Analysis
-
max time kernel
149s -
max time network
149s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
09-10-2024 22:11
General
-
Target
a7e3293e48f09645f41e3dbd5ca431c96a939529fd3b053c0b9fb4995e18418e.apk
-
Size
2.7MB
-
MD5
cbf99415ccf0620a6a34aa54f69a0fed
-
SHA1
d012a6e165c3291b8404f9cdffd4bd4df2184a0d
-
SHA256
a7e3293e48f09645f41e3dbd5ca431c96a939529fd3b053c0b9fb4995e18418e
-
SHA512
897b1e8ff77e8dfd4788967e8f29f27ff2432e1036adf66ad0e7680caf8b34249ab602fe3bbc4f4ad4cf5f4e71eb50fb17c2abd87115c967a3dfc913375e1f32
-
SSDEEP
49152:7wg6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQL:7ZFjEI4iZaUzYH99yI6
Malware Config
Extracted
octo
https://31.13.224.141:7117/gate/
https://31.13.224.141:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://31.13.224.141:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
66B
MD57c6674aa08ba10e5d9af4f210117864c
SHA1235b3b9c0c2709485bf10047293f2d85634aeccb
SHA256905495202789ce2d89d7c8eb5089f8fee25e562a2fc1bdb76962223b5ab55a21
SHA512977fa287da90ec4e0bd8f5a2a92a59278a5176ccb9e5270ed53c00820d79f65cd15f63dba70049239cfd410ec01b9806b6cd77cb10e6419aef32bad84be949b1
-
Filesize
84B
MD5fa45b8138fa62cd599b5d9431b9abb4d
SHA1ea1d80773bff118c283369306d04487e1665abda
SHA25621a621c9405878f44859d3feb471f160116de1310c6b0e15253a9aba2588483f
SHA512b7f5cbc358945d9a12eb61d3434846fff5507a696886c4d913c309edc9ac968138d796dda956849f5b5b759856deeca1e25aab4506c888bea9e6957287ecc9a9
-
Filesize
68B
MD57cec274eb0381854e0b0cc1c04eb7582
SHA1910dad979afd3cddb48f84924d69cd2efec27fa3
SHA2569bfec687d1e3d41149a842782bbcfb3a4a0f7f8c22dfdc1cf4ef024047e5846c
SHA512064a0e5e4c06183fae034974b341837c6445e5e85be8c35dd483658a99ec7ed1e383a367b3f869245552a55973c1b9ebabe7f9a5f5c37cfece342b33ff594fc0
-
Filesize
68B
MD5dad5a9c6aaf3d2a877234198eda6d019
SHA14b8cd3237929f5caaf16809109d28c5758c4969d
SHA256c79eb64c132d9a533b7ede07918f6931ddc651a170d7e8e62557bc538309cf0f
SHA51249e2ddf84fb54f024221b227f424ee134100aba00ddf68e7cdf3bfdbf81229c8b43374e326df818536a854df9e2a4e38d4d70dc83ccf42acb7a45e2ec13a9400
-
Filesize
214B
MD518caa43e571b9e691b83044135e5ed73
SHA1ae0eaea4a618fdf3cac51ea0c7427f44357f195f
SHA256aaff98dbdbe4e46372c738a6756aa2a0cceef9b35888ee39a52900cf067bf51d
SHA5122b7845dee4174bb905ac86179bd550e15b92ae7c6d0c4fb0b704a26d0acc3beb95d0d124d3eeed7f228aaac8cf79cc358290d58c397d7569df39772254bb3fa4
-
Filesize
60B
MD52d314e6151ec3a1b6d51d8e043c0ca46
SHA174a85ec9e185f7263abb6edfd27efbfd9a9537ab
SHA2564519bd4c534a0bc9f05c04850347da82f5021b957757b0045d1b24405b954cde
SHA51203801de6c3a414f79dc431ce3fea42d34adf43255bf703140ee8ed0d285f8a4bb557c270a2f88f367d947faa6e210078d9b0db5ae62cd9fd47eef807e3e0172f
-
Filesize
52B
MD5b0b363af07db5cd8c2cc3f280f679dd9
SHA1d6945b6ee9ac6b1316dd724a5ed208b180ae35f9
SHA256bf093174b0df641571c25ffa91a318f71cc6b618e9ef934e62c1ab3f6e1453dd
SHA5124c70f7b2eee7a89911d6170a676d442e4f642a95bd9d7a079fa4df3efc6793692b9f6f626460c904920c2d4d5ac6665f480d4381d600b017aceeda7ac3f0aeb0
-
Filesize
70B
MD50fa70cbfe7103e25474eaab2e7d03300
SHA15a525d2b877b4e8515862af9e814dd0b37bfffb1
SHA256e196f3d0751749a91a17ff140a3f1a1ec200f1dcc488822ee045eb48a8ee3f7b
SHA512bc95f7f5ef1143464e3b16cb28a633e45c14ee5372abcd6bc8ab02e97d670f7e6a3a15ab0fe466d3827a466c5c2468d67242405af746d299644ccd10edb4f2b0
-
Filesize
55B
MD57f4e92ea0a9a490a44d9990190207c37
SHA1a356911030672a209081c07db9b6b8921f490d46
SHA25677afa2b2eebc3c9bf82cac2d4d5b02c7d6db9f607182cdd89276c80bba47ac26
SHA512d2a2e894692e6a4548d2fe9a4a086bcb093a3ecd6115e643deed5eec0f25e008bfa6dcb2b2f86677df63672a8c1ccd08b1c48003b0666614e037cd4846c71cbb
-
Filesize
45B
MD56e6f2ac6b3bedf3c582f51fc01f642c3
SHA10c051ab8a48beb8b3a936c3c1330ae53e14b0f6d
SHA2561f39e323a16e81e6b5ecab3334a234061990118603a7237344cc1398c5e72a5a
SHA512f9d4bd04712142f40d5db3124dd6377ea423ab495354fb78c30b56e5a389f4b810523892659b026e5ddc2fd5bed4eb3babbb96cb02365e77ac9db9297f32da64
-
Filesize
214B
MD5599b4b7138b27a31a6429b494e5d4d2b
SHA1a6c836d17165f8908cb6cd23cc9b85cea0cad2f2
SHA2561e1f75359e95297618e5e57c251458e58fe6e7c7d79f1469b6026affbeacce98
SHA512ef4fc55632b36c84dd081e080ed605d8bb02187a67759deb8a3e1cbbc6bbdef2eb87ac40fc42bdc9ac36732c906fda4fb9e45f1175c2a1d9bda6e2f5ce86563a
-
Filesize
79B
MD5c327bbb664404975c889de06e7910e97
SHA1998e22616d99a15f95ac199b79b0dde50257aada
SHA2564b59a0ae0fc426473a002a384a9a828a7126f94678686a6f3d4cc98da5bab0d5
SHA51279ec5da1adfd96fbfec6af8580a1b4ef16af1326ed317e8a05b53bd76115067ed2a7064f9aebed8a458d7d5066466451503e3d588592df13e9f096b0c97f7cb7
-
Filesize
490B
MD5b062d07afc99d4903214b76f9cb40531
SHA1701b1b0ba55f49f39fba4579738cddb85b1f440f
SHA2563d9955e51486bafe6f28d27b3da16493165df6e5448b2b6dcb8f3b82147a22b4
SHA512342f551fb9dc0b547e63f0cb2b76cc40616364dcb80e989c665ad1d513923b0172d9a86fd8c521ad3eeef4611105437b8ce5ad109e45f09466cd8c9dde9d8251
-
Filesize
45B
MD59f8e738b714168908cf29a72e2eebe96
SHA1716a722809284c9e51449dc60aa26a7468b4d2d6
SHA25631dd860b715d5587c31668be4b50a51f1baf38a47fe294f8a866e99ac93b6c91
SHA5126841682da33eb087687147e94597972a1c7fb7df15f89b170c39f370cd92891893b3c6e7b5446d05200371a7800bfda364351bfce3ebd9ba0fdf798806024985
-
Filesize
70B
MD5eb364badf4b2abeab637fe547c26df62
SHA17503755c6901a11243c3c90e1482565a5f3c5d37
SHA2561162aa2feb97aed9ce3990ca208855a958552debc644dbd58938de8274266d26
SHA5121478a27d52193223e71226ca1a03332f2dfe93e179d28a33f72e3dd4bee7a7b570b931b787927b3245f0aac598697f30640c6fc8418fb78b6e8107f23d5421c0
-
Filesize
70B
MD544fe707556de8e4330b76c2ec0e7e49a
SHA169030f8ee795ad86d3e8dc0b02bd74031799d395
SHA256544fa1e0eef9d0bce8c88d0ffce94e543dc851f144c51747769a820ebec793c3
SHA5125efe8b9f055a0d4a46600d57ae788c51413bb96c5de7323daa78260d43559242084e6e3a2de7d7fade303efa32186406c6744de232b53077a6eff190315a2a7d
-
Filesize
68B
MD57e72e9a73d6e9f98e2952378c1553108
SHA181fa8755543348943186603534513c134b29ea6d
SHA256ae527cd8e04779f58dc577ff7e580996afaf72614b95462ef39625d99c95eadb
SHA512859dfac6aafe3f64ee9a5822aede5d23ad443f8706749317b02e27c38928429252e15c3a66b8645bb55be26258aa6f7b540eeb0fa13b1c68ec8898aa474cfce6
-
Filesize
52B
MD5d991648aaaad6c18603586a20919284b
SHA1d27c70bb17e067c2edafd9c5d11b02a42bc24a23
SHA2568d5e6b0781809f4e3ee15ec3b018ef24d2985dff0a2f7c5a527aa9980865c0ae
SHA512dac8953475ee84bd161cceddd4e70016ee28329f39e6512935e45b055d496dcafaed657ebf74048e9d6066af9193df67a0d2f5a617de17ac1583495acec0fa40
-
Filesize
70B
MD5c953195bb6361bf2bc07a5015aec41cb
SHA1e3d42dd8a28db154cea439be563c128aaf0ec935
SHA256931f18f6a9783914686a95ffe51fa46771ffc866303f0be018a8ef9fcd65d83e
SHA51203fa8a3d0ef41d3a0a65e9d7ef96cf873a48023b03c6a8070e63b3c7c89f39c73c9e1fa1883e9c89d1fbd5fa092096cbbc2b51caa479193dc4f475ed248ffacf
-
Filesize
55B
MD5af9436ada883adf71513bd82a1622e90
SHA12ae48e9a9b43bd30b16f7baf8a75c051df29cbfe
SHA2566dcef17cb9a722c38cd37066b0f3eae13fc3f6ab8ab4100ec35a1950912fd9ff
SHA512f97a720f386211a1880b798bf25880aaf3f940574d1e490d7b9fe7ae3d91475f344dcd89923903bc6ebe8c5fbee7b3f6b47003e399303b58c2c164c32dfb3dba
-
Filesize
45B
MD5a0429220723bc993e6f6754216df3e14
SHA130559bed8605e2e079a889ca262afdfa1d99a94c
SHA25657f6c7a6a2b2b3e3fec648a17810081cf53f8145c4b9a15e56d327cd1979e77e
SHA512a09bb7df2b6fc375349e2fcc1456a96b4d15f667383af27a395d98591719111d02b9c48175a982430e4298029b7901f86941b2adae0133e171d6ed3d7bc6a798
-
Filesize
70B
MD548e982014cc1f461b989a5f816df27de
SHA17d190fd5e9663a5b994826d5940c747f91cfac85
SHA256042020e0a7c4fbd488331b1ad10fea1f12cd98141af12ead866c75a1af74b074
SHA5129e436182b57a74157ac056e91993c2a681f76422ef548d19296b757dcf9e3d299df9bfec9c2f9dfa8a76242aa518b7913866c7b7a6a6ec6d5bac59c998647a11
-
Filesize
52B
MD59cd3b4770715588a9b25ea46d517b155
SHA1be956c2e26ab161b2c244a435f42266558915ad6
SHA256fbe42e9ead95fe21f981c8fdf263256da7741f6bbe9599fff838c152100e7b7e
SHA5121c2716ee3669b6bd35e7e9388888f5bac6af8e6cb0833c6e8a7f2dc9feaef6e6147d421fdc5225f5e69bb8623d81f73ecd75bc2c0ee9dae9d2d180ab7e64a4bf