Analysis
-
max time kernel
148s -
max time network
154s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
12-10-2024 22:01
General
-
Target
2867daf83c6e61b34e7c25a807083e848080fac75472c1f77da591ed2577aeb0.apk
-
Size
2.7MB
-
MD5
57e1e95fefbe8e869459c59bee1717bf
-
SHA1
c6d8cc8b91f29912a1078d53af45fc5c962c2068
-
SHA256
2867daf83c6e61b34e7c25a807083e848080fac75472c1f77da591ed2577aeb0
-
SHA512
aec3fdced06895af468349ca9d4cd613092298f913444c7932c7cb93a2073ac0097aa545b6713f35e0b8edf112a5e2f1651ca4f8af900f8dd375ddccb98dfd31
-
SSDEEP
49152:+H/4CZT6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQo:w/TZTFjEI4iZaUzYH99yIv
Malware Config
Extracted
octo
https://80.76.51.218:7117/gate/
https://80.76.51.218:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.218:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD56ce34b81177cb7c559c55f9a4d804817
SHA188554946c4e17db1c0a3f4ea1e236322dde39adf
SHA256fe0b76ce4a75a0f40c7a42faa9966207cfad90e355bcbe653c31f0430d4a04ab
SHA512621d005c7731ebc018b5c512c31c0612479a870564d18b7eb64bbefe27ed56a67fb23f6f8baf9424ce7c83e34c7134d45481f34747515500332b3f30bf98c021
-
Filesize
68B
MD52418a0eb67b65ff8071932d311b2ed4b
SHA1e4122e3cd159eb1d50111ec37af64bc07b6aa0e0
SHA2565fb331560d41b62805db4060e01d0334ee3313e5584c8d31c8522f12f4d189c1
SHA51258ae061c352d5381e940c674ff74f94bced0e0ae6ba045a940a688d45f406001a04490c4ab66c53a866bc24364f595776ce34dcdba88b1718046137ac6a85732
-
Filesize
214B
MD58e449fdbce695211990dfee77a7d3d39
SHA1d9596968ccf18123824f49db4af08b83128f3781
SHA2568a4bc8ae583b7027a37b92d9d466f569f68b7bf0f5f99bae5ae1da5bc37b22e0
SHA512848388a71333b114ba0c8ff966874134bd93fde2125082f3204c19d0a1c0e800f9fb3656579f27481157374b260aacb72789424a1c62dc536cc68f3597e98368
-
Filesize
54B
MD599462cd019040c81b50b44bb4347bf4c
SHA1266254e322886ca90f3d016bcda7820f58b12869
SHA25643ffeeab31013201d21381e3c717944f821752b0df31545bee6be5312d7d21e7
SHA512938de3db0b99fc548ce55a0d6da9280f801e263789ba386e659c6e16a9292dca646e1e9ff19f181ed3be62010b44a11d18c7b6d03363a6364b1b7e535f0c9092
-
Filesize
68B
MD55625a685ec6e2ae0fd5b829079caff61
SHA1105a1f072ad46694fc176f0e963758a296fde14e
SHA2564999f4b0ff70ade2ccfc2de01e3923de0df3eeac45556efb995364a0c9741331
SHA512a8bc54ad09b532637266bfc1e9727c274d600f291abe97bab4499b003d7c8317c1723f3f770b7551896c5f4c4d2a7b6a162d41cfb8fb3b0d5e23425371eb8e04
-
Filesize
52B
MD5d83d2974480a69d60c5e6a7e0c18efc8
SHA10e21cc17a37376385130a1cec73ae9c78fa89c49
SHA25606ecd3d6aaa4b6a52a2873442a1afd1c3ed723b463cc3bbb9485a6c10fe78f23
SHA512c8a82abe93ff5936482b806f3b33ee8154b5d07c7ea351f33efbb55a59d39e109d3b545df8450e632e516075cb132b12d338fd7f736b605d16764ead1e55c924
-
Filesize
490B
MD57499d0c27f1da6546d7b0cc2c1c7bfe6
SHA121e26a84e9430c53ee059da74d81beca3ac028ec
SHA256be32e776d0646dd0731f2641f789acd97111029d0c7146c282d780511eba3aac
SHA51201ac5b0e6d5e91f07d55c2b26640092369cacc64172cca4fb0bd31d89dbd597fca6155932e8d13542560d74b7685c41fa593eea642244304a7ea26c733ed4810
-
Filesize
60B
MD58508f3c485def40e36fa6caca85fc1cf
SHA1ca5cc85b757d6d0e0be6f9649d6d66a206074742
SHA25613eea0b702d436a4b155cadbfacdbd2de080ee1a52346c3a76d3ea9b8488d3c6
SHA51205f7606fef0a2df6edac075396f7ec8c95d7fa1ebb695ec83ec66e1e80221a6ad06e1fed0d136ecfd26cc0066e4621012478e4c6ae93d7c755a99dccfc5e925e
-
Filesize
52B
MD5db5810c4eb7a7ef3fff0cd0109f19817
SHA1cf59971a8cdb42fcbf797015f7ceef080dc81157
SHA2567932a92f4d36166020e31c4cdf724948db74e224ff62c3e47d7bedfc47679bc6
SHA512bcd59d3112553c0b4528586a17382f9e6f36f9b90bc394c399193dba23b339d2feb77935f091d61bab897c9137c5599b08f80a5c6eb74fbae7260c46686eed1d
-
Filesize
66B
MD5e025eddd2c76429db20791d938afc1e1
SHA1943d1c678b6db5352989e721c8d9cd6db2d962ff
SHA256920ca3e55520e9675b7162b3afca0f69f1e46f7cbb412e27e17058596a841578
SHA5125b0afcf379c5e5a5fd16223722750a2c197dd695c076132d9b877a6c20163b7256c25c2e4950fcf52a719a3f9d9081b62759e1112e578d7485cfe4190b4c5734