Analysis
-
max time kernel
141s -
max time network
149s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-11-2024 22:11
General
-
Target
fe5e338f0c61312a137029d5190579a263ab5a776ad7942412d9dc443f072f5e.apk
-
Size
2.7MB
-
MD5
02d4a9b4cbb891f04a57959898bcf320
-
SHA1
43bbb76a590c03ab0a989fd0189a008d9acaa6df
-
SHA256
fe5e338f0c61312a137029d5190579a263ab5a776ad7942412d9dc443f072f5e
-
SHA512
79e32ef25733c1ad61ecbb109ee1f5c7cba27f8c6607f5e52bf57362225a9331691bd325e4e815a809daff53ae04a1691391bd9c38852b0d830eea2f821dd784
-
SSDEEP
49152:5UzN6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQK:52FjEI4iZaUzYH99yIj
Malware Config
Extracted
octo
https://87.120.114.189:7117/gate/
https://87.120.114.189:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://87.120.114.189:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD53b74b529d5f4b769940e86a33a960964
SHA13d80efd0fd50c74ef4eaade113769fda2e71a1a9
SHA2563dd80c00fcb0d402323a6bdcbaea884aff32f06b279e826fdc2aa9fb444dbc3a
SHA5120743059756d223ce96685ac0891cd684bf300795fe3b77f313aaec90cec132c08019f2025e1438feef12f3089ab9886a2da71be9ffbe497b5590a4242e9783bd
-
Filesize
66B
MD5ae94c8958ab17aa64bb811c68ae1f940
SHA1bdd26a733d28853f845f354477152b0e42eb9615
SHA256926904abe9ed0d28847646d7d9f13bcb0b2b570dd88bf79f428a707e4daa2be7
SHA512e4a6c21528e7a12e3f6b9c185b5c33ba2046d5176fa1964c2eed0bcb1ee25eae84499d85ae3b87e0082239e82610a813226f5410f4561c66104017602251fb8a
-
Filesize
84B
MD5a42a2f23e5921ee35712e6f1b58c1123
SHA19f5014a6d6bfeae7d49f20dde4d3cdd28ccf7d3f
SHA256b12bc2dbffdf94416047a9553fece9c74d60c96369d03bc5155ae6cf6ac04eed
SHA512f518d55f2b407173ede981a27c4527b65a97551bda5fea3c855002887ff5fc4fc7042039fc37307d08706d6bdf11236edf805a44f34b1b4681991a1f6e0314c9
-
Filesize
63B
MD59038bd4161643fa330f6e73114e3a8bd
SHA101bceca54887c0163f7737a16076692366b8f80b
SHA256bc821016d7cb5e039217d7a86e3ccd07428cf956b87a9570f301bf4d922fbefc
SHA512a2f6a06178073a867856f608532a02baec31a94bee4cfad459c0a503ad3cd14f65a77bb88f50f783371d9580ee0bc6ce82c263fae0dab7aaf06971b96e51eea9
-
Filesize
58B
MD5dd92ec32aad988cdd821a5667b2c5ffc
SHA1390eb7213b4a48789c8149e4275f29e23b55b807
SHA2567646b6ccc7594800a80a19f39b6442653bca8346154c9305d86bef556d4d4951
SHA512816b1fb614e9ab1566fee0528f2b6187e6a24c28fb052f52912076c3a7cb97141191da80761115594a1fba900056c5c5296c49faef0e9248407f88b3181a088b
-
Filesize
230B
MD507527ec310d3169311d64bb7516d7608
SHA1f63d1956f1a9a369c01f616be943fc40409225dc
SHA256918c78b1d2688f0870d9c46bebc62923e89a77681779dcd55270d67891f1b74e
SHA5122db735f1056bcc0e8ed9550d2a792fe09349ff6f08f89f46e3aa75ba5ff99dbbc0f1c114a102eaa7b3b33516adf97c2566c979a4fff21182f2a46bcc1e003e53
-
Filesize
45B
MD569180159c1ce0217d966cfa2b3774eb0
SHA124b5edad82f53f0616f3bf243d82a65028c07f00
SHA2566140449e80d4d39928b4008d198b4c1a18d8c54ca456d453cdaf12f90d22503d
SHA512fe7a28531fcbbdd520f7b8cfde6c5cd6ec51f1661c9ce7ccc8729077f66610aa676f4f634bd30f8e32f32b2d51071ff87eaa6a293ae97c43aa91cfb4fa83ad2c
-
Filesize
63B
MD57bcb249d4e4846cd7a038fafc6e732b8
SHA1e347671cfd2f5df5c612dd6e7f501dd3d7119da6
SHA256f949477a108db32eccf031bf79744f1fa07c2301caecc5df0559362821dc04df
SHA5123e8c22e33b07b9deb6e7e09cd1f26c7cc4b5e6ebd7e6136dd91f4d9d781932cdfa03f4f6479ce4eac2c4118ecb16e4de547172227b9b62da1fd8188d1de21b9c
-
Filesize
45B
MD5ff12c2cfdd673ac8a718030138e78753
SHA1a457f29b5c509a6e0bc08bf770ec18523c6208b6
SHA256355e39f07abdcdb2f3275ee4d02dd6e07a86aa904ea08cfc305f9b88e4e12418
SHA512d9d54a58fda6e6bb6ae9a3efd17670eaaa4ed699e793f0061a4d2055d987eac1f66769873df4c65f17944b24120bb68c6c6b15a2a9679b2b242fa6de3cbce9f2
-
Filesize
466B
MD57bef119ff50045f4fa0e3cafc381a3f2
SHA16499b41ce4c05bda888f9d3e76326b491224a6b4
SHA256066f854e71fe38174e0849162f4e52879341d72d859415013e3eb464c82baa57
SHA512bd15b7bda0ba3e5d2c1ef3453b1594f76bcf595b92174a0f4dfbf0b676b87bfd1726e384d5922b397f874a76288c67b15bf8cff74191ba53cdaa5cc67e8ee259
-
Filesize
63B
MD59e6745de2c4d99b8f870826da4507839
SHA1b64b75fe6552ab402f595c9eb6cd130aaf5c9807
SHA256d1b6286ceffe18c3a5d2c828ef0f999052424443759c3dcecd343c450bd5fea1
SHA512084b50f6dffc654cbcb4189f25f22bfc5b4c5d88a3362b3d0797237d9c4e133d3d93e845bd245e27242cd941e9077d48fa22d4b40741251da3ead33adf5816f1
-
Filesize
58B
MD5ca63071b75927cd67ed8f23f53c39f07
SHA13045ceee5e65eb3aaf6b07a7f38e678226324afe
SHA256b84359d2dcd1da2b19d6db31a7915dc077ce19862606c5ea12aebe56afee96ea
SHA512b689840ad0a609e9f9a52504272d2f0efb57e400b44baa04f745af51e3518c3994ccec98e12e53ea32f418ab55a04a0b3089c1b9649a7d17719e46106bd9f09c