Analysis
-
max time kernel
149s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
02-11-2024 22:00
General
-
Target
e218c4b0ffe63877cf900940ec783083de22654135c24ef64a03eb99e121bc52.apk
-
Size
2.7MB
-
MD5
798e963d3b62fedc542961fe027d5730
-
SHA1
394c0466772529819b12db77b4df004ed89cf4df
-
SHA256
e218c4b0ffe63877cf900940ec783083de22654135c24ef64a03eb99e121bc52
-
SHA512
7b72b255b60a14b636b7272485fc4ffbfea67369fd10cc914af5297cf11ff963d8e5923c0d55b31570a67850756761fea178641b49039147103f628f185f2377
-
SSDEEP
49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQo:yFjEI4iZaUzYH99yI/
Malware Config
Extracted
octo
https://178.215.224.87:7117/gate/
https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://178.215.224.87:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD533155b3fa046a7de56a92e88dbd537fc
SHA1d4d20217309c4709a3bcf556a7de2c9a980f9222
SHA256b3e4c68c8973e8b62f134d87df5e3ca90f8e7d11687d74079ef7fe03e50e96d5
SHA512645d0755324cbdda482e3348fcf28f70450b878d5da56796e24f46814555245504a19cb63c191382ef3c4c1dcc6adf9dcea25c6cd63d3908d18de62ca50143c4
-
Filesize
68B
MD589bad583555d5599e32dd18aef0d070c
SHA1b623764f0d79f26d345c935ebb680d8ad601086e
SHA25606128939858f6bfc6ee3bd54c97cfd669dd37e5aa75e8e44be762bf01de6bfbd
SHA5122a483264580eeba49383f4aadb18e5832c73c8dfee579c9e8d9745b2e0776e5b4f9e3be5e7202a8c69811b4bf98d9f84128698c4f760061b8e717c954ae2d97b
-
Filesize
60B
MD59584f5dd88dd102b8c9ec27791703f4a
SHA1b29a864a6d7c41de55ede837395332978e7fb995
SHA256730962c831a95dd0f1ed28d8c4a40c9d556cba3c166a2eee484b49682ccabc61
SHA512dc987d0a3a9cfdd04739b04fd70ee00ecb31a0d35c284e7423499e8865a9d38faffef20b111d23aae3fb85a124c93811a106c385878cf397a0acde90e2a3be31
-
Filesize
70B
MD57dd9489fb5ab62c6f7e20222d545161d
SHA11cb29cdb1e79ce968171d2d699a467593ec04ddd
SHA2562d53f1a8b16f24d9e77f7ae5382336a1c4c50baef31c325a5bf552b51fe9c716
SHA512d2cbb16fc8e49172ce912f98872c04cba0244e83fe204728bead1477f2f87029179a065868d76148f482f16abb96fbb696bc021d1a57d3e47b58712786dc8056
-
Filesize
52B
MD5b21b4902d1986bf9e458ceabd9679275
SHA189a258e41a1744c39c2371894b9cb3515a1bd78a
SHA2567bfcc2b9209ed8a66933ac69dc7b190583979da9b6d02e723a61cc4e768a3bcf
SHA512e5439ae71e4d03c12f5bcea099e9b5ffd3197a5e6f8b6911799abb666eb7b8d108dceead673f93a04cea7525b6b016ee0692239af86918cab2c6e8e701f5bdb3
-
Filesize
214B
MD57c55eed8d1c3195dbf75431352cc5583
SHA1d0d89651232b36b83d12aa97d2675c86dac85661
SHA256b45145fba57ddd57095a1d2cb136b37ba748f41a9e8ce6a5c483865f28513777
SHA5120588f862d71fb8bbeb6bf30be475f3d8dd761d9e7543d58a833c83843e44f2d3e67f8ef0ac9ba1721856387741fd52b4bed6564ca0bcbd97b2e5f93764ce1b3f
-
Filesize
214B
MD54c568e0f6e6dea5eca543032a0e9bea6
SHA11efba8fcc39d15aabd639f140dc733f3401cada2
SHA256430d4cb42d16b2d3aecdf31a5e5dc6da58438f3b9ddb391b5e3825be39b94da2
SHA512eb05ede0200884c7686cf2987f4b0cb37e6a995fdb6eacd82e9696879ead0af7fdf17f6b85f53b2b8b72e980a9ec7239b1915d75f02c1f2e852cc4cdf04db752
-
Filesize
52B
MD518820bacfe221a7ebf34717846dab9de
SHA1c0805f4dca941ff0f4d73660bbfe6be22fa22ce2
SHA2560d52456aea02a3316e56a9cf743f024fb7629516b66ee9af9a8ddbd3cdf4bf3a
SHA5128c022aeb5744b39be4d47f8039cdf95d6b4ab226c6bac32736cea55f7d77a385d18cc1f19030c1fcad4c3c220d4094d9569ecf8d3c1528bf1baded2e673eb546
-
Filesize
70B
MD5cdd44deb5a5f353889e798b2f08232da
SHA1d6c87dbaa1c3fc1eb9affd229db15cf77f0f398f
SHA256417b874e605bf0626475eb5ad207fc337a38dde57d45acb6a2780bd00169930c
SHA5121a646c2235f66bbddac4f996549d25343250eab8fc13a3f71ea369952442e795758955a1522ebdc1529cc968e7d66e6d28b6dc4f2b7c4cc7aa216089218eb082
-
Filesize
55B
MD560ddbc88f8c0a3503bb506f0fc42ec39
SHA13fd762ea66b72bf4a8d8082bf7ced23c899123e3
SHA25640983d6d5083cb20cb2041765aaf8ae8c9753373b8850338f64a4194a86c093e
SHA512cbd7e2e4dc3486b6a72b4777a5b92fcccb8d4c3be163d262c4d9b41bbb3481584e4120a42b87d285e1ba6a92e9a13635253119b9ac6797765f80475d32092b0e
-
Filesize
70B
MD5349d1c549c37dfbacc2a311d6f041105
SHA145a08db9dc0db54640b4c74922a96a12e553c825
SHA256facfc421d4ae3c609ed799f5c5e13fd3a0ee8e1e1f508612a45ffd60a0b7025b
SHA51210cd483e91e6f8bbfc865e1ac51244821c91a014179e98ca968bb0ea605aaa19be1c4b6dd8aedd5cb20250e9d0a7b1bebf06f774fbaad775d86679628e71c117
-
Filesize
79B
MD50e4f3ba890362f6c1dd83423c16dcbd0
SHA101b7d26ca136dafc480b11322f34b729239bd220
SHA2566c5cc7d86ced2d55959d3c199152f0f2c472cfec3785eb25340e42db6925aa2f
SHA5120b142c0502b1060fcfe490f849f486d666ecfc7ed44d6572454b03798b4fa3d4605bccbdc97823c2b437977cc3c7cb147579bb13cc980b546149213590085817
-
Filesize
490B
MD5bd6036b4f0761a43549a34d9b1221617
SHA1da6a9d69ba24c0723cd1b74368d384a519a0e90a
SHA256b78ead53053bb4eb1afb4466e1b79af8cd2897f63ca4cb1d9f1178e9584e0109
SHA512094350a5371add8818f67918a2135083ae524812fb5188c210b8646384cfa209ced494fa724b54be61945476b65236aae3808436b8d8e4d7d3a9b0831436d90f
-
Filesize
70B
MD5871519897c36ce14934c96f8e5e3890c
SHA1bf62c157fa6702130bace998950e6d4c3e687068
SHA256c4425df0c50979385748e647ccd6f395e1b6631e95f77aeef3099c5666b4c819
SHA51268b65af6f9ca7e85bb2979182c7f0d745b2b159295b5826d61053954930b8e7ccd69bec02c7e7f576f70682a8c7b80d5dbcaf4652181d77fa193bdfc48793f2e