Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
12-11-2024 22:16
General
-
Target
49cdaf9f7a4fdacf425a04f6edef3358a13a8ead4e5f10d8bd9456e9b3e10ad9.apk
-
Size
2.7MB
-
MD5
d5d44bdd5faf6fa16413d6602064003f
-
SHA1
4da5528a5519d39a52f74966cd873021936f75df
-
SHA256
49cdaf9f7a4fdacf425a04f6edef3358a13a8ead4e5f10d8bd9456e9b3e10ad9
-
SHA512
3aca0d885b9870f6f50e671dbed72765df359c0e61c9e1d598838b07ac4f7fa4489fef87af4f258087917ae8165b0c4c29f96413b8bcebfc748f88bf2ba77854
-
SSDEEP
49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQh:yFjEI4iZaUzYH99yIe
Malware Config
Extracted
octo
https://178.215.224.87:7117/gate/
https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://178.215.224.87:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5c3a168c1cff258384107ecf15369cd2c
SHA12352ba0db41e6807f122d82bd29fad4a183514f2
SHA2565ce81f1fa1d2d29be6030b65dc7f6653a6a4fecbb97490105b565d4c73e19a7f
SHA5124d6ab4a5f7ea90895bf7d22d683865c0474f7abb30e98539be039763ab0f6fce2da5c49e48355a92f392b7eaf1be4d41eb3d5ceaaeb5831f3d67b842dd6ed3ff
-
Filesize
68B
MD547845e6b0dbe1be234595ddfc8deba6d
SHA1fca0f64cb60e8e1028bda529f3a419c441783afb
SHA256acbd6c999436af81ec632adefa25d681cf3e9b81ed13a909c3ac49796587db85
SHA512100d4a73c6808fdf3fd64527bf4a2b97d702e1564072cf15c28425540d8ad4ff0cb8e29abf41b514bba866a5e01938912b5ee6c05f0ed8a91610525f1c4a2edb
-
Filesize
230B
MD503a9510e60fab953a2c6ac3d7190da1b
SHA1396859a8955131c43e64c490f5718729e6b6eb1e
SHA256228216f973e52d4ba534967e9a1983a3a5cc71d38f6f0f7d897be11dfd5027f5
SHA512e1062c148b6987d15acd8dbab9945b7496cefd05a4e55b9125936ed17bd92dbb95e889ba6c3e2a8d4bfb28b77532f37f59756e0d1243310c93964833dc164fc6
-
Filesize
54B
MD5356c144b3518540c40c660238d05e4d6
SHA1299d66ca356fde21452128839e7175f4c41b407d
SHA25679e580d778a4f0620eaa29ca3f3f3044d7da7c041be1ce1f006c2a124604b357
SHA51273138fb7dbc13df7ff136b1995def4d855cbbc8b27d49ff9fdb6397dcf49f5a51b9ba5075121503afe6de01b8b6282ca5749cc4d5e5234022ba7769ffeb79dbd
-
Filesize
63B
MD5362414936647a3c919992ea77d41d2fb
SHA131c9a7f83976a0e641bd14612f01536b1f636f3e
SHA2560740f28756d1d4801b02dd8143189a103301b8406620eca3d26be038682526da
SHA5127c3cba6f349a0b2207e5d78b08fc6badbc7f937e6d25870a6bd45b729a97760aa2730d1a44ba237030084b2c4eec671e0388531ec1b469724d2b83972cf1a34b
-
Filesize
45B
MD537795cf75203ddcdfe2894b7a961893b
SHA193ae889ba195219dfa2f3a16e953fff2e9d14261
SHA256ee2789d74712cfc8c40583a58630740ac07d96962b5e51ba35d2b8fe549da012
SHA512589146d011fae0e608f0439d59ade4385aaa49ec797062175ff0818ec9ef08699cb718335586b6c40ea851a38d168cce8fa8b28b5b51abf0aa1b3cceeac4c406
-
Filesize
466B
MD5db86c7ef810da68adb1c261cfa6fb654
SHA17251a3a07907cac2bfe2e4a0142be6456629c910
SHA25657c78249516098b52d16185f8f85f016b7f62e448d3f6f77919ee0ff8073d0f6
SHA512d18c84b13b0b160c08dd4187e2034cf7d900aba5ba8b73257e13db423749f009db5702372de9b7318551eef40971f70286f2bd94f343b2ad6f17876bfc37b85e
-
Filesize
45B
MD57f9e450298da47b6ee67b4b0f5d17041
SHA11a3f4f458952a4ee1a34008f5e410f1ae18fa813
SHA25643cda5a7ac51799354bd3c6444ba0e5fbc1859956e7fbdd0242cd8df626fa0e7
SHA5123042fcb4510802efd4a10b495c75a87d7a28315f15276e372807bb14921a14b3e39c1517c8c54471de59f437fa28eccd48f6433a83a8db9c77537dd054ba187c
-
Filesize
66B
MD5d545d86d9b55cfae43d4c576dbb2331f
SHA18cc6e5af933e890346f0b65f656f0104e8072224
SHA256a8211ed28b69cb96b2dd250f5cca367e3b1983c461161067a42e5995fdd5ac7e
SHA512f1b4ddeb5e2ef386bb64a22d9ec38ac66a5790f473ee089e2f905a8f77d3be3dc70f3e3c4c4bb235e6a4fe6c93a8ed920505774a79f5a6ceec365c17c0dfe191