Analysis
-
max time kernel
149s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
20-10-2024 22:04
General
-
Target
26b9f7a2499fff5ddd0754763f73dce3defea9db7a7b3d09a48c51cf45197c34.apk
-
Size
2.7MB
-
MD5
158d5d90962d81339dae2c71bc6df0c5
-
SHA1
837065bfa5b96fa597026305e015b9e34f30ddc8
-
SHA256
26b9f7a2499fff5ddd0754763f73dce3defea9db7a7b3d09a48c51cf45197c34
-
SHA512
344422c5e9e8d203b432b333ea980b0198ec358342bf53c8c3be6f6185d6ede799e3232964c3b3508854ba1432c7c78dae78a78988e59f58407f289833e2232e
-
SSDEEP
49152:/PI6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQu:HIFjEI4iZaUzYH99yIl
Malware Config
Extracted
octo
https://94.103.125.223:7117/gate/
https://94.103.125.223:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://94.103.125.223:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD505d4588ec24b35ce2f312c51479188be
SHA13bdb3b7be6a0acba604258b0027c655b60a5f27d
SHA2569e025c50b02f38d0d72cd744584cfa72be5309a7fcf23332adcef037383e829b
SHA5122ff83b858a78cb643567cd3d79437fce57ce9b5cbfcddcd7c08d8c2233beec91fddc14c11769a8c737aedce4c79a43e7091561cebe979971b9458615f86311a6
-
Filesize
66B
MD55e6368a33c5f1314281825b759568e15
SHA14c6609e8c037c0d991faadef2847916aff0ce98a
SHA256010f9847ca7ddf06f590363d002e6257bc23b03666717ebafa118d6bc1b82f92
SHA512a04ea2bbb7b2ad8488cfbe17b6307dfd120a029d98894fb8806a26c2c42cb4f627f4a0427fe15e4fec732a6e76de86999b8924c7692a97d40c7dd9117d931e87
-
Filesize
84B
MD5e9d01ffcd004a6acf0ff3f531bb4bf58
SHA14ae43daaff1ad4906ebfe66f37ec7f0818c7d4eb
SHA25687803ea8dbf861efcb431bf2bb30fbdf0a177dba272c883445712de7b948235b
SHA512e37350ab11dfa4e89b830c697fe824ac4a034732ef860d7786457906edf36b6ff0846ca0e8fecaad9f56fa0073227f5ca2a491fcfec9a10f8e3e72a43b5e650f
-
Filesize
63B
MD53c30847f8b22dbb49fbfccc2859ee851
SHA1862f1a976f6c599725a6db1486ee369bb1647753
SHA25647225e9dd668336db47688128814bb15bdf486443c62db38e73457546194982e
SHA5125d1a62fcf4c3ac9dac5f7583efebba5461389453fcfe6d2a1bdafe80641a235e53158f05e775836e376f778ee8835885578976cd78155501a0ecefa7733c1187
-
Filesize
58B
MD5056d40a6e0139314318b9d4d59393e85
SHA1a5fdd6afced6c7789effcb59a84fee73480cd678
SHA256445ba3afdd5ae7848c4eef15d9f7c8352517069e4b8b2733f273a29110554916
SHA512a919192868ec8405bfe87db6d728d779c565c2623ddba1db73894a53795fd9052b866387759ea114df6fcaa60038116f89b2e6bbc38a465cbc8f659ff0571230
-
Filesize
230B
MD5fe125bd512bf207015b734716d5ef01d
SHA1fc4fe186f44ffb1b75b43b1917849e2c3aef2d1b
SHA256212292c0804e505a65fcff5482fa92f189ac8dd7e5520f0385b937dba16846da
SHA5124107b47d2fdbcdd780d61f8d0aa0bb8d77b0b78e956dbe876d07f7a0db72e923655fe78c1bcc49eaad6d887eb419bbd69d5a40d9b64a61257f93ce7e37dbf24e
-
Filesize
45B
MD5f81193f42f6e83a8fc6acd5c0e39b00f
SHA165d7d85af2c2982992c0444b7ae99e9922e563cb
SHA256a6b75c512b0d5e4e41d90d4e7883eb69299322740e664c86e88a88ae1366685a
SHA512d246f99ffd3abdbddf35507aeaee5848240c824897387fa42656e708cc3f80f3b922c2db75006f020011d61a552863a6294b913762f2b21dae32235e1d032f6c
-
Filesize
63B
MD54cca8bd9aeea4cab1a47a4aba56d1d2e
SHA17b63c0eec8bad65ee05d773554e6ec12ccb29b96
SHA256853cb506e63ec71e78b4c621b384db1a7fe11262a497a51a774237a48b9ec0e4
SHA5128f78b9b8b376b60fdab47eb084274b0352b5ca1bbb4b13b6abd448ad03ac461227387705c2e98eb7d5a812f08663b0c41a7908ae9ce5a46ddff6e67943687c6c
-
Filesize
45B
MD540ab7c5db6c637fb7059ec71f2c8305b
SHA1432bbfc4fd285c86b7cf482584115dbd52c7ec1f
SHA256f38fbc8d309ff47b45f33f7af2e61a1313f424eadfe147181d1eb2db9ecd9f68
SHA512265383b410bab93d6d161eab3ea781e60b4af53973f9dc5e51f151d4f5071a6b5530184994f35170de64131ad1589e9055f3a869ce1fa89d6c20ad1cde17e803
-
Filesize
466B
MD57a3b6cdb698908e93c253589461c5a27
SHA1957f715e6e5234bfea0dde60d1254ce3a86b2071
SHA256fdc3513ddf1cbc097b51435d484b2fd5c95cea505ea4f620d6981835daf9f4f5
SHA512ad917c6c842d52377064bb6209358890a17aaf1ded41041d2d5c3757ffd8e9d0498a16391b622588cffea3ef2b97113d12feaf803777221d81bf3ec30255f631
-
Filesize
63B
MD5036491d4f5c11cbb70f368d62354663b
SHA1eebb553009f4cde2513a3e9575642b486226fb57
SHA256da80a0b06018b8dc369011f4ece2668cfe734a2ca5d86986fd8fb1ae1ef901a1
SHA512366c405a4d2ca8c71245c786868e5fe26e72db0cf36b1bb7be0162b8892702d30aa731ab277f5864a743ae9e610da62d3257f016e8278af1623e03bbfbadd4de
-
Filesize
58B
MD5250dbc661507d14b9f1c46cee810a42d
SHA1fe43a9f11cdea499102a83b85b9dbc7f02e07f5d
SHA256b182a70e8132741395b78c1040a26e5afa46741e722331024483a363e3ef4373
SHA512d33c7a53954427cbab372e84e8cffcbbdf13c360631e14a6d5051eaacb818b2687a88f3aa4e0dc267d25a977010e37ae2681be1bee58e2a51d4c3c0a2cc3951c