Analysis
-
max time kernel
147s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
19-10-2024 22:07
General
-
Target
29b9e308df9140d4569ff7acbd02ae35dc5d777a6700b6451abe476698952534.apk
-
Size
2.7MB
-
MD5
d94a6401ed4141f5fd62ae63f818c587
-
SHA1
9d5ac03c7041643da688047d85f8ad057e6cca91
-
SHA256
29b9e308df9140d4569ff7acbd02ae35dc5d777a6700b6451abe476698952534
-
SHA512
721c5539440195c5dac4bc74b7e8da59c4128cb7c2a33db6b399ecb49ac6c4a4c3dea4612c80d5150528bb01e27176cbb7e776627e61fa78a45cc02f5e429a79
-
SSDEEP
49152:UMygCkm6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQz:7ybkmFjEI4iZaUzYH99yIu
Malware Config
Extracted
octo
https://80.76.51.220:7117/gate/
https://80.76.51.220:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.220:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5db3b203793d5655421e5f3563396d4f2
SHA1e48a99b93886391b0342561b3f886d1cd914b337
SHA25622059a7c1e8de6c70c23cfda8853ddaa985fe8df1cca1f051bdab24a71f33d12
SHA5125d7d7d28f44625bb7264adf859df08225e55c2984b0282c8f6d4802034a5705d644ec6d35804e949437460806be4404ba27bf67bd3f9e2e41c10cd7e3a6eb062
-
Filesize
60B
MD5b1377d753bd5cd453468f68e73828f45
SHA16e872dc5af8798f91350f991997542e27c264f4c
SHA256b0b6c9c873047516fe566e695e2170396711372a22c854aeec6d77f9883ee61d
SHA5122897bc81af47fcf74bec73291f24ef0f44827117a5f6188887516e389e09a11306392856090782062df8cbd5adc0b9c4e6a06f89189182ba685a02985401571c
-
Filesize
52B
MD5d63f231a7fd135e6462e4b1f6ec6af67
SHA154955b8b7671d415b2d97f432c662a2f1cc15573
SHA256a50e0d9d1c6d440f4a21912ff57cfb337ef99dbcab6cac4c8737c3f510a042d0
SHA5124a22bafb42a4b924270b56278aa282981ed2379680396a13d114a7528e4de649ccf2c5c5ddd384dd5782a80328f2d4b281c94359960e58ae3221d20a0c7dc648
-
Filesize
70B
MD514e23604d3ece96195f086ea9f378be9
SHA1b546c8ba47c4f1fbb6cd1c2333113776f1da75db
SHA256e96726a53c9b6e0a98ac947e7d9f5dbc2fd0f60d928aa743692064bfe9096155
SHA5129203d1bef36a0369c13a7c5c386d5669599c36e36d57c7479cff1975d2623d0b8c16cf3f1baa6c66dd6816f763b8b3230aa7a3824da5eb6e848a84d81749fa5b
-
Filesize
55B
MD58d86d6847baaed8c407c8359ff8865ef
SHA1d1b2f10ada14bbf8cd49ba8c2b71a2ac19fa7bd1
SHA256cbc864954731faf3d5accfaf1c01775ee9bcb2bfe4ec0ed9727ba5eedf07e173
SHA5121e6b170c42013f0022acd758013faf52490491d6d489d39c0af7aeb9f96c547e85cfbf563100f462ca9298b493dce663c368c6e89386248f39165850bc2ac9b0
-
Filesize
45B
MD5e42fa57cb147d806df6c09ed0538f523
SHA1f4aa0b8f9cd68b0bead91e71b1eff48149061093
SHA256ce27392edd225a6126d158f77ef200562b59c4bb26a2481934d369320f8248a7
SHA512c35e397f22faa66ed7529074755c1ca4bf956b114e83b28744cd6dbb3ecbe8f620a90a4d6fc96196673748312e5696c98a2cb65375c3c027aab5f5501dfd4f25
-
Filesize
79B
MD50a4bd504df09c92fab14eb70d71c4ccb
SHA153ead79edbddc404ddb926deb5483ccff99b4314
SHA256aa4afe0552b659b6a9e2aa58d507abfbca6acc199ee4671d52a2a6d7995ec799
SHA512fdc2937ff25e2709b19a0bcb86a324ed6dd5253ee6b96e86a3b1232d91d74e67e542b2756a9a42f181411de4fa15a05b5d2cea64c7b95dfe30196d90ea54440e
-
Filesize
490B
MD5b2235f237fc1fa3e179a4fcb037c7f6b
SHA10058379fd4acff25471359b9f50c32680451f076
SHA256a475b3c3d8d47d16551202349f7e0f6e7d0c7db09224d1efcbdcb06c2a21b5a5
SHA5126438c08275eeb93934c67187a003823c5a8683264abaddd8a5f037149295d8957d073da52b7f93ffbeaf1ea962e36cd6ca6ef31000d7692ff32521c60a1b0e84
-
Filesize
45B
MD533195165e7c951821defa6581c8a14b0
SHA16619d8167ba37ffee76858b52a83d2afa9e0d6f9
SHA256c874250f0cef980deb9bcc32b571d440622b0c584fb3ccba9e6ad381636491e1
SHA512a5e1cd51bc47e24c7de34f5ca211a35d7883cbfc09e3e6fd5fca27a3f26f8c2b5aa33a77963b089f0d93347561bba0d37563bee2d874061e4b0ced464cb31bd7
-
Filesize
70B
MD5988b2737caae396a8ed1b7819cfa6561
SHA1ab81f77a23ba8c79118b03f1c7ee555b9dffa1ce
SHA2565fa30c4f57ab283d09e0eb33b06236b8bfbfa4fbe54b9b761d1c22178a979712
SHA5125a0bcf054f232c7f6010d28917470e6a4275c7be0fb7c5f964d55b3d76ba68fe355875e6bdaa7524606359cf6080a6c62386cd53a4136d7eb45a63c6633c6b74
-
Filesize
214B
MD577e085ac0b662c9ef7b7fd603c2d0cb7
SHA197a4e6d26b07baa67b36b2a11a11426f5e28200c
SHA256dded1d85ef1a034aa317673ea708ea134e14c409d3f23862cf47e70d1d589998
SHA512c956bd2d52134b35daee5a546ee8d06273ebda09f01397c3b9abf519ddde517d6c36c934a115d95932ab36240318639cab524e6c7e009ec5931e9614665ad577
-
Filesize
70B
MD55cc34bcfa7f77d43abd51d6da50ce7aa
SHA17a817f937dd775d77256b8337666008511d62be4
SHA256d8c99cccbcba69c65e25d65a1b96d3ce68ae3059006fb80a4e7f66545676a99d
SHA512a6eed72edd70e77a5957b585f88e976f397a3528990a2e7d462b044fad880e25f31767ebe01cd1d48b37e04f9ea412d64f74f7d137f80793e7b4e01bf411caf1
-
Filesize
68B
MD523d3ec840cc9f601f24ad77e9bbd8e9a
SHA1bb03539475df4858aca6d066410659e5801377be
SHA25684594c2afb37bb80ec66900fc9b4e4956345d366dda59d318c83605f49cdbf51
SHA512ac52ac8444b862ef6a77ca7512cf5b4c5b27be7d428acabf98780d437ffa54d78fa63454e0120eb31e0c6de70f5c76a822daf098fbff93602b5ce3b708d1aac2
-
Filesize
52B
MD5d6b45d43d1a388453eaff69fa665f91e
SHA16c0eadfbc90ba9ee123b8fa6bd0fba6fc0b7af00
SHA25640bf9ca10246f0caabc69995daff7d273fb4d71d13875449998ff9b276528282
SHA5128aa5ee002f8fe95e151eae6f6f72bfd97d8966bf84df28cc0bf0ebb6fff70c93ab98f06a7ebdae84c7a0638e7bb0a73cd5c0c25fbc333d03360e0db7b8cc1a6a
-
Filesize
70B
MD5caefb94a8fe4f1abf35d26ed2a37a12e
SHA1f6523045e60ad7180c10236e3e20d2e5b9740eea
SHA256385d635342d402aa392c7312ecc97208fd4598eabe9c88513e0f603241b9803b
SHA5121e0b2c9d2acc4bb36aca8ff27f2fcac53e48a1457061428373746e44c660f5e711e24306d6a194c9c97499f5aa848ad587d77e4c02954cff2ad29a497cdadf83
-
Filesize
54B
MD580ee50b946df020814b1a61431b38880
SHA120831617a883b0edc69d73982ee49620314db4c5
SHA25664ecbf6f75dac159941b8a412026881d980a3b13766224897fd14865e9831c08
SHA51248bd97415ce89afb3eaee296ee31cc3bd02dab8bad11a5be28ecfbad393241e9a8612513d8cead363d35f0d78bfeb31b6f822d0988337883c5616164b9d5a841
-
Filesize
52B
MD5ed6da973687c4508ad890ddedf28adf7
SHA1d813dd9fe22a7b2b382fe0c68cb75da34b95ca1c
SHA25628b7ac90bbd9c26c9ba6cb8a1bf8e4354dcfc00a8fc32e5c8c3bb0f5f385756a
SHA512ec20810cfa68ea2c805099d07bf313a68f78dd667b4f491de7711f5f3be84b6e483b099eb3e44ae5033e9d04b8cb0270ed5cf647f5f60970150e83738a722d40
-
Filesize
66B
MD5874bf7a9cb0208545dfa09a5d1d4a900
SHA1b9c7ff7988e3abb60d97c85caf5e1fdbef5c1884
SHA256ce49f2da0f4d9c021b071fa2a057539892111212db756510ec6c60af5fc13d66
SHA5126a5d0fe9f1e07940549629e89b8eceb6b2eb6a06dbda9cb79027457546c853b7288e543a327f575ed7a5cd7e9afcf63836a9054bbdadf989e235f0a99a0ada52
-
Filesize
84B
MD59cbbbc5cece429b94eb58f199af2c9f1
SHA1f3960838b950c1f61f46750370aca677bf750533
SHA256ce1b469c81020a0b01f0633a93c4521e21150e25415293f4ceab13765eadff07
SHA5126d235913c501497e29183fff048a59ac2a5e1fd705fc5b25472092afb4b1110b390b543fa77d3804090de04578247494e030fcba438ea70f71659c3e72c0a5df
-
Filesize
68B
MD58a7557026178700fe24c3f53bce0e819
SHA109454bd37e5eb9072b01cc66b3aef2ab42f6f8bb
SHA256dbd2348bd2d5c6d87ac56538ff37042117cb806735b58008e754e22b628050a6
SHA512afc6a20a27c202a74f67bcd6f3590a460c6cc3f118c15c28b64e12616b09005dcef7ace0b2e04f95ad927d86a347fc673ca7e077080551e7b408ebac12bd6278