Analysis
-
max time kernel
147s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
02-11-2024 22:01
General
-
Target
5a0c8153cd121c52d0f6dad97196f74f6e5ec32bc5564fb1da74d083464002e1.apk
-
Size
2.7MB
-
MD5
ed48ec61ef07a74e2f6d767c62ebe978
-
SHA1
0cced743a7c2c6a5fd13a9f8922a1f893fed2b58
-
SHA256
5a0c8153cd121c52d0f6dad97196f74f6e5ec32bc5564fb1da74d083464002e1
-
SHA512
8474e9e22f34e200301441f9f80616d5621d2209d0107732edf885e19769d4e13fc2ef8a50fc3073e4affd4dc522bd9e88e340794b687972e58bc3333b72c56a
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQn:e4FjEI4iZaUzYH99yIA
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
55B
MD5cdd3b6f1b6193950d9dc548e38937981
SHA1f9ed5cf15b085f260b5723e502d334a04a5aa84b
SHA2563e294619aacf61c4e60b577f894ec371922521996468c07b686f53ba79502363
SHA51283760882e5f52a107bbebb7c70c77a2bb25c41d2c9211647fc92625159c3ae4e964f742e9939e2cd58401f34d5cdbccffdf48cf3e831077a7c85034ab85b08f5
-
Filesize
45B
MD59214dca07d858608789a8bae44c0cbc5
SHA174383ff53a550653cf6aa6b716b5a14f2e4fe305
SHA2560e1d05c63fe78da5f3dc39c42a8a6c7ad2407c4773ef7ef4aae6165b448a2f81
SHA512e11a8e23b9355c2034e5d89264d228711d1d09d0db0035859bf764889d42d2c0e42cddb478daf10c54b1f5286c681c93a0361253eaea8e92f922f32c4e28998e
-
Filesize
70B
MD5b4d157141453c7e08563f10dc8a66a3c
SHA1077c45679aeeb2dde28244dfe2b4f8874243108e
SHA25635538e773886b149c8decc53e45e95a588b8177c5f953fb8888ee2eef8d7e417
SHA512bb758ae80a040478773439c6af51530e5ab883db93120276a3679fb15a790b2d0c45d4c87be34fb2cd1c4ca95f0c1a7d67291b4f658d96a95cf0e82d5a5a941c
-
Filesize
45B
MD52f43874de59db712c29484f7c6d1853e
SHA1a79b3cce1a2238e27840d2168c28cac584afb478
SHA256e9a5c426fb92ed2f7c0112091a4fd599da4a1ffd5b7cc14362e6e95e0936c367
SHA512c3fffa5142dbf00387bb0f391fabacc8c964534ecd8cbccc8bb6839cd6eb41a708274e835fcf86a4d7e32a9ee99d476d8cb76c70908b568a55120c85deb1331b
-
Filesize
79B
MD58ca36b773f012d02ade4981fb47b93f8
SHA19601286618953693191e9b837c7c20c2b91f5f9c
SHA2560767e4dd5ec4262fb0c2990adb87a15d70f91e69cd3546f44efce6e107cf64c6
SHA512d2d6364de2383457c0fe3b351139fa2a1cb7d30ff21fbc555664f3b06315ea934d25f11b3bda704ddce8f9e77276dcbe43f797c9854379efc0a73119f4eee5e6
-
Filesize
490B
MD5e13c568e108697d4a8d918f89790d115
SHA1d52e99f45b6162a919e2493a705cddbc5df8ebce
SHA2566638fe3292d1bb5970fb766a7491de06f6507b866fe883326a5c1696d7057c15
SHA51214ea6bf3ebd13742d829de1379f86b7f5e6a0bf8756ea20b0db976465b65de81a1a159b884455349ff9fdc492cde67d4b85fe4d2492716675e129b96f54809b5
-
Filesize
84B
MD5a70292acf1354ca25904f580aeb363f5
SHA1876041e04800f3ad3b8bc62dd1abcdf65c05045b
SHA2565bc76ad15aa49122a4e5d8e6b5ef0ea561d08211b39cb5bee12257b561e6d8cd
SHA512c86a6f8d79fa3c5cdcda758375def8078959964893eae5250610aabc1c52b4a83b53d1ec4975bcdfb782928179099dae86ef4e04bc38486890489ea194155965
-
Filesize
68B
MD5bbaaf573a594c120d4be9416565fd85a
SHA16d0893219c8ce4073ce2d7a001f1a9a251516b5e
SHA2565a7433bd80aa23b46d025f200ae2805cac4cfed3d45f2e7a3a33c3a44fe92f5f
SHA512291e070fd066751d2e3c3d0b66eedef27008cdbdf5222c53db14a42bd7945e91de22ed9e798c0896d741465db78f5ea437e93c71c846e19c2b48e5b2d4d2f34b
-
Filesize
68B
MD5f7477b4976d2e52befca18950bae0592
SHA16ec529d50a758082031eb1dc0b1f4474f1db1596
SHA256a9edf189339728484e6835503db12990246b31a017c286ca58fa4981eee938c9
SHA51220d2577284ee69ada75f28ec7fde62f027a3cc5fc118184e89619f8851cd0f3e8051d82b02e453ea49c976114d33287d2d24dee8929ae4ef899175e43093bbe8
-
Filesize
60B
MD51267ce5cba1d6cb8d4c4045f5882c4e9
SHA16aea89d81d137b898d915519e1e7417729dcd48f
SHA25653693fcf1ebbbb9c27888062bdd9b7d66abaf85fc288bc27bf0ba7ceff352b8b
SHA512839c6d6884aa6ba81498b1db5ab43310f3322ef837526fcc490a1f3f659af1e0d8292c2c10e0864f8c78aa84e677067f4a30f319ff34f82ce47f5697a29e9b88
-
Filesize
214B
MD5b8464204e341d5cb51c6eec3522b85e8
SHA1eef8731c06cb297089b562bc8f651b8a7f7196ed
SHA256ccaefd295822d4c75b8dd9940e02cb429ebbde97bb079fbf0dae604c1578892a
SHA5125b4024c82116bfe92d4eb7e75c4001e281fefa5b09a4d63921514e0437e7fe812c2a44928d3edb8dc74f17fd762bf76842fe80eb80c76dd1896173ec627003dd
-
Filesize
52B
MD5d3d836673d4598a9d1f7d79e85556528
SHA119fb7b80352712757e8692c4a0b35388275b598a
SHA256d0c4110d2b4cade5d8799cc40beca11deaa24ba6f56d919eb78d647045505d00
SHA5120398b13d62041d29018f13c8c3bf376dfcba8895d08e5fa350f7fa29a85baa1cf723fc92065b0750319a6f7eccd331b7a15f201365cc8b1034047cfd7820c805
-
Filesize
70B
MD574ceec0e76f87302997ab790a334a6b7
SHA1626788d08669f724ca6ee7195621df03bfa559b1
SHA256563ee66ccc4c4e4b5504b62a9045846a8da4bd4bfed9c117fa159b259d69ea8f
SHA512a11dfe48d0b0c868830fa2faa051277f69ad790077ef9c08af07e7885251f4c9ae0f5b4f4f450a5f62c5df935c6257988cdac9bb92c9a73b215870c8bffadc04
-
Filesize
55B
MD5ee4a38de716200e381f078db25bc3b10
SHA14a40485c8f409af5cb497e5331f4359819dc0dec
SHA256193fa67fefe53dfa79d706f1cf4ff845cc88008ed5bbebaaaa49fac6629e7601
SHA5121617c8e21f6d0472746a344fd058d935ced493b57b5dc30deb2c4b374a7fae935b96eab1e62410e8ac9d365c05cfd299a21dafcc11dae4e861114b14e3c5a23e
-
Filesize
45B
MD5a427de89fba247d9e614573ef600db0a
SHA1f102136a1b4d8b5925f2cfe51bdcc8263624ba3e
SHA25646c5f60faaf334b44aa9caae65b7034659098cb8a7bb8f7b7a8797ba31c613fe
SHA5123eab0775cd044012391a90abc4d18f4884ea3e77a5c322df0dbe0c42e5fb3405efeb12932172fd1f36e3da9bc71bd268e0509e49bcddfc608821b53b4e888bc5
-
Filesize
70B
MD52887f5bd1d83bee43f0304d273e9c510
SHA1f70ba8f42771287c82f7f03f78038cc534e2bdfa
SHA256cd5c09ec901efdc6bac6232ced84da9d04093cd84c60648824bc922f14399496
SHA5125e778ec9c3ed128d63081802b8d2c0969f8a33e5b5bc985f1dd9e42bf5e4a719e2e7b871449872c5c2f28af997f120d222ab9de402ffd532e66bb67c87d577bc
-
Filesize
45B
MD5ecfca883eada9beacaa9954ed44848ad
SHA16a308b57c03c37c47fbb405eaebadc086ce68065
SHA256135529b22052633c5cccd8eb2bbfdabb1070cefc38a355cbaaa279f07eb8f7a1
SHA51275cc534557ae0b707314c6c16c4af26bafa216dee1cf7ffd0916d587eba3c6ebe390f8dffeccf6ee1854991aed94bbec236f8df590be669418ac3c296f37dfb7
-
Filesize
79B
MD5119281afa9fb5139e1666aeeef981618
SHA17294bbdbe663b21f8a20cd45bf79e5202c23412c
SHA256afd05c4c29482e6931afec9c0d291534a06fc92c9941c54e8ae21bc7d7f95729
SHA512dfc2b7b8ef0384d354342d3682721ad317003362821d9358b4eeb95a56e1be40d07c4b33c981b8e2248da5ae30898a48c69b184c47e94caaddad03da2450dca2
-
Filesize
490B
MD5b4a6c77677b0dbc2eb84877ba5c04c7b
SHA1922ca56ebe3875d62f0dd6209caeda79161d3902
SHA256daee5290a3687e4fdb97351cb8d310aaaa7a08102280734eb542a487dd58e952
SHA5121b421aed8058ebf34db7a61833c0b8ac2670a477d002edc417f76f20a5508475748c402af94760d29a16965a317a3786eeba251ccaa56c7d4b0df06012b9faf6
-
Filesize
53B
MD52da9d3cfcf085b51dde6d45d1408af1a
SHA181b73fbaa9b6b24ce923a193a00c2320adcd6199
SHA25607c10cf60cbddf892618db25129b81b64fcbf7683700335ca22df9b08ed72862
SHA512bd6060d3559a9af73921e59b407225a03698b982d1f13f1d76817ae05e93a5dd47376c9efb6f644fd51c169d8c84a7d0a210d255bb7e0c86f9ecddf52f78a685
-
Filesize
68B
MD5131b69a64e2a087f7c8c205343b2ca0d
SHA19940b6f2c7d38b45e8f1e5dcf646b143306ebd01
SHA256bfa6fac06081527428deb84769de5244cfec9d4e383c8c6b6db0c1809ed6bda3
SHA512abe66b42e39a911a7d5c7af3c504b4d24bcc7c191b2c075ed16bde9ead03b149522e480781b5224840021060231799c2d719ed69f1e68aef48af453bfc1a6dc7
-
Filesize
214B
MD5cea53e36d9b8f029bda4dc2003ab0283
SHA1f1da6594faf91ffb209c71721a7076efc5551cd1
SHA2568189b326b70164ddd5e5008eea38ceedda5f5b2fabbbeb7e8ccffdb874ce2253
SHA512d94de3ada48737bb4323ab3c3deb9b6dd0af5a5b4fab1229cfe370763cbe7bd7aac3a4f5fbde4e9f859d98be32e134b5c1bcba6ac702d37ade6d9e8846b138ce
-
Filesize
54B
MD5722001a1b9e5b61cc7f4879c374c6fd4
SHA1591b105d02c07b274d3892abc281e7798954bdbb
SHA256c681240948681f11c12f63a26cb43bd7344f8e61ec445e7cb0f31280a695a090
SHA5129115e240edbabe9d39a75f16d71e1f7c8b118415eddcd6abcd761103861e427e79b57f2fe77607934a341b4c31f452c6f239ef465c693e007a686401d0f3b4dc
-
Filesize
68B
MD5a566c2bc420578e923e8afc909f20cd6
SHA1f5327257dc5206bbd712e58db724c045b5257e2a
SHA25618382e3800f075a0b2d18e85707105a07c299eb7c38bd107db322b15a0983764
SHA51251a1a116f36b47c898e481c4fcf8d1f788bbb0d609323ff279c234c9c45f2c178c5dd49e5cd5ebed7fd4489d342b4090c8e5a6213c004f1844433477bbc3fc87
-
Filesize
60B
MD561cdf526bee05d3c6d450b2b0b911253
SHA1c24bfe0c4064f716a871e92dbaa9fbb51ef29373
SHA256453b0bfba67ec8f048942890d56848c3e8d9bb3b4b1a6512923ae823dd295508
SHA5121865017e7ff3e34fca5a27685cfde2778af6b12c1dde72ad514b6dd1a9ed34a4a0954149be9add1565be7a1ac03d50b31f7233c9aca2bd9e81739dfa809ff5c7
-
Filesize
70B
MD5947143c1175ce22d004129baa17f4f9b
SHA178773380e6875952fc06d063d00bf578ee7838e6
SHA2566415d28f4325b6c6723bc196ab8713b1a3824165dcb9509972a4aee690c1628c
SHA5123a39ef1ef906b9aa3e620bf7b15c7a15650217cd50d6727594d70e2cde37b4a686b2eb0d20a398ccafab31d8beeccd93d1a6178d0e67be2c1cd4a1573a6860a8