Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
12-11-2024 22:14
General
-
Target
8b549cf317862537c4df13f28b6fd0354dad4f99a0e1b2586ba1b4e4ef5a2d1f.apk
-
Size
2.7MB
-
MD5
dee4ba6394eca374cf6204ce03b71119
-
SHA1
1e7dfb5f4319ce817548b909855d52d8ff0a3095
-
SHA256
8b549cf317862537c4df13f28b6fd0354dad4f99a0e1b2586ba1b4e4ef5a2d1f
-
SHA512
a8df08ce24bc6cf881d5f5a832221f16a5af757dd301a97415733f1cbbd00cd17097855e95fb4723eb7e3fa5d6b8b1a48af50b428b7e8ab07172fe7176a38591
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQa:e4FjEI4iZaUzYH99yIh
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD59488e09d6760e4f01fef6dc58e1a8632
SHA1ff17446e6efe01b88149a39c99e40f1fda240db1
SHA256b0191ad952c63014ce62bea627b17199a0f686d232b60d7e6a759760796280fc
SHA5129d806a997c4aa18f78fd581f6082a43acff4fe8204d6148bff2c219e69e5803123b0697e8d73586b4af20f631f611e15cb181313bd4896b4e6ed731ee1009dcd
-
Filesize
45B
MD5ba5713e74276b064d36ca66b98561c3a
SHA16e01d13b13fe4c495fd03ee0d11eca3a70db4d2b
SHA2562934faa7c6600db8d161716a68ae318675bd2cf3607dc97d2eb8770954589c35
SHA512e35c9e9edbe762b07d9603f2332764541216a5b0ac33917d0c25384f844dfdf3fea1c81ea387b84ca666f51688ac9ad97152256122e61b9c615da8f28c3420c1
-
Filesize
490B
MD52e87be1a1b7f57589b2290100b032ff5
SHA11f2c1c2a2ea65a86198f41ee1568da42c5131968
SHA2568ed596377b5f6d3b29e038b0a76c5630ef6c9731aa644603566c8cf8c1e45de0
SHA51256e22e2dad679cf3c810de62d0359e71c716193967075b8a9a87fed3c3180a687865281552b5f9d056fda8aa6d49afb53d92fc94f0ea5023f78b9c2e96e6eb84
-
Filesize
70B
MD5da1c163b77029853c9ff48559c87533d
SHA1de24b873be0443049f77ee09a4902b0fe90bac7f
SHA2562f7b1abb01d9e0667ec7b953f9f3f1c1a960e17fdb64f44e286e44f33bc23182
SHA5129fb9f8f59245c5e25d1d7643315726cb6c93708f327dbd577cb2568eeb454deedf70f2aee742ecb8d542d3e93fb4e93c8ac711c675dffa5b30b59bfe15454021
-
Filesize
68B
MD551c3dc2a298d0232ddc752d2fb224550
SHA1568cb158a702e0539f8d95f8ff6ccbcfd9e6757d
SHA25687e598b32d1c6c5df72388266fc047a9cb074f354a6ba9d3193a82d6e6f0c3ac
SHA5124f93b888dfd131a89ae4941e35f84016736ad2bd9ec1701c4ed64d576c2de122f897024b1c8690e23c5cb94c1f3a75c7457851ac1766f1c45eb7d7bc95e5e48e
-
Filesize
60B
MD50887b6cbdff1045712716d670725c02d
SHA13e86c23d0c09fe6dc622e137d534e2ad8535c5b2
SHA2566d2b94d8116a97d1b7cfd1f69e5a97b8488efab2dd545f13886d3b9211f02417
SHA512b385b4ef118d1865a3e2a4abf7d6a086fe9eed9e19f914590ffeefb95d073b297825bde797147b21309a625c6ff989edb89d2a24264420f8c4d2c67891e8fd58
-
Filesize
52B
MD59ff7def8d278a226211a08f80e0a7f88
SHA1071a82ed823337ad630079f69c6215b4060b7db4
SHA2563fb9d6893e404c98090f8b05886965aa1cf5180bebb773bfe889586d7b316cec
SHA512b11a50b719dfbd955f738bbf77da35bb9438c1eaa04fa6d802e782c987b0294636f0088f5e59106bb70e65b7e871af2d5fb34c32fc6523fc26b59424ee55e12a
-
Filesize
84B
MD57336abeaf2f8d9e35ce900e2d66d80b5
SHA1c023883918e72358ca8efe89b7319f66661ec460
SHA2565da99c0f12f57a0ee0699d4fb1ad5e59bb20319a635dbb72cdd77090e303c158
SHA512dc17c6c51979fd174af4e0108fdae9c9222d432c9f75eaf48add27dfa91123fff1e396dfed4dd9a5e8093da752b623f64e51a5274f6da38f3ceb754f05b45cc6
-
Filesize
214B
MD54eeec412f1939f07decdd86b54f3db6b
SHA1b45db9e02f90cab7568ea9c0e68f1dcee0c23c70
SHA256cc94148245931e1071344741876289cd487d35d3835b232339b43986eea5e052
SHA5124a4b08f57adb85e1bbdfb85786d13eb60994cb1f0e75a93cc9b3050d2f033283520c6a92687e24d09b3af8b6f68434e2e6acfcbc43be6516064ff33085e6ef58
-
Filesize
54B
MD5705ebc20775c491c61dc29f03fefb897
SHA1a653cf368d8a56626c8efdec940cb91620ae3b77
SHA2565c432c181611fd4cd4cb304006384afe378ed86561b402728d652e9accb61dcc
SHA512bd37c049d7c8a4968a66ea45a55c8952fef2141b387bfdc13f285ef7821e6a84f9f35834d1271d733def5879af1343d9959557b4a0369d53c52283f8402acb61
-
Filesize
68B
MD5deb79daa7b12f4786c54ad73146a04f1
SHA1342139d6f79060265b3eec722415fcb57c971181
SHA2566bd39f1d8172b7ce32d731d97416eea9df67552cc50a70d8a2d18a2f29a722ff
SHA5129a328b551ac0de8ad56b11bcfdcd48bbafa03ccf33a1cffea80f12f4acead84b60a1e3ade966257e17b29c617b516fed2564e0665cb17a386af336db8b19f869
-
Filesize
60B
MD5c7eb716bee63f0fdfe783753775f15d6
SHA11eefc4c45b280a618f7c2ea04079403c73289f92
SHA256af6720d56393493d710e5e474774aecfcaa1d8b4c5506bb27fe5e834d6573898
SHA51284095cda08607b288277a23c8b24e5f97041a620dcf41a7696a3a6b2e314d42aa42f8b3e973052addf3d28c5b1be9e3fd8db504d267218060e43bedca7d87440
-
Filesize
52B
MD52fcc70f011ad68d41d7ca7510593479d
SHA169d310a72129f00129b41e0e618b6995b5fc9425
SHA256ca994bcbaafb15b8994ce6f823c9e1ded3254555d9531dd6c5c5854413f58eb0
SHA512c7dd609b17cd88a92e637c6484eea72caa743ef3bc2a4c1aabd7519d5824645c46b90d78a71b49536ef0fa7c76152dfd7ab9cc4892be5b104dbfa47e4391a03d
-
Filesize
70B
MD5074404103f489c65e268b884fe747564
SHA11a8320ea2e5cc39cb91bd39b70378a7ad967c87e
SHA2561096a3c9b6273b6e2689f22a5739723e737e08575005c6e6da692a908a0b6c36
SHA5124b8bf93b18e24e488a4f93db4d2ce2c41e1e2af6aa231e037cad0b248252b10c554b025eb4def37b74ceb4dc814dc488c62d36eaa0f537ff8af0b3693ca1feda
-
Filesize
55B
MD59fb996bca9a9fd6050785dbf7e8e09f8
SHA1e8a5df4dbc05170eadc160425c5fd37f40bcb3a6
SHA2568c808c760a74b9404a23342b3bf7da755dfad64363b8b8cb6a28342e1720620c
SHA512a0629a34e09c03063d53b376691c0ee856281b4be9e8c92e6562a72baa7abfb51eab5319fc997aaaa23cd2492a6297622e69558f4e36ed48d6e52e5ac6e221c1
-
Filesize
45B
MD5378c1024f36d567b2f2c1a10167ead52
SHA136447740decb37ad9916b188aa21b958b8af1886
SHA256106403bcb62226917de99939cb7fe5852b24f759af6ba6cfd5cc84ad5df8559e
SHA512f47315ff59e425c066a53724242ee64daf1927db67562f7e7684f99f07bd6448c64176da18b999befe616e5fab4ed8f055c473d47d31b265c6790a5cca5aa4c0