Analysis
-
max time kernel
142s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
09-10-2024 22:10
General
-
Target
ddfca34f855a642ffff8a0c26596e7ff8a8e17674fa193ace7ce679dc1961167.apk
-
Size
2.7MB
-
MD5
6142c18b043fd875d553f94014da7f10
-
SHA1
98451183833fa0677c5ae428012a2bfab3a59148
-
SHA256
ddfca34f855a642ffff8a0c26596e7ff8a8e17674fa193ace7ce679dc1961167
-
SHA512
6bb97028ecb269e4dd1ca3553eb0f03ff1917edc732cc257531fe9fd70df77e0faee377b15be26ec0bd5d8b18f93657b6185c690b505e40c50637e92e7b931c2
-
SSDEEP
49152:ecEO6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:v7FjEI4iZaUzYH99yIp
Malware Config
Extracted
octo
https://45.88.88.74:7117/gate/
https://45.88.88.74:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.74:80/builderxxxzzz/gate/
https://senoleletvyayinda.xyz/gate/
https://senelolatvyayinda.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
54B
MD56b86b2f9fd6b0c4c6fc205e9624c18e7
SHA1062d50e89c328c51534b743d6d3c7b0479527b96
SHA2565bb437a2a2c25824b5c759050aef315b1080be1fa92fff81c8c43170eea6a657
SHA5125dc8d1ec2294c8b2a6571df0e38ae97e71b15d47746a79bd146fcb42a65e72323ba9baa9555b4c4d8ea76abb617244c0d93a082ee327cd828d5fefe421f89fab
-
Filesize
45B
MD56d383ae71a092f49ba9529338b7dc21a
SHA1b8757bc71016911601b7b9d996e0e4d41f1a64c0
SHA25608cd06d7d6dfceb9c6d6cb3c0a97698cf6586ee1a7d68d3f30d994882471292f
SHA5127149f9136465de3863a4d658e7060f538ba541e9d5dafcbcd6082b6b7eb1befca323040f32192db897f5e114c73fa812d277ce84532e235cfd94f5cd6500863a
-
Filesize
68B
MD5afa75f43c56126f667e9604b06b86e3f
SHA1caf64b06a63bd6a4deaa2729ccac7eb5117e4e8c
SHA2567691a93ff7fb9f0cc48b73c7d77c03d3b574d75c2ee7d7b67f835eaa09aebb71
SHA512aed4fb804c82765fdec751b935adb7de0b247efc390dcdcd2433194366c11edc8ae39f2162dc92d4ac88facc1ccaf3ecea5841d952900b1f488cec30cbe5a908
-
Filesize
66B
MD58f6b54b74c0a1e48bb637a0ebb740a95
SHA112e68cee74fd5ba1ed38819be62eb17fd3776748
SHA256acf9e6abaffb5bc702d8cf782c47de8f10a69b93b798d4a19ae1622a9f3c494d
SHA512b1679e8ff66886652a1b08956d314e755057dc7db22ca19cc7309f9b2cc89156b8915f0480340c0a8d14feb2f5bbad5d7e177dbfc4c2a31c44199380e96f668d
-
Filesize
45B
MD5511de7a0c914f2aad8f4392b973bcbc1
SHA158bf879972d34f741f8a7c57406c3e1c31b3bcd2
SHA25693aef3b4e0c52e0d008c18bdd3b709b12a89fdb30b9e006a9f289844eab138f6
SHA5121b52a77e0b04c255c6b83d4d7a476f8ae2d7b08f933e79923af07dba7ed31228d020546a7a0baf1d2b06025e15cbd108552b36d1cf6120efccaccb04a2d0dc96
-
Filesize
84B
MD51993fd69d276afadab9b8a06f1271844
SHA1f8901cc6138d6bc5dcefb087d1f7a8cd584714de
SHA25647d294a585fad17ed688d7ff72fb4f1a6c03d9e94e4094612143926b9be0aca3
SHA5129c885e3b53f4e680cb929104afb4cbe48ea1331d6c69cf275320029b5a23991879d794dad3035af0ce0039f937ead727fa4af8035edfb9d49c132dd18515f2f5
-
Filesize
68B
MD5d6e17829d4ff2a0633ad5062aa4b8f52
SHA1861dc0c7a4db429ad29230592ee4c5adb7e2fc61
SHA256e1c964ce445b882c9586ac2a86fff04e304676f11a18c9de81faa972f6a2e91c
SHA51249771c4037df893d9c08b1b3c7a0077f3662044bf3fec312378bc08677323b5285e832b2615d04d0539559725d08bcd4a6adee2c38e9543d75ca59e3116ea9f6
-
Filesize
63B
MD59f10a7be8f8a4d9cce7dbbb992e0953c
SHA1eabc9369ac7c81d4d6a5969bf59acc6c663993c1
SHA256c158ec1c5e18251a0f2171637986574cfd4df33ca180a55d1a4ccf8a98099016
SHA51234f295cc2e781f1a3d9aa2bbe3e34473bf4e3a690885a013ff99eb16baf0dd4212e3c23f6acf7e7bec38024fd316d5a26e74d9dd000f3467a3422ce9370b276e
-
Filesize
230B
MD529706c3a730e166040dabbdcd7e225ff
SHA1764b1270d2027440a4aae693f80bf768909350e2
SHA256c9b6c1bbf81a2d9e552086b01bd6d8dd86be0a9541ae3b9b1fd10ecc22fcf4bd
SHA512567f7b4950a9f8882b90e6fcc8ca0204b739299f6d32a0256b93b75e1b2ecfb458aa517dfc2326bb658e13d0b7f2040907523ddc8cca5fa388241cd0a5bb4c33
-
Filesize
63B
MD5bc11f4bd4416401c3a121bd57af3ecbc
SHA127d885ffe6fb258ed05c3834d0fbfd374455e270
SHA256bcfcdbb22aabe4382fdce622f233944f3e1e9465fcd6a11c0c1ad9ac5fa82c17
SHA5125250060a0c09adbbcb11d5b1ad00782761009d8c55c7cf346d657c3fe6411bcf1d29084fb7748c6ae0b4a199a6cdb0e5134725b2453c5e87874de91468d8cfea
-
Filesize
68B
MD556ff37a6cbd1f23bc791be6a38310a38
SHA1f0843c9445a8e81a287826ccca90e24503562418
SHA2563b3ef73c2c37da329d2cfa9e381c71bf6cae40da0a0a7a349e63d960a9bdfa69
SHA512a3ffa06b3cf89fb398233447e811b59b72b0b950cb8e12b9116cb596dd35b8dafa63ec9b80a4e72890f80ca0c151279bc250e6c196f5ed3f60dd70435c7e99a7
-
Filesize
45B
MD5063e71bb1f824b407c9c2b2de27f4f9d
SHA1ca9169d716563e473e69e926a328c02c2be3738f
SHA256db16fcf31ca30b3fe1ee5344ae2157a1462d17eb3e32ef3d07aade7d2476550d
SHA512a21e8969525843f78922585410fd1599724667ffaa85d512c1321ca8f9228942ca8381480377e18b7ecce2bf94696e05a351efd9ad5d8555cefc995a85b08fac
-
Filesize
63B
MD53075199edc886359bebe77bb6b5c7bd4
SHA1c2fdd4a6d2365e5d46d603f377ecf50908fe2173
SHA2564c9106e59fd5941b8596a08611ec295ac1c504cd990da0469dcb596145353a19
SHA512dc4cf03bd6c5bb36db81ef2c0ddfc4e0a45de71ea71a13362a88870dad8a7d9a5fb6d5f975eb8b3986bd2b83804b2db948fa416c2438cfa192d4ee28ee9a052e
-
Filesize
45B
MD5910773408b7a1c9441860a41b745b1f9
SHA1cb036d2eebd17032187cc5da303d3670cd3147b8
SHA256456f9bf399199c0a1311036da8d43ba7291ea3c6a0b39f889a8657db3deb91bd
SHA512bd018b5a1755f19b7864322c7b322e0f57e2e7c2eda6c2c9f9303ec848ea04e9eaa0e179c9a5f42a71711b518c9825177f58d0c6087939bd4de0b1b6f1004f51
-
Filesize
79B
MD5779ed12fbb43957845f8ed34f86b3890
SHA1cc8df905e4b2941c9cc854ce7c1cb1b2fab44bf5
SHA256decbd69a98fbed71fdcc046854875c45edcb9ebc0c1d82d6fb43c9afaef0e013
SHA51201cfef164ab710522061dedb2d25a842517dc664b5a595227405b2007afe654c99aa63c2f204975eb5a84c51ee5c67d80a8920eb7c708aa962234d26cf2890d0
-
Filesize
466B
MD59bb3d2c0cb78627ffadc1a8e4f40eb66
SHA1450258aa75ce9069deaeee5425b63cfe7575edb6
SHA2567733c6dc7d5faa2bbdd820d1f7c99723bceda5fae5f3e1895a7be988995dee56
SHA512017725e04e04cf95f801ffe60d3efcf74e46089b759a4634efe8fc8ac46a9b9b512cb90d20582d1469742d4fc78bad973e073dbce047b9e4de90b1e78cde84c9