcompass.appSQ0QACAcYJ
com.arubanetworks.atmanz
com.quickmobile.anzirevents15
at.volksbank.volksbankmobile
it.volksbank.android
it.secservizi.mobile.atime.bpaa
de.fiducia.smartphone.android.securego.vr
com.isis_papyrus.raiffeisen_pay_eyewdg
at.easybank.mbanking
at.easybank.tablet
at.easybank.securityapp
at.bawag.mbanking
com.bawagpsk.securityapp
at.psa.app.bawag
com.pozitron.iscep
com.vakifbank.mobile
com.pozitron.vakifbank
com.starfinanz.smob.android.sfinanzstatus
com.starfinanz.mobile.android.pushtan
com.entersekt.authapp.sparkasse
com.starfinanz.smob.android.sfinanzstatus.tablet
com.starfinanz.smob.android.sbanking
com.palatine.android.mobilebanking.prod
fr.laposte.lapostemobile
com.cm_prod.bad
com.cm_prod.epasal
com.cm_prod_tablet.bad
com.cm_prod.nosactus
mobi.societegenerale.mobile.lappli
com.bbva.netcash
com.bbva.bbvacontigo
com.bbva.bbvawallet
es.bancosantander.apps
com.santander.app
es.cm.android
es.cm.android.tablet
com.bankia.wallet
com.bestbuy.android
com.jiffyondemand.user
com.latuabancaperandroid
com.latuabanca_tabperandroid
com.lynxspa.bancopopolare
com.unicredit
it.bnl.apps.banking
it.bnl.apps.enterprise.bnlpay
it.bpc.proconl.mbplus
it.copergmps.rt.pf.android.sp.bmps
it.gruppocariparma.nowbanking
it.ingdirect.app
it.nogood.container
it.popso.SCRIGNOapp
posteitaliane.posteapp.apppostepay
com.abnamro.nl.mobile.payments
com.triodos.bankingnl
nl.asnbank.asnbankieren
nl.snsbank.mobielbetalen
com.btcturk
com.ingbanktr.ingmobil
com.tmob.denizbank
tr.com.hsbc.hsbcturkey
com.att.myWireless
com.vzw.hss.myverizon
aib.ibank.android
com.bbnt
com.csg.cs.dnmbs
com.discoverfinancial.mobile
com.eastwest.mobile
com.fi6256.godough
com.fi6543.godough
com.fi6665.godough
com.fi9228.godough
com.fi9908.godough
com.ifs.banking.fiid1369
com.ifs.mobilebanking.fiid3919
com.jackhenry.rockvillebankct
com.jackhenry.washingtontrustbankwa
com.jpm.sig.android
com.sterling.onepay
com.svb.mobilebanking
org.usemployees.mobile
pinacleMobileiPhoneApp.android
com.fuib.android.spot.online
com.ukrsibbank.client.android
com.Plus500
eu.unicreditgroup.hvbapptan
com.targo_prod.bad
com.db.pwcc.dbmobile
com.db.mm.norisbank
com.bitmarket.trader
com.plunien.poloniex
com.mycelium.wallet
com.bitfinex.bfxapp
com.binance.dev
com.binance.odapplications
com.blockfolio.blockfolio
com.crypter.cryptocyrrency
io.getdelta.android
com.edsoftapps.mycoinsvalue
com.coin.profit
com.mal.saul.coinmarketcap
com.tnx.apps.coinportfolio
com.coinbase.android
com.portfolio.coinbase_tracker
com.bitpay.wallet
com.bitcoin.wallet.btc
com.blocktrail.mywallet
org.electrum.electrum
com.paxful.wallet
com.bitcoin.pocketbook.btc
net.bitstamp.app
de.schildbach.wallet
piuk.blockchain.android
info.blockchain.merchant
com.jackpf.blockchainsearch
com.unocoin.unocoinwallet
com.unocoin.unocoinmerchantPoS
com.thunkable.android.santoshmehta364.UNOCOIN_LIVE
wos.com.zebpay
com.localbitcoinsmbapp
com.thunkable.android.manirana54.LocalBitCoins
com.thunkable.android.manirana54.LocalBitCoins_unblock
com.localbitcoins.exchange
com.coins.bit.local
com.coins.ful.bit
com.jamalabbasii1998.localbitcoin
zebpay.Application
xmr.org.freewallet.app
com.bitcoin.ss.zebpayindia
com.kryptokit.jaxx
com.cajasur.android
app.wizink.es
com.grupocajamar.wefferent
caixagalicia.activamovil
com.abanca.bancaempresas
net.inverline.bancosabadell.officelocator.android
es.caixageral.caixageralapp
com.bankinter.bkwallet
com.db.pbc.mibanco
com.indra.itecban.mobile.novobanco
es.openbank.mobile
es.pibank.customers
es.bancosantander.empresas
com.indra.itecban.triodosbank.mobile.banking
es.univia.unicajamovil
com.westernunion.moneytransferr3app.es
www.ingdirect.nativeframe
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 2 IoCs
Processes:
resource yara_rule /data/data/com.onlyenough7/cache/mksjoybkwiazc family_octo /data/user/0/com.onlyenough7/cache/mksjoybkwiazc family_octo -
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.onlyenough7description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.onlyenough7 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.onlyenough7 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
Processes:
com.onlyenough7description ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.onlyenough7 -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.onlyenough7ioc pid process /data/user/0/com.onlyenough7/cache/mksjoybkwiazc 4994 com.onlyenough7 /data/user/0/com.onlyenough7/cache/mksjoybkwiazc 4994 com.onlyenough7 -
Acquires the wake lock 1 IoCs
Processes:
com.onlyenough7description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.onlyenough7 -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.onlyenough7description ioc process Framework API call javax.crypto.Cipher.doFinal com.onlyenough7
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
308KB
MD5169141bf6637d767cc3adbef0e3f29cd
SHA1b44a1b231cf4ca5664ab0a7f9026c33d64c610dc
SHA256eced83ae144d2163642ffadc7a6b0d092ebb85f663bec18c5993f84b3973c2b2
SHA512ceea3fa1279c3dc693ddff07fc24737b86fa97d8b3543378c2f5898c26928310ec05430368909a5f9c17a0a082a2e31d62992b4d858fa3e455d12accebd136c8
-
Filesize
460B
MD52bb95f69f7de1c815ab8014d2a1d8503
SHA1a22d1de782ca402a37effae34929e7648bade08c
SHA2564605654f86c465c640cbe1dfecfdca2852343bac0099230ad1b8b60f32f91bda
SHA512a5208ee8fe1d1407a8e65ccaf9e27f803641550b144ffced31798a6edf06576787b5116fad02360f62de231619dc053e917d0f270fe4fa102122e341d3c83311
-
Filesize
230B
MD58fe043251db914adbb5782d5f11891ae
SHA1501b7bd67a0795baea14f6951ebb18824d440a50
SHA256e9291d247982795dee7ffa4c3093ba3396ebfad76dacf46b6c816929c7850e7c
SHA5123822b59094d5fd3d2ff188fc7aa1e9f2b957d2748d00889b572dd213a66d2d460d68297308a93ac1c175bef1aee6845e6d185e66306c3c0234aab2651f12e07d
-
Filesize
54B
MD50fab7970f47ca29424751acabd6e82b3
SHA13861e4b48a4bfb7f057500012369249a9fcc3152
SHA2561f090aa31870145af4f0f21b29c4609c8f4fa0d543ab6e0a5e0dd1b19e876137
SHA512a93e4bdee6f08c50d699c2e8ff3ba7e407bdbe55031490061c33cf82a06a7e529d32fa5d48d41b2cf73297c1e99e56223993757e63c4b517a43ae78caa70bcb2
-
Filesize
63B
MD51030a14cf46678bf3202ee1620c2fe6c
SHA165f20a3a468ff1e57187f32ebf013b14543a7243
SHA256390c92196f5d5614676530c81ab4399c567c0407fda55176a666c3e81eb41e4b
SHA51270db897f9bbcb60a05115a935f77ffcdccd6213655ebf954da369e0d160b866e09ae176fdf4fd311a5834451b2f2fa3cf2a280a7d2fc6eb7d14c6435c4d733da
-
Filesize
45B
MD5a790d56d5ff9650b8fcf503abe521cb9
SHA18bdcf3107ca186694f4a562566d888f619bfd27b
SHA25634df87ada78b3a3ce7c4083717db83a01ca2a82c4f90bf2b0f228c514b1358b9
SHA51217186a4c02d70abd72e50ae3d47b37cffb1ce7f15408c15c6cdb0296470bb517f0fd80027ffa141ed229847ac6af3d4554f5e06a38d1265e177f48abd2391261
-
Filesize
63B
MD53cdd1d57613e7bbb0111699b7007ccb8
SHA1dccd3cc2bcf268982e4009f1d0c1ca37252298a2
SHA2567b8f8100ca2101514b60a5d95933ed46b2f747d11ba4c5eff674d6a8df27ebf9
SHA512bc7413c1147f2cc115117a5785095937b61ca664fd7bd892a75c7522fcb0677274cd9aacc08f0a1e182aa8ddf6278da89f2c6f1b18738c920a8886b1de97c195
-
Filesize
450KB
MD54ef770fb87b027f2f2025b6d42a30f60
SHA1488dd38deed969d64154fc578193855fd422cc90
SHA256e1624a55b8a1845ba588e67f886f28cef6af37477a697df7c713d6cbca65d343
SHA51239a2091e9a84cff98b565892e362df6bb253c30aa6f5fef220fccaa6d21cfc110cf448b751b4ffa5b0071e46395bea22dc24760f3a18337586116a19468a14c1