Analysis
-
max time kernel
143s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
02-11-2024 22:02
General
-
Target
005aedd1cabad8386602563223762e05ab3c6cd3149ab13c18e64e1ec1e6cb36.apk
-
Size
3.7MB
-
MD5
e61c03904acec24780446b28496caee1
-
SHA1
246ce75b6632e5e498145d067acdb6d2fda77c80
-
SHA256
005aedd1cabad8386602563223762e05ab3c6cd3149ab13c18e64e1ec1e6cb36
-
SHA512
a8fd02f32c8b8983936a97da861d56e3d7cb156a171248236bfe2feb14820bf7715d416b5dd1689b864430c377f85954d26795301b132e34a762067578ac2ded
-
SSDEEP
98304:HLcFcul1W6TmaXO7P1A5aAZAMnBqRYVlOQyhr1:HL6cuHWsma+7P65aAZAAuYVQ1
Malware Config
Extracted
octo
https://malkafaniskm.com/NzY2NDZkZmViYjZj/
https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/
https://malkafali222.com/NzY2NDZkZmViYjZj/
https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/
https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/
Extracted
octo
https://malkafaniskm.com/NzY2NDZkZmViYjZj/
https://fukiyibartiyom2.com/NzY2NDZkZmViYjZj/
https://malkafali222.com/NzY2NDZkZmViYjZj/
https://oyunbaimlisi35.com/NzY2NDZkZmViYjZj/
https://mal1fukizmirli.com/NzY2NDZkZmViYjZj/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.commonherev1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
3KB
MD58f5d0569f123adeb46d7bc235a2b8011
SHA12a5d060ba1a37de510b15a6f19a9322060be78b3
SHA2566c36319d7268bcbc8a786f297060bb2491bf7b3536d1f88e071d76cc7134faa4
SHA5120b2aeb1ece722a910f26a80943211d676611f4f6d4cd9633088569c8f888ec3907c53dfb55312fa0058d2b939bfc76b0d089dfd46068ece7145297a581510b45
-
Filesize
1KB
MD5e086d01b3c7572070d98aa9a318478a9
SHA13af2147f83224ddd98b1c168c50c164077fc9b7d
SHA25681d85d3148f860e7205843003092d262b4486bf471ac70e741181c174404310e
SHA51241842b7720e25abf8b18e6b5953d828de27966e737437f077286c0412720555f382f73eb58e67c3dc34f411c59fdbc6a0153cfa1ce6f8363aa87696a5f3d62e0
-
Filesize
1KB
MD57534a3d8d0a98b47ad650ee5312473cc
SHA1b0878bd73c91f1df91359681c111ce2e24a3a724
SHA256bd5e17267c9f86a77e899f6f0d8a486d32b48b4df07f2bfca6ed78b06c7f84c2
SHA512d21616da15a609d26829665bef9c850ba5ef19b8bf70d5ac5e712fac4403af40e838963233f7f94e64a801c1dd7cad68aa98eaaa255775e72a232dc47a5c4a37
-
Filesize
320B
MD5cfa0f9afbf2acc28c578e92ce0501795
SHA18215d1d5f9c77507079b8566aa2a6b206db5edd4
SHA2566901706507235a9d9e6f5dfa912782cbad360e82c93cd4f141de5cf8c771efbe
SHA5128cf1031a97e6c6692296364b4b3675fe0760f3d4bcf7326f48bf90e68f0c00e18052553e05305035368c4df16ca517b6e18d0069b621b659215564172579d3de
-
Filesize
449KB
MD55985ab86b56c10bd92a17117ee338b0f
SHA1d6daf0fcf61e0472b2908cbe4185936c52f7552a
SHA2563bcf69608ec86efdff54144758e50eb216d4997dae1611778b39716d23178a36
SHA5125eba4daf768a288b642b51b2067d0f61f950a54d649d4513e0bec006094beea406057edae88fdea7a8f45ecae3e11a40cc9d5306ace0a170adac6443469e51ad
-
Filesize
45B
MD56ca29719fb2cafea3a67e2e594285c8b
SHA177c1ee69476ebc15544d2ad69dc922266168b7f5
SHA2567c239e46190c9c823d5a01df68764d8ef808d06993255b706614aa5515e4dc48
SHA5125f637714511a2cbecdc1188876d8b02486d0d14d81c9a32289284dc7dac46e6ce20bb8b98829065b388fd31268cfe63a3d005ffa4c31ec247d6a6c5db4d38398
-
Filesize
480B
MD517d61242165de84d3799749acb825b4a
SHA1ad9599968e3c9c88e91bdb32d23a60b641dfd2ec
SHA2568ee8002cfaf7eb0139f034837920f7b652ebd6c0dee603bf377aeadc1c668bff
SHA512c389bf8ebd133b2860f282cb0414444520873b18fd4652eb230f304bfe6a25857c27efc8c6a87600ba9a8ddc26712ae65d13525086a250abf299247a9c3d82f7
-
Filesize
237B
MD591f8f288b10bc9cd01262a40e4c60701
SHA1516852cde98fcb2ad6a1a1c4783b429b738cf00b
SHA2565ba8142b70a22f03a5ce89b1e280f1b05ba9dbd07754bfaf912ff5ec88a306e9
SHA5124b7876ce172f98742382deda976a908b0f3ff9e749638ece547bf9f47483036b1d31e284d0d1b40873e23d095f4292186ea93b73e3dc55e3e1c84cf622232b6f
-
Filesize
63B
MD5d86c121725509cc9b70ac36a0425b1ae
SHA138ca6830f30a7776a227434144155d2faa694260
SHA256c4f2f938d5ff5da6d38f333846fb666cab2f58f086aaf9e3441757e5a0e1fbee
SHA5125ac37f2ea3e8709119041339fcb0ffcb95a906b2787bafdc2542e88ffa36076f4298dba6071d101acfefa14dd54d6c867227fd87928c1a4919d8f4494ea85240
-
Filesize
75B
MD57db4bfc58abbba819802ec3a57896a9e
SHA1da4f00e254a01b2802015a9545e76f2aba9a991e
SHA25648c69a76303a0a05c9643ed585b579d49dd5aeb578fa2ba05dec4acdee437f32
SHA5120aaa9cb4663257300f8f06e617ea5c21cdef70f8cb96e44e0d8cad61d7fde116ff3ffd6529ecd7c1f1ab17dd2ed61902540b4e1473bf22f91e90fe6c5db5246f