Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
23-10-2024 22:01
General
-
Target
f8ad19e955feb49095fd337093ded3dd848a68dd7230084298945e88c9b1d7f7.apk
-
Size
2.7MB
-
MD5
a4f29748fa2ea5fe5d5c262e8a347d34
-
SHA1
26d7eb5d927b707dadd575550dc14468ed1d2ecb
-
SHA256
f8ad19e955feb49095fd337093ded3dd848a68dd7230084298945e88c9b1d7f7
-
SHA512
f95caecd4196ed28a5d800b12847113eb83ddd74c21fecdf24c26821b85c82aa1dfc1473216a9b550be2ef517028bd24e5cc89c48a9c9a1014c772b8f589aaa8
-
SSDEEP
49152:/PI6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQd:HIFjEI4iZaUzYH99yIW
Malware Config
Extracted
octo
https://94.103.125.223:7117/gate/
https://94.103.125.223:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://94.103.125.223:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5dc1b434f2bad9fba892e14618cdb0c34
SHA14683f60cd8e6ff8420285da361eb1404088ba984
SHA256bfdf7e9c4ec5efb95a719cb1e4b7e2fad7b5efd9bf6ad2156a3744a30d578be0
SHA5124bee2a3937b22ed4d2a66fc5addd181302e87a5f371273155116b2e8fca889ffb34116c93e977f6aa9e6081b9b22b6db1cc49e0ec30bb89e43c72365ac3a9fc9
-
Filesize
68B
MD5efbd42acf89aefa22096f344cbdfd92e
SHA1032a428ccda6916d4516b4a3e3fb3c437fb87f09
SHA256216e4971b5895af09ccca3f32df8433eded6a95996524374334708e3f11eaf3a
SHA512e1d0b8b3bd669ac17a667005083cb2a4d32a4616c5bca758d2c7f843cb179b90dae3a940c3323bc3488332a5674ca0b9ba072ee32e8f5b1156dc785eaf9476b8
-
Filesize
214B
MD50e287df5ea2c98ff7bf5a3d47bd7fda9
SHA1ecbf6b6cec2217dc99e2f63271e1263af1ae68fa
SHA2566462675d12690f88d642bd99489f0a7fbcfb3ba6cf91e1d0d6802043be87897b
SHA512b276149c03cf687f4b7f88950f98d58d3cc8cd559c1e36c0ff41fb625912485fc2b91fec36167931d63d8f2ca7236be3ba808d160e767a2979e9c74bc329225c
-
Filesize
54B
MD5962dc75cdd7d948874e37f28a88a65a7
SHA181d76d1b90bca9797c864b7be9d1405b76c161d8
SHA256032306e39a6acded90d30570d571204b5e3f4a06eddf711c8de0042b95b9d150
SHA512e91036065475b910a1135ddf825da7ea8a44ea240410fa48a605c3378793bd81ce759f4bfa1963c42f9fd9dfb58c4cf8cb045e4c104828af38af0e6d3989b56a
-
Filesize
68B
MD5626ff75e7a11297fccbb6aecd7ff1c26
SHA1ca3c674b24fb5f234e4e29b7ffa8ab05caecf4fc
SHA25677178dacce53397059ac1b691690389f78f0db5c2c0ebe608b5fecd12e7c8a4b
SHA512261e63db1c93cd8a746c4ad0e81393d741086c5a349704d23db80b05fdc27754682ed5e95d7f812e642aeaf652dc6fd9408f9172ffeeaf10dfd250492670f45e
-
Filesize
60B
MD5c613977f158aec92d18eb52bfd9d80e0
SHA1e4ee58df8e3433e84d0c8a1e4bb024bbc33dedd6
SHA25639303c286c72bd81758870cb072b810328b23e9be7cd3fd73bc08759849a77ba
SHA512f2331337d9d4e036b00b94439bef8b03410a749536d09f35f1ad54d01a7d4794b411a6db3a5d63be4db13f92dcc6b798397c1e14e17bde975efd925855c737f4
-
Filesize
490B
MD5d0751bb0f3486032a13c7553b173b276
SHA1689fe6e030e8df441d2bbfb1d509402190f5d32d
SHA25676ffa651941ce9b4d92bb70fc95b7c0815c200a11dbd87a16e4b864a25dbd437
SHA512dcfe282752b7a25b4cbf6bcba6796e99758958aaef0d485148aee36127eb08f1176732ece796e825031ec6dda43d48ed8cd93bfa85cc59eecc35ed12fdf47ca5
-
Filesize
60B
MD59dc59a7465da80b3961374478080c761
SHA17a3403cf74f777b615407857db9fbcbb7fe8b881
SHA2566938d74d6db26788852353f53e6097cf6832e54efc3297e7942126c6e098ca00
SHA5123dc02859d8ff2f676a111f1f71a8d56e3645f080bf1e982f8a635e6e1e7b46bf70dc09b15637b4e0a9475e280ef470bf330d035dd1e1c68d1c7df0feb9d12e44
-
Filesize
52B
MD576ec260ff4cdf74ccd89c82ccd81f99e
SHA19efed8a29a8b11ed8e1423e7bd5115dbe63c25f6
SHA256a0c5c6486f2e18a7fc14e0614c0b052dd07e5ef41c796d7cd8160c5ee8eeca3e
SHA512c28a012ccf64563d9ee7481bfaa943ee7bb2af7fdaa2dfd11b3408b47f102fc7bccfc6e7578da4fbd910343d456425b35ca98f818c226ad512a46c34eea57974
-
Filesize
66B
MD5b30eb7f6f9f5309d578a50ad9e9475de
SHA1e7fdbe54ca374e391aabc12e9b7ea80497d4a7bf
SHA256f59822b016a486b47eef71bbc502e62c3047c28bdda5e027f00989e3c2ca1f60
SHA512bfe0fa72dcf04d2ab8a0b8204f053626a22e72d719598e0e6f2268cc954769c9227aad6b12799ee57aa8ee8ab6930a575a7068fbb7add44b52efd664c33c5bae