Analysis
-
max time kernel
148s -
max time network
158s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
13-10-2024 22:00
General
-
Target
110ea68e563301cbc6f382c31654cdec8eddc666e104fb469f9ffb505ee0b363.apk
-
Size
2.7MB
-
MD5
3190c8b1f950c52e59e6efb0d47e1e3c
-
SHA1
a11eb6c5ad9b27ed4cbb9b449097cc8b60e98e54
-
SHA256
110ea68e563301cbc6f382c31654cdec8eddc666e104fb469f9ffb505ee0b363
-
SHA512
fd9ca64aca68ad8b0aa55b9b55094bf82e425155ccb97658e54131b47e3eaa6986bcb4038682f8211be1727b5ba575dbf594f7c99f9871354a1bd7ee043296b0
-
SSDEEP
49152:UMygCkm6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQK:7ybkmFjEI4iZaUzYH99yIT
Malware Config
Extracted
octo
https://80.76.51.220:7117/gate/
https://80.76.51.220:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.220:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5947bbf5663f722a25b72d0fb1f1c5fab
SHA169f5450e558bbe4da2bbbacd7f256a68d4fad2bc
SHA256dcb4dd0049ae33b1eaaa0c83986fff5a3d596d4e189afd4ec1d5edfe48110883
SHA5121c6171d0d418359ac39e318bec9b80a840787377c31bbbec9f893f711b91281dfe646eceb8a2dd5069d8ececa2119ea466c31096f806d794179b127503f18e80
-
Filesize
68B
MD5ee7760df34545ccb45511ed0cf4fbb15
SHA10b434960efa412027670fe76d6be26014873dd05
SHA25622ccf0023383354fd88cd54af76fa649b79f73e4cccb33f8ff6b711b66d3698f
SHA5127136d0e8753e62ac15b0eda789c084c2f35cc4956e046aeda92bdf74f0b367b3a09db9cd827de8b10c26ea7c2c73aa0d1e431c4b0e378395f908399a9bfee5d9
-
Filesize
214B
MD5a567bb5f0cfbacd9dbda27a2ee9e8d79
SHA124fa9faddbd2374b168eb03ea3da64801b70e520
SHA25658ae70fc6249a4531208863d9a3f3adabc6a0e288b4336101fd2cbf94dbaca62
SHA512b042e3023431f65c5784342c2a78499f63967f36021313c779ca8334dc855234746d8348ef789faa3cc44de2b88e675c3946007591510f42969c2449ce35935e
-
Filesize
54B
MD52a8679969d62aed1d000cb0b8462d0ca
SHA1621d718708d464d65a523555daf600cbf6e271ff
SHA256bf064a51a92fb7015b008f304ba54de18aab967cb236e12a120d6342700b849f
SHA5127b6c35791a0c16814191f428f12bcf1d75ed2224659d9393f80d311fbe27c02dc93e4f93ba1ab6f97385955b35e8176fc3a0ac1f5856a2b86b16dacb59e6981b
-
Filesize
68B
MD59e07060f91aa8dc3391d01719f5666a6
SHA1efd8e0cbdd18d767738726664aee62219f378fa5
SHA25656b46c078b06c51cbdbffb90f9d4c2be8fa1ea0f9dc130fa27e20ab420bf5ed8
SHA51228014dbed5b16eb3c3d619c8cc6128461b853f290155cb917544db1dd262ce3bc96f25bfc33794e4054459bb5a645e6b2851f81f96dd16737bbe124374f7557b
-
Filesize
60B
MD5dd78ed26021ab1e65cd04644ce88f995
SHA16588bbc0161e670ec845099f7c3f7d0a8475486c
SHA2560c271000a54a9ce20c7d6efed69b3b165ca8c4ed0f4dd282b807258f5afb2c2a
SHA5128bdbe79300813abcd9e4b193cc1c03afb51bcab95f30e371af1cd10f0d685e84aabd459630fa9eef3829f1c868395eda45869f18a3e3f6e17327cac9c30804bb
-
Filesize
490B
MD5ce8c1eb510ce3ea94cd5e164d9c4cbb1
SHA1950dc960a5910213ab2663d271c8d9515e5f26c4
SHA256927376c76fecb9c76f20003d2fcfdfd5d4fd93314a79dad589cae0f62a68f0a0
SHA512cb6a2e2ca661c5c78946fe9d331563bcd6b7ea0be99db41518965ccd8d87fbc0f1649b8d49ed32953802619e140ec78da5195a23f62dcf8b74ac0e68d3ad6f63
-
Filesize
60B
MD5235260ab092a9d2e811210f34eb90ced
SHA1343e4d9d764e829d36678cdf5123ec4ca88619f1
SHA25610d1aaa041614ab58f4e852c07853fd5a09721ceaa181cec6afa5b29090f1980
SHA5124ea4c34da80c772c6a7b9e631c01eb910208a4e6c4f5ef7d86f274a312e5210579372e040e355c4d70545f9d2a5445e8603f2cb450c366ac053725e766f257a8
-
Filesize
52B
MD54de59a39578dc2a50c0b1314a748da1e
SHA1438ed2c09807b7f108b2cda008b513f20c5bb2c4
SHA256d3431207f9c66974a5269dc06b4742bc7b5104863d1f6c6e70a89a4b76f4cc90
SHA512ab9025ab71d456955cd17de4e6020f680149270305ce7b562bbbd817b82481672d3ba2985c7ef7a531a9e486211950e155b89182d50bf3bd53aa27207277bcb0
-
Filesize
66B
MD56a837f9f2bcfe388dc09664e31a1afbe
SHA1a71577fa633ff253610f7d92e136584470015095
SHA2561ca2edfe90e8c76bfac688f84998d22671be30eeaa29d2577817b9e6c3fe6e8d
SHA512584ec43b27df469ab2dd548ac4d09a2cd911884458647afd1fd21459bbcad2b15d1dd1fbceef881d669970a259edbfa10651c78625ffae3890704dc23df8ddbe