Analysis
-
max time kernel
146s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
22-10-2024 22:01
General
-
Target
f082a77acec4a0d264c3c0b1e50564fe6c7af61847250257877a3137035cf971.apk
-
Size
2.7MB
-
MD5
7f40fcca0c6625a34b9e985e800c6438
-
SHA1
46102a07afa6f25b8f450ba0c8efcc720a472b60
-
SHA256
f082a77acec4a0d264c3c0b1e50564fe6c7af61847250257877a3137035cf971
-
SHA512
f083082c8fc198167aafdf5c96c19a2404c7a968a69d973b3524a1b8d92f02c585bc35a3bbfb76dae4f657df2df3a2ca537225b431e155af5be3e551fc6c1e95
-
SSDEEP
49152:Eij92W6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQb:Eij92WFjEI4iZaUzYH99yIy
Malware Config
Extracted
octo
https://80.76.51.192:7117/gate/
https://80.76.51.192:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.192:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD528f8c6428cac82799f50bd03402f99d6
SHA16808a4f9dbc6bc30ec507d3efb80e5ae9b7a2d25
SHA2568b5b6b42f61707b76b4b27e0ee0e2ff0e9f77e3dadfe0219d04744c7f78a0f5e
SHA512fe277e2020018f11e742812d33cd39e701dd6761f3c4cf7b9e5eb15e837f195a4f04afbe1791a5b66fb87302cf72de3f409fbb0cb1cea385c78267a5d5500d69
-
Filesize
52B
MD5fb8ccb35ff016d308a87f8ffe7a2ca3a
SHA1359621025fd086c104316e51894ede94a0ae43dd
SHA256aa827cfe825a28455384946846110940d2f550f50bd856b00d488d27ade2736f
SHA512965035f83016ef12b1a30f7377c7ef8f9b553e57669f52fbcbdc47e817739a4e5a4679c5813fb015091628230db1ef285e3713201c7b85b6c52a7ae6b951a7ef
-
Filesize
66B
MD59fe25e52f1b42410b632c3eb604a4d98
SHA174cc712041da23b9c9af6bb28c3292a4277f617f
SHA25696c65483728c421a73622b3147205050deb4c67a4fd7257e52f4c178b70d81c5
SHA5125e407eae82b0932fe05ff9cf41a3e371fcffb69b9960fbbe08b44a02f85f069301a7829206b1670a8dd6a15abb57af8e9529d81fbc212c5aebbbd72959a0a4ee
-
Filesize
84B
MD58f6ddd2dfef18cabc97f0c30b9a9315a
SHA18d713a7c84c1dea094953e968c6de2cd70fda373
SHA256c13ccf97886692a179a03ffb900ad4baeb1f5002256c7aefa00f57bbf16c73ed
SHA512ce3e09a402c16e5958f15abb0f5b52ad94628be698d3c537f7f33e6caf43f6f8f55eb535a5e4fb8b96bcab4916699cc5ff802a0ca7761c499323e422f01532d0
-
Filesize
214B
MD5ae0a95f5b20fa21174c84c4403724cba
SHA163d3681be4e5292992bb180fb606af08ea81b341
SHA256ca8b1d695f06d48209ff635e7af426a252350428ac742e4bcb32a658a71d8085
SHA512ad5e2e93f30063f83b0972455a9ccf78656629f8d730e17f9a75036758e81737c21f3ffd7c30d4cb2525afbe7854447c852a9567df6a666104fbf5c34d5c2f62
-
Filesize
214B
MD5eac8c00af56408cb8a48aaf9309eedc2
SHA103f70affade545b543258a0d41a62e193a83d228
SHA256253b27ec23ddbd99cc872a4aeea5c10ded7f995f0ef8ef6314ba5450846311c5
SHA512c4455fd536ba466ce14c265c2e6ed39f8246cc061f34d4960293f0717024311a7765feb342490e9039c2697bfa714fcf15ad8c19e5d2aafe8e5e7882ddecde42
-
Filesize
52B
MD59cc11a3d1034cc03aed1bda4b1ccb1f1
SHA1f8663fadef9ff0ebcf7fff8f8e2068145860543d
SHA256871773e6826df38a2584dc0eee490ac3278f02d6310a68bc2cc7272752216327
SHA512225e6ab1ffc070a5ebd492a6d1ee3e7e7903184c60533c178b5f0f2553806bdfa90bde5817037e4f055bf466698fd4a00d4d753312375d78fa182ebf78de59d6
-
Filesize
70B
MD5aac65a909eac375f80f7bfa2cd1a1fb2
SHA17d746b7fb133d4ca94daf826dacaa7d861e9996a
SHA25610d3ca99f7fc2aa6c5237632c2bd7517aedc14415d1e3b4ba6069a6499a1fd46
SHA5129ae605f1ccc4bc81510ad9f386787ff62f89cecf12dc7e4e10bc3723753936efbe090343fd3adbb9ccd283d5c6fe1f9016b0927da71abf78a54dda71258a7185
-
Filesize
55B
MD51b04a23bbc310e0b2891b34dcbf69dda
SHA1f4940c289dd1c0dc827a63b476bda73cac420859
SHA25647c42fae351a7474b86e101c9e5b0071fb97956ef540cfcbd02dd6385011198a
SHA5128a6a92a867133d9c741cc1ba2d64d91a6f64a570343373afe5e824f75da22d391a99d285cd5c1edf4e961af7cee38d1f1a8bca5dcfa0e3af12d813a70b2c9572
-
Filesize
45B
MD5e8e2013d1a1298add6c4b4bf975a1be9
SHA137a74172260a13b2d1a746b9ebe8bfe354107aa0
SHA25610eecb38456137c26c33bf38759a2c32935ef80c8a1aa68509e73698aa2edb17
SHA51217146b31ba00f0a9b1ba68fc1bd33769d11f11a800929e721c5a57d3d0f9f11214177378438080936007336e44c0d9e5136dd4b05029157c04dca336fdca428a
-
Filesize
70B
MD54745ef77bc2a00e69954ac31237b1abb
SHA131e6781ce9af0872ba89265b950545b1a7c89782
SHA2569296e3144b871691f4ede3204abc50a880f241791bcb61fa1b9a6790c0eda864
SHA5127ee8d58e1d969f386113d78807cb69f85222fe694f25621a21f50f5b0287c6905cfd1a156cd0b0eecf4185b867ad5b903f0b2ca469923b8c9d9e4cc006a7e4b0
-
Filesize
490B
MD52db63fe2c41fd3a3c3f37a639ecbb81a
SHA1a2b1cad4e33b5f1526a52c3c232bdde36d596cbc
SHA256617e9659753b3b56c78acccb581e118fcf4ee1dc9475b7bb48a122940713080a
SHA51295a1b427da7ae0833e10481ab5dc064bbc5d94f173c89c5c8b113e3435823e91c8766cb99f2ef48e464a097ccc4813771675cb3245c210bb359661b72db773d5
-
Filesize
68B
MD5c5d3d77420af3a11dd41041e38a54021
SHA12b3af4b593f4f2544ce1c18ab10c28ec9ac87137
SHA256ece868e14b1f1d24eecadd76579adf80ec5547e75071ec1d1e5d4fa16da202c1
SHA5129527d50317ba924a4f343dad6b3230c679b69e5e1b11033c9f185f764159e03f796a54f9c207a9a842e70bdb663ffae4a229d66ba43d3ebdbb6cc6db3a3b305d