Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
01/10/2024, 06:08
General
-
Target
2b6c640ad4d6e4aa470aeb3229d73f830670d84a24f63ddd48cbc82e13c3eefc.apk
-
Size
2.7MB
-
MD5
15f72e8f4aa62b2e01240106b98f7d69
-
SHA1
3404ce1803514a66e3dcb605b797fc6e1c76eb0d
-
SHA256
2b6c640ad4d6e4aa470aeb3229d73f830670d84a24f63ddd48cbc82e13c3eefc
-
SHA512
aa2a95ee9b61c09bbe235c8577d8d1b0ecfe4d4f078734485bfbe5ad7a5d88045eed9064e1ed420d52123b1c1ad3ce8e26d60ebdd7f697677be8122096eacc19
-
SSDEEP
49152:W/96Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQA:WVFjEI4iZaUzYH99yIB
Malware Config
Extracted
octo
https://45.89.247.180:7117/gate/
https://45.89.247.180:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.89.247.180:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
79B
MD52bb6281165d89751cee38a5d5d6c96f0
SHA185ddce6a150414b3e23ef828bbd749d2da2e3e50
SHA256fce2d137211981d53d297c7c5373fce9ad9d02725e74075cec70bfdce1e5b580
SHA512ed64f467d33186e450861d88cab7e333fb666681f1f585d0c69d62a4c76b17369f9aa6fee0834cb5e90d359f531ab078319d7672e3c8e560d25427f3759806ec
-
Filesize
490B
MD52ae671b68e4e2b38119ca116eaa34949
SHA136daee285bff343c2c1c1df1bb584db490769acf
SHA2566f3a42405fc55fc5a455ba6e7e1a4dead0b997bc4903c1be95a85f2cda9bdd26
SHA512467e1c7c91269d3f3dc921ab2ec19f70571f26ec7aaba7e1a5abc51d242e043d600142ec1ef755b704ba3a8d4c0e1f3288128e15075f0698e3ff4d32a2d96496
-
Filesize
45B
MD5331fcf9f3e7f58bf805b5c8e65daba6b
SHA13f2f80c0f0d3508384645975fb6e500ab5868f79
SHA256a50e2c259d5f6ee1a9dd115b11feef92f53c497bfdfb7bb3e0d945323b62ffc7
SHA512dda6f2e15a561db0d81729775b5f5fc417408a3977485d09d87bda7a33f1396d0e69864b65bfdaaeedf71af7b164d5d95c6563aad017fcb14eca7e192c934343
-
Filesize
70B
MD5bf414b762451f2efc7c2b5ab0bccfb82
SHA139de2f8e839c661e1d9290219ecdb34378eb8e17
SHA2569e466572c4fce4f8ccdcb1d08267f51e67d180f3737f0ccd0322cef94305b515
SHA5123a5f4d7679dbcc15d6ef587c96abb76effcfbb764b3f0c864f3c241bad7ed744ecc0e24b6b9f355278e7166aa3692309258411d034da934e2842a5b1261e1fbc
-
Filesize
70B
MD537cd3f52128cd8d3dc4ae8c6fc01f0e3
SHA1993bd37134d01813f79299d756fe726bc978dc57
SHA256f7a87ff03ed112dced71ad33bc19926cca4be3663df4dd3b98e08f37773245ae
SHA51262628fd822fae92f5c5c6bd87f72fc4f294631c1982f31d1afcb7e4cbb7310e7d1dfbbebb0dffcbe5b715386cb664ad70ebe5003b7a5ee0fa8682ee007f635f1
-
Filesize
84B
MD5f7186a4c13d400a70a9590ecf63c7133
SHA1b476f6828ccfb207f616e14cf4e520f74f6b77b4
SHA2567ea49c8ed092e066b78fe5c3302e7a95058bed4e11f933bf637530156765bedc
SHA512f759c8d22e84c489402b8ee2efebc9a17e4c9deeee75b8ff3712d07916c486e03eb69c93d790dcae3e5113d593f279645005f3c94f705a8b5148c7f24550dac9
-
Filesize
214B
MD53aa8245a512e8937a9b0c204e66620df
SHA11622c6d8e4390c2ef80fa6b83041370f6d820f03
SHA256824364c98cc42429e7a9d008436b2d7538e76639c1b4e1aac51ef3c2cbfa23df
SHA5125f3740788e44d3a860c918f28f5672dd9d59045946c1ea15d02375870f02eae0d521ab2e229a5e15ddad782c22383ad89037d9b2b7f090415d404cfc1837f6f4
-
Filesize
54B
MD5f42ca83a41a01ab13880fa8f97425a0c
SHA16c390ce7e760d4cb6fcf9a34fe0a00ac2340b33e
SHA256e6e245bd5789313982785ef7e8a8c5b1a3652c6649ff4245eb96571e1f8fe6c3
SHA5129fb5db4f4fd951346889a53091c3d0defd5ad559da7047c24df9b597645e039dd3b74cd3e0ddbf2b7ef311408deff340b0fde55e27bfbadaf238f2fb7f0ebbf9
-
Filesize
60B
MD5c20cbe5f16fc94a81681fda8742e6d6f
SHA17213d0e3aee1a5ae454bbda9153568e8a9c1fe3b
SHA2562c4e1dbd4683c38e82c75b51e5fc11f2f67842a134a255e658de5a0808aeae30
SHA512796fdb05cf481e09eeeee28ac4d0226f5c5d1aebad246c3cab2da819fe07f5651b145ec810dec5ac3fa07d3d894b2e3513093a25bb464ea70daef046cc4607ff
-
Filesize
52B
MD5b5e8e551fb5daac0731e3666e2701a1b
SHA1b5a16a3e0b1c1dff8d3857b0dd1428ace38084ee
SHA256920a5f3a56a461758af2c38bdf3a27780e520baa7776a64e2127212460c9b228
SHA512f6940052f8904532b3f85ad07fc8594d1f773e068f43c2f67dce02693b8f5fa0245852baf232b08b990d62cac5e8a8dc737e80633090f87d052c06485fc2c7f2
-
Filesize
70B
MD5d2e7794092e1a86ca120eec385effbcc
SHA121aa64ead7852dc225a044936cb956f48385c85c
SHA2560abd6f81a3ef0a9c8ba7e7ed279b1c40f8b428c707e108c1df551139d9e27793
SHA512dcdc0c4b50007313e608ece51c21e241352257755ade01f3e3a4cff7e84e3e05a66071e9174f36ed7039f4099071623c7d280297744f0bd7c73a026d17e317c4
-
Filesize
55B
MD5bc7c9087d5812caf79d44a152238f4c8
SHA1f24ee336a74a4692f460b0f0cb2afe5710706464
SHA256c4ac29cfdce604a9c17be0015248f7bbfbb05936dc48ace1752dd131a14ce037
SHA512f28030f9a0287ec3e0d112222ebb7bdc18bfcc02e60107aae3f1173870d24c2e079a6479270738dc3d1d4730fe2b3e308d8d7c848a28e229b2d93e4b54956660
-
Filesize
45B
MD5b20dc5baf1da85150c131b86dca7d080
SHA16da0b5a7eec64ef605d8018151ceb0e69a208416
SHA2565431f31fd3fca54b1062eb9e02b17e8d60e734a90c9da5d0571f7be84ad2b8a5
SHA512fa0ec3bf5d5692d987bf734b99ddcaf4c53bd714389d8a75a06c0a6e30cf32fa5ba88f0e3728f0250eb55f290ba9aef26bbeadac65e03b182994c164c729dcee
-
Filesize
70B
MD5465adaf8d77715bced593331ca7d9007
SHA1f82f42d63457b882cc539c5bcd152ce80f5fa4a8
SHA256dbba3973c25122f9cbe303ec87ddeed046362c68d4c9db420877e8c128417b92
SHA5127b5fa20c12049df8166b609350f08efa938821c60ba5f0c56091bc46ce17c73e8124e7ee2b1114cde2bb0b5ace0bb1540e19b67a0f9ab1e117e8dbd095660983