Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
06-11-2024 22:07
General
-
Target
f4357004c0e28995231e934c818105c65a10a6e48a6cf37e3f9ebd6865bf059a.apk
-
Size
2.7MB
-
MD5
6cd28820e1037413c2ce4a81caf1c470
-
SHA1
525ad93436897870adddbb22f841465de55fb31f
-
SHA256
f4357004c0e28995231e934c818105c65a10a6e48a6cf37e3f9ebd6865bf059a
-
SHA512
f10989ab6c32cfa40cb3d27ac74d914a2b7b74be3540edbaf259d3e193018c5cd66d77dad48c57a8010c15a2e948777e6238abb00292656ed22b1682b705ee1b
-
SSDEEP
49152:3366Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQO:3qFjEI4iZaUzYH99yI7
Malware Config
Extracted
octo
https://31.13.224.104:7117/gate/
https://31.13.224.104:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://31.13.224.104:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD532aaff7d18ef2057cf1334560bcef916
SHA133fbc0194c08166a57a16de188733f61ee05221e
SHA25641ab7ed5ea5c8021ab870a958f88ee7fac3085734d2fd2b52bc10f71d1196f8b
SHA5126d4506d46a8226c23ef8c2ec6703d04d8425ca35c3f68e034ae9636737405ec099fd2727bd3ced323c2752b1eca3c144dd3b7c474343a481920a273a0dff72dd
-
Filesize
68B
MD50840d636d58a032fae5caf816914704a
SHA151521fd62a61ba8979ba1bc858dc3b21b3c87a28
SHA256df48089efe932ee31a2d4804ebc73be27eb4d3294b4ae6acb5ad3930bcb70f1d
SHA5128db7fd4476dba5e5e28af61d2ff5488f8c61a4e3dcbacdeab9cb91b873da1cf471461f9a7867b8b7a7ce75d6409c362255ca4aca3dbe1aefdd1c08373e7e17b9
-
Filesize
214B
MD55ebc91887853650625ca5144d764bf58
SHA1cc61b70e20d57e5bdda3615cf3a1c48cba10c513
SHA2564d581e2467fafc073fa9ef843a06ba7b225bd5e1cf27f355dfdb47e6a572b221
SHA51283215849810a3529fd3341dd6ebfd8172950dabd63ec5a4dbb96bf2e86a31d633155829c04d91899cd92db51cbf11432404cd309f212e27eaf1939340e404898
-
Filesize
54B
MD589fa83fae22c8bc359ce4632387a3ffc
SHA12c6cb2dfc1862344fdfce3b00a301cdf4a41429f
SHA256de28b8761b597cb46bf9cde513ee846c6549939466c496085acf87edc5dfb65c
SHA51290b4b925b167c2b0cb37c0422a478b0d90a3f629edbc975e5a101af8fa61269550c96b035f05736aa02575923e8934fd13141cbbbca25514ef4eb193b836c9bf
-
Filesize
68B
MD5b79b18b85c010df0d6b02a4a46754b6f
SHA1f786340809ff4be5f2b393cbde89457e502372bf
SHA256ecfeb7399322c97830ca30118ed80830175e45f28c5975b726e0339e8b76536b
SHA512e97aaafb9f9f848c83a3512be9c578a7390c9d81b03ff0267bf06db3a8c57b156d290c11333c269b0bd943d16b72f207f2250454fb4f40658ce377d80e3debc9
-
Filesize
60B
MD52521931f5ab1b9381fb0d89ebb6f0e93
SHA1e1319edcb72dc1bb5577c07ba4690784b9acb9cf
SHA256826a0fd5d7567f1bc56d33eb6e7c35fb2466834d97e8e2ca296cfff5785a2e14
SHA5129a7a7f3bac1ae0a80a687df17f9b1ead378a00b038fe298d22274584a04c0bd81b4ec7d680eae6d2f13768eb0c9f27349bc9f5c10ab3f6f0590aca124f9d5f6d
-
Filesize
490B
MD531f689e3b229e9ad4865aff5c08f8bb9
SHA12c1701a46069c9548f5894c00f831d3e35eb527d
SHA2562d78bb954554e06bb17dd5ff59c571bf17f2e58c37758a6a417e5faf97e66f2e
SHA512b69c37ec9ac4f87dfb09e9b2c9669dd1ac42fa51964858e14b6e8a7f4c59a4dac2314e8386957c17dde01d0193c0b607995aa3da8c9bf6e2009c0bd8e33c7179
-
Filesize
60B
MD5fbef8c2d48523f6461f0a159891d7342
SHA1dd6b54c196e7303e1c4101798abd2658dd2546f0
SHA256de4e97ab6d027f91941e2634b13db92cf4f7fa41f894956f0ba4abd427e622f2
SHA51280bd783b15d2ff072b4de8e4bf1cdd815ca2561af16fa1b0bf323fa78cb33ace9a45c2075dd02d82a05702e0fa08234dd3e94771c8f6c92102498898328ae3ed
-
Filesize
52B
MD560b1168d80654e84fd152bf288024398
SHA1ccba127257adb9b5294b46437626843fc3e393bf
SHA2566f7244c0b4bcb8d4f725c212412be0ada49a7d9a093b06e0f668c3964971edce
SHA5124a46949fc252774e1957889d3a59f6793f4d559b01e05b76cf1e79a906d10b71ddbfd171fd8e3bf6837639b0bdfc1ca6cc50819f47ba62c22374a5d56bae2239
-
Filesize
66B
MD520b26335178dec43c8d00070415a3818
SHA17d1c6846227f41982532887f2ea97ec77018fc51
SHA2562471189b2d773eb1486aaf39a3ec1df5537f3646df20ea17cb21b1acd68e38d6
SHA512565b2600ef440813109d5ecaf0d925012f9b99634e6d7925763899e74081a37fb2ef85fce42f94b8bbf67b7d8a5ac3483181280cf6337939d787471260185e29