Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
19-10-2024 22:12
General
-
Target
dbef30700bb3d66d80bfb18dd50e267ba2a01032f68607920b131b3617b0b0bd.apk
-
Size
2.7MB
-
MD5
56800343974809c14da7bc506696a2ae
-
SHA1
521d5203e9e1662a583de06daad2f819418d3104
-
SHA256
dbef30700bb3d66d80bfb18dd50e267ba2a01032f68607920b131b3617b0b0bd
-
SHA512
4aa6099bb2ed7c181b411804d25bb3352e933d0723333971ae6cb8ab1d64097c98d52dae99f9192b5dd5dc350538644e31e53f0d35e716da43e1f22ff0dd7635
-
SSDEEP
49152:Eij92W6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQB:Eij92WFjEI4iZaUzYH99yII
Malware Config
Extracted
octo
https://80.76.51.192:7117/gate/
https://80.76.51.192:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.192:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5d5f4c51ebb5ea7c63d35627993480b89
SHA15e8d7b4dc612c0a8193ed3ccc4b5541cce6c12d2
SHA256d41f04437adab081a57c5231834c3fa5f31683c351ecab09723ef58f1f024d9f
SHA5120d58a22f97fbbb06017b21d6a48a4eb6db5b9bc86988ad72d706811da287f175b22804bc870cb749b338ce8c5a1d34a972875bec367d04fe5933d1dee0a1d25c
-
Filesize
68B
MD5058fda5f89efd3db20845a500c721218
SHA1ce9f5a41eea0adb674628845966d5f61034fa0e9
SHA256491ccca4ec4bbde0f899ae6868a1e64c03f4401fa12b94b3dfc13e9432c0d988
SHA51256f1b3bba627ef3ea31f2f739d78e4609861f4066e30665fe99926d4d0d54f15ec3ef7615e890e75323959c474d4378e0d8cc8e39d312bca85c8770732bec141
-
Filesize
68B
MD531d18abb42ed6a1cb818511dd66ea639
SHA199f79352c59e1b339ba277f65bc22407bb6472ec
SHA2562dffacdb989250a31a8bda88fa36bfd04ab9970100600acc6d1e3b7b7b1d1660
SHA512c12f827bbcbdd346ffe3ec0b39060b0f3c91807bc6ee88df2e502d313a38a08d621216e521e1f9db66fcf1fcca23d71ab04aee361f87d3b0d33b6b49e9938548
-
Filesize
214B
MD5d74998647cce9e8f1fc98354a42ddf53
SHA199581186e6fc6b2c662324bb9f8479027c0c15d1
SHA256002b9ce6522b09804e9ae316558e3a6a14792067e619048c2d5ca206e5189736
SHA5127e122969d0eb0ab740fee0c87e4e8b87a7e4ac2dfe7678355d0786971c6fe997ff81e98110bef0f6dd708bb0ab9cd4442756bbac0f77f94244bc058c2da29f99
-
Filesize
54B
MD5f78b4969d4a6dfd08c1838dac8b41c5f
SHA10b609173e2819d582fcbdb082f39da87590ca612
SHA256edd78ead7f2b40bbcccca34134d71a860005bece3095b5fee6e99252dcef6000
SHA5123524814a0dc1a1ebacc8e0f4f38c87c764f58d1d6b6025d1e80ae2b1f9a824794177bac9ecc0be8936fce00187ffa525125c7770741fa15272e231d88245efc9
-
Filesize
68B
MD50449c6264eb26e7d06a075c0554bf875
SHA11c821972d1f405362db7af2282d26d0d130dcc02
SHA256657cc11b6c4baa09178f586ee6e79f0b9849d5a3678bcef4165ac176aff74f92
SHA512dcd8b5058d96610fb6635278f4bbdd115c2f9ba6220fdbd905c78f2920890580af9ccbe5de0d5f33adb2403fdd024daccfaa64575933f2d4f89e1ee370e7396f
-
Filesize
60B
MD56c4196732016eb271341f1b8993d9fd3
SHA12eeb308be69fcb2fd10e3a7e9eeaf256f5333315
SHA25649299e544a8f1a7be90e616dfbbf1b5d4c86d2d321a13ec6a2996733de646dcd
SHA512aa5c4dfac8716d7e97343732fd2f08d87238e798545e6f06009a86b00458ac3305203512d808713048211b85f3b76bc64a9e874705d59e9936d554309d551047
-
Filesize
490B
MD514e17152a418dd9086c9097314bea023
SHA18edc3b788b6fa70dbe391e506255106d95b62642
SHA2562e1ef304aadf6d8f0504f9c4db7424c49131178b5dbf72139f153ee42458570c
SHA51246d973943fb8c69d4ef00a4419f99e1b4937a522a258c0a54dda9317e81eae706d232cb6f0cfc17b584297474cb37afd9a2375ae065dc263eddd28a698580a36
-
Filesize
60B
MD53fab36b77bad9f39a3228ff9dee2bdd3
SHA17530298bee32cd9b1419520f7c374151b228e067
SHA256bac593acba6d2bf413a825c72859bc4e1d39cb5888f4a5d9908a5eaa6f957d1d
SHA512191d134a98971f10a353c69a6f6c539e59ee1d60222bdaa1adaa379450b1e4a3efa5ae8c8285d23fbb4b6518b353eb8b32241a7afe27d5451e5dcad82e8be27c
-
Filesize
52B
MD5d36991204df149e28b1ff57632fce907
SHA1ee2bee395e31be0a8d2308dd3ece67cf859cdc78
SHA25637f69f9ce336e28167e9219f3271f4db138f9c36948390d3e7b57a5fcc069eb4
SHA512c21ccad20e7027f903e142f230e3b84d338eb112ab80acae1614b1b2ce7d32525ed3e399e35aa860a2bbb78c8a89b3403aa1ad32cec66b5981dbed1f73a2faa4
-
Filesize
66B
MD5a1d1d99615486c30a99eace46afcbea1
SHA18716d56df2d5aecff2fb2bb7768a90f4242314ad
SHA256f508ae11218a625a6727c67ccae5ea1758b78accb484700a257103f13bbb5e96
SHA512e8d022e49f39c389c7ea6d4a6383d7a059c64922f3a924c13f35b698d24cfe6cb374f08d3b3f35e6a5124ab0bbce56ebc7493d144cdcff6f9e757569c558818d