Analysis
-
max time kernel
147s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
05-10-2024 22:09
General
-
Target
ec5836c08d2b1627b9a2c75c85da77692dea573d03f13aead4d1e3eef8b8c89b.apk
-
Size
2.7MB
-
MD5
e30ae81986eeb4ed89394525e8c1f735
-
SHA1
d29ba25a93b36b379cdcb4c39fe7a06cde9f0a71
-
SHA256
ec5836c08d2b1627b9a2c75c85da77692dea573d03f13aead4d1e3eef8b8c89b
-
SHA512
b7db83b68ba350452e5cb2e9c46a2cbed99ab147afab3b0775258e3a1c14c5671117772210c5bbb537603ce5ae582c59083596984cbef3029b486b85c8de0d42
-
SSDEEP
49152:7wg6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQu:7ZFjEI4iZaUzYH99yIX
Malware Config
Extracted
octo
https://31.13.224.141:7117/gate/
https://31.13.224.141:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://31.13.224.141:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD585aacf0493a715b61340f99a0289c26f
SHA130f36317ae79bbdcdf0648c500801d271236d1cd
SHA25659654e6992923033ece3f9f7ad8add04ea0e77cb8f87a4c351d5850748db92ca
SHA512fbfdab52f8fe9153cce13d22e7e4595de02bddabccda3b025a82bd93345bae45fd7e585e2a5e5d8141319ffd16eb259528c77abdbca7c6e4af275414f4706f40
-
Filesize
70B
MD54c1d974ed42438066a492ad0958dc12f
SHA1242a8812c8ccda7f93d1df5b27481393d28a2258
SHA256c04ad5b6f18f4b795578c9a81ea8083d99e6c645993e32c96c14b701a783e3a0
SHA5126ee3cf4d8bac0204e600eb830a59101da8ee401808c7956483e7eefc2bba4cb6989e4c7ac66438bdb9337eb75885320d742dcea5cbf5473e1407058b0755731d
-
Filesize
52B
MD5a3e63214d300c8e65781e7f5edd5099a
SHA16897d24b94be5b128e0318623dbc8dd1fdd5a059
SHA256f7d29b21a218d0d8e1c4f915902fd416010d589172245d54e49e2bc008207ccd
SHA5126e7ce4b82119c1baa69c0fbfd176a7d290d5db9219a4b68581caaae3bbf13e9852fca108f47dd16a76671758ae4955be065dad947c8003ec3b65f4dc2086db39
-
Filesize
214B
MD5961b993fe9a13478e78b6284d627ab94
SHA10265e77e10a8c59549fdeb4380e35fbb01392944
SHA256d97f87165efdb3cfa32aecb92a4a4597fe952debfb78fa66543cced97f4aecd4
SHA512ac46f72421091039c7646f8e7a06c3619bc0a06644b7c7ad52ae8679a5284619f6a78d285a15e2163a8d500116c12fe242f1f1930861f2b5dade4c175d4df5f9
-
Filesize
214B
MD5bdfa0b3beef947aa3ff0116dd94b5ebf
SHA1c479c86ea6d986561e5ef86959f54c77907765d1
SHA256a28e05cdc290b7114b74327a8e8effc0e2f325312354eebf6c424ced4e0b9f13
SHA5124ae70738c69cf7771163e8266dd93016931c2455c7ac01181529f3140987aa20eaeda16d36995a32dd75a046c656e1db9baef6fab4f919c8336f4aabe89feb0f
-
Filesize
52B
MD568e35b0b2eac40d880fe6b0ef8c519f2
SHA189b0fa6c32858748a0068e02f9f92e8e3ffb653e
SHA25692d0528d8db3a255c41a14ae7b12f04a0702ad8e7f1d459980b2d098d7dd256f
SHA512e17872a9522d9e2307fc1226351ad79b7088766674fd928270027e0b862b49e925baf68a6cc6c464e2f91e9f78aa6a8322d205ca675f911725a2faecd1e2d519
-
Filesize
70B
MD505d08fb5dcfec7f9624231afa13bbe57
SHA1cc6e680a7559009f1eab31b0524df71cd55ae54f
SHA256cd3cf80d0706f91fa1f5e54b4c49a99eb5f07094f7bcda2af84e1a2a5403456f
SHA512f1c866dd9b3d8639347b9a157a51784f5d982239ae6d1775744ca6f90bed2b0fbca24e5ae74a679d013d67300071df53fced334ff9f5ae08a455b09a879ebf6f
-
Filesize
55B
MD5c6febea62a96972f79674ab4b43de9cd
SHA1f9e53ae0c50050591d3929d3c407a98ee160471d
SHA2564b36d9f1e9e8358456c2ef7c20c165cf05a51f9aea0d35670ff12bdc948766ba
SHA5122cd2c2de98206e4263e40f9a3ee029ff0cafc08f1867804aba820acc0236382f4bc481118f1b1802af8cec3790b12b9ef6829a2f2cc9d60825864391edc2b4ee
-
Filesize
45B
MD548599a43982efe16f0d60521d93b8ef1
SHA1c6ca3f94f544a617b7efc8c79753f142bc619941
SHA2561d6046268739fe9cf155b7cc6635f80367dc5ddc393abab27ece54239e944975
SHA5124523a4c4671c4ef18e1958e8218fba417631f23b67fb4361c5e44cf15017379442488f4a2c42238dc64297e8f33674a7f46555166eaef4d14543e201c002d0a6
-
Filesize
70B
MD54dbba0b56dce950da7cc6994e09ff45c
SHA159fa951a15e976bb223d15477b68193ecd9b3b7d
SHA2563849511747c37dd2fc81b5ff5190dcb9db1abe9971788021d063dcc4bcc4ce44
SHA5123b1657e4bebf9ed9548f429f56b1373a50d84abe37417f0aaef7f62903bd3371cb9ef74f8cf831d91d9727e858b8ed1e7132268c38685722a52219ecda4de16a
-
Filesize
490B
MD58744bba48a02531820f2cb30c45037cc
SHA1c98d255cbcec87186b24b4620e6530f71c0262dc
SHA256b8943284cc7e6ac283783a66310251fcd1bbe5f525e5115909eb774cb6d8d6c0
SHA51235938f357ed5b8f9503f70bc1fa85b31abe0e364a5b91dac01c98fc25b169b6474d75bbbddeda50348b8a4e79013a22f975b5f16116fbd51ee6695e39d5ebcac
-
Filesize
68B
MD51f0ed5a095a196868c0bd8cba633ac97
SHA130d362087c9014c8572489239e9efb7f349b2379
SHA2567be1e4e99d044d589e9642a30f484e271acd833058b5f745e3a0128df905ed2e
SHA512f6b395e8e928d393377f5747ea931f9d961dd3abbb462fa123b24e1457ee35b092d92018616f977d5d86ee38fa41fc9686113c36e87bf8b75513396328355521