Analysis
-
max time kernel
143s -
max time network
135s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
06-11-2024 22:10
General
-
Target
352e09e0e425446c6d473bc971be8458d1162cc4b4bedfcffabacf98878cd11a.apk
-
Size
2.7MB
-
MD5
9cd24e7c77c75cb477465c74906e87bf
-
SHA1
9723df425ff5f5e8f67bcbe347755811e563301e
-
SHA256
352e09e0e425446c6d473bc971be8458d1162cc4b4bedfcffabacf98878cd11a
-
SHA512
fd791b3b5e2c49744c18de41a195d02c25bcb238a27ead6077f0e9ca6af6307f78f2ca8e22fd871410444d30371726875d5840ecb7a985c4188f5da2cbc94357
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:e4FjEI4iZaUzYH99yId
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5a25cfe31c6cbdac8d47ccce87d2132c9
SHA1aa141f1a4f3a4f5ae1586e567db3cc8a5ef290ca
SHA256db6f493f220e8cd6fcac60198a4a288b6765bf1d959cb6c361660618174a0fd0
SHA51267e49bfa5e18b24e2a8c572f787ae4a3b614a8844158798b0bf8628c9fbf5647693595f2701d17c8b041ef9c64c3c2d77a446d1e2e7169e468da6a3e42df12a7
-
Filesize
60B
MD5011cc33141a8dca0c14026a0c9e3039c
SHA11a14eb8b943060133e85c5afa7da49a7b9643392
SHA25684e9aacae26a79bf2bf7917b2f94337dbf24c94ab950a09c5ceb77ba52f709f0
SHA5124e283694db4054b07f3ce2565003485400320472fc4b1b2a386483a6c4f41e79e939d06e45833a8452d6cc306912ad3ae5026f4e2be3a37fc5925e341757ff0e
-
Filesize
52B
MD59034f5e3ee06bab0dbafeeeddfb41bef
SHA1f0d4a18a8fba600e7cc95473ce21662ec747b974
SHA256e52a432aabdf93a0b0069fa52240e7918d9c3ed3cadd567ce29f0553c485907a
SHA5128279be69a2254fcb1548c29b40eda764e2fd537e9dea71114341f2f7a636a20edbc1e4cbefaaab279b4fbe93cd59274fe625d84cd06c13127c3d7c869e0433ce
-
Filesize
70B
MD594a3cd6ee7a0bfe122127e7ec68ba0c1
SHA1c86a3c8d0ca904425a3c3ee367ff3e230a55f4aa
SHA2561e0d0bd8d5646818d1a4de945e178493262cf28f3521a7cabe4dda499b2fda20
SHA5129ad4ee5151ed7e975d1b52dffe3f54eb0b20dff2fa105a795d48633becf7eef8396138bcfd6f7f7ed39784f0140d9ab0f5be84072934f4138db44351e516d6e6
-
Filesize
55B
MD5262ba915454d061139e82cd9cec520c6
SHA149d4043eca5934cc67a46ad66dd85092dd3ac2fc
SHA256494e05e94a05fb8bbb90979be7b37798684381a4b48c0ec322f669397f1da0de
SHA512168be5b5d15af33469ad4a19f50857641a9ac1907b8911e49bcdad731241e66ceb5ee82c14af8d645801659c46bfc9cd5275b5e6539ef363318e9a292d593702
-
Filesize
45B
MD552f27eeb478e590f2f8e98ae4a65f5b3
SHA108b699554ce5d953f5fc899f8a16079044a489df
SHA256ad97597aca68ccaa542af9a16b1af5af9e6232d133601070f024b910a24b61bf
SHA512929747cab562e7095462e1a9bd1997be1e85509de64eded21e13815ca101f959118f86156b69271f122c9a7e9ea6dfd49f7ba5d584eae6cb9e16cccda259d307
-
Filesize
490B
MD53403043ea8664696add1dbd9f7397d9b
SHA14c16f82119672980782eac17357bd79f1c8402b5
SHA2567e32ab7f69429066a6501031b08e6b25d909543e9e9dc9ed1d4d8defb11805ac
SHA51238833d62bf8ee08eb6581d1c12d523ff1f402d474faeeb9da6b330d123e8b86fdd1319c7941be0f993ce565ced59cd62171cc8a71b3d290187db3d30cb7baf21
-
Filesize
214B
MD591dbbb0361ea6fca8aedd25c45ba91a7
SHA14b7f293fa45314ebfc6448e31d31d4369055821f
SHA256e37c33af542983dd4b0616b8878f70e547faf41fe19a8fa78435362801af3858
SHA512f777559f13c1c6926a90dd1a9fd35777a7783d3e663aa160d3cff221e40821360832e91c357d6ada1a34401b2a7a2c7a2beca8ae1ba91b4e8f6fbfaab5854855
-
Filesize
52B
MD5626b6be58072273ee4aca7888b914e24
SHA19a6486777b05077d4abd973ed6617a4679e3cf74
SHA256fc6578e5b24a6442d2ff1333fbf16179c8d5f55ee41d55d6f0d5c93f10d29336
SHA5128adbb66b20bd326cf6f8a842c976f4eab5e0721a9154d71755fefd53d439e139b99d1981d7c866a4b6cd107d871c5d5bb3303e81ec036ef94fa8837fac06f500
-
Filesize
66B
MD527bfe5d4c19a2033a972387d46b141b6
SHA143414598c376fd8730499c70fc70a21e18c60b64
SHA2566a00e2784137ac1f0e81f34564362ba7160b69eb9e5ffbd2a6050fde17749423
SHA5122a3155c16d1556c7b6d993429a27d6f8a9fc09274011ab966ac260497ea7cea490a1dcb5d26b393e33f21ef3ddcf21cadaaf5e9699a5cc867f357a0b7e747a39
-
Filesize
84B
MD56010cee0a234997da59f2ac9359609a5
SHA1d37cbd4869ed93abdf2a6dc8af8774277f22488e
SHA256ad52cf9f0540f44166838b41514ef9fdc02fb9f786f6783112e8fc386c524f65
SHA512e437f86649dbe9ca7a3f7948f180a5e5ed818382aa1e77d81696e4ea1221d2a66e7987359b97c8361f112888df83c6dc072f3f3b229e219c3c37bb3590826516
-
Filesize
68B
MD512167d4c4a6d7554c1e2e4bef47fa150
SHA13fa9130e8f9f55b47eaac6e4da273702f32eff11
SHA2567859660324f03d8b365b64d0c0a6951a3f5b0c56bf50673a91f2671aa6562e06
SHA512caa4296a71395ede936cd3002d509e111496467953bbeec081d9245b524c3a3906d37fc20b15fc564a1230f241319b70d4c1c74bc0bf89aaa24206716a33d410
-
Filesize
214B
MD5a9b04ac05ad0145313e53413430c1b2c
SHA1cfb09ca0f7c62f98c4aed87ada9e6ad66a31fe60
SHA256cc595320eff668b3777364a5eb83fef679c70ed594ff20d0d49b988a5718f4ad
SHA5123de1b1914d31b36b1f73891ef3e9bec3d886831caf1edee69ff50be9859534e0e8507f97dbdf8ef8689c30fc5665ecd769ebc476aa1296431f7ae2212059b62b
-
Filesize
54B
MD57f2a398529a5fdf9776ca31b7ef90693
SHA1cf0cfbb02c04d59b24881b56eedf900bb4fd34f6
SHA2564b991cfb221fc07c0a453a1b24c67c0afdb076fbe769b7761dc48f4bb0fe197b
SHA51285e19ca89d226067196ef4c8dd09db2d7a4c5bf7b11fb63dc5f5434390b6d6908a2f8352c0c268bbdb5366c8d15681aac9e497726e067f27c5e044d5c05bbb42