Analysis
-
max time kernel
148s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
15-11-2024 22:03
General
-
Target
47774f8548b74ef7bd2ed3d16ff457a957be69cb71685636ee8eb9c87ea75040.apk
-
Size
2.7MB
-
MD5
b3f654a118ed21bc207e34f256e21cdf
-
SHA1
15fd265f66beaeed82ac4738396638d207c1a8f6
-
SHA256
47774f8548b74ef7bd2ed3d16ff457a957be69cb71685636ee8eb9c87ea75040
-
SHA512
ca3c10ffa3c48260434ddd6df70b46d41620e47bb169507844c7a2312cfa03c41d14370a857ed3931e20ff6431a7a3078a17194d386d3a9cf0fda603b7ce1f0f
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQI:e4FjEI4iZaUzYH99yIb
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD58dc29a55de1f7fc7fbc6c9978d5e6ee2
SHA13e940b6e392a52bfc7697aa3716865536aa05cd4
SHA256de6855e9e0814254969c30f7039a3e2698c08c60f9c36b987a3f46f1eb6c32dd
SHA512a03ac5caa7e7efbb3104055c914e532591eedff94488721e0670d58c567b28ec423ff33b71c6f06575d342c2cf5feb5cef6af409d8d1d01936365ca64c6f603f
-
Filesize
66B
MD5802177c2cc1222c37ea99b8bffe8b836
SHA118117745ba7d5be6522209304c2cd35d4b190b1e
SHA25648c8950014edd96756abb9d212fea3820cc85fcd04d58c0ce6e46b6026872ef1
SHA51202aa5a1d3c06073505beec912f04c21c13dd78b2eebc545d3be4765d2d3b4291d7a81441834d9a6413d1c8218df492f9659da8b2b156d967afca8cf42c29394d
-
Filesize
84B
MD5bd7064d67da2a3a81b0e3cbbca15ec59
SHA1dad16dff26dc4727bcbf846c061d8e06910d00b0
SHA256b60b18cd73f95d55469715f3e5e60da35df94bfb924895ef6a787cb8d2117914
SHA5120782f699f61e48e29e1e859d6a26b19de8e36ab97f4ed8cc98f28db61d33c8fdd47443527c5f1fa237963c0338d2be8c12b6b48074289c76866dfe94b48b159d
-
Filesize
63B
MD53b080f3075b219fef4b1224f299083e0
SHA1cebd1e9e4ff83a5a90c0376f9941a49e9abd478d
SHA256e6e7de93d825d169112e2e6fe122de8c30fa9ce21161b822d0426f9c763571a1
SHA512188aab3a7e6f6755211f77d374e1c15fc8409b680f950820579aebf3b6780148adc36b586e909c595acd93fd738b22ecd2fc1d5c7a3c055860e94b8dc40d24ae
-
Filesize
58B
MD5a837e2d9c69a467c2585d0aa42a04c02
SHA1dfa9e8df7afee85d70189820495e904cc4d76c52
SHA256ef5e09d0d7d211ffb62aa61bcb53bca63b3e0b186ba8973ed11b9e6bbbbe5466
SHA5129991a53f3a6657140769f7f75e2e40f47f346291ddfb2fb35b9509777dd7702f5d964ecd5ebb0a78cc1ce60a760ed95012faba7ff4dfca3062fc3b8e497151fa
-
Filesize
230B
MD53057362902b244be00bc05a90d12a8e8
SHA181ee41a4df95091e569c85b1b5cba84c0fbf41e6
SHA2569baec3d04e531c68a1ee6c4b4efa13f37fad5e06ff918bb4f631e65abf102b92
SHA51257a6225d86046ffa98354732f60cadaccc766127b26ba63b3ecf79a414e07c3c6005905c197dd89cc1916ba0fe741972da0d666c0dc0ab32387de571aa7d8aa8
-
Filesize
45B
MD5f5db2c42f3dcb49e3d9fbf3fc45a1e5b
SHA13d7a79e79468e0f65cc640a42ddb1f5dabab5a3d
SHA25612dcb5db9d11b1ab6a7435f349a0360f683481f93b7c8148dac888c4206c9e91
SHA51237b9cabb532b9368a2bb4bf8b66854198128e5a234b799905a7e8a4ea5964abce6ae071480e7da1334f2a9251a2a79a4be5ce4d8eccd9668808e8e3a380f9f22
-
Filesize
63B
MD550fd49d5015459103aaa32698d4b3729
SHA15943bece093e17d67ed9318531d506916efdaf7d
SHA2561ad1e7377e3b31633d2240251f74859ca8200be5f7aa4bd454324e779b109906
SHA512cae094155bd2aea472becc69bae6d794e7b2f3ae264558f1fd99a28a2557c8b5536a799ea5fb4dcd201cdac2da4ef0cbd7962db1bb9ec33eab0f1f27f7c388a7
-
Filesize
45B
MD5dca1c414aec63d769bc37a53c7785cd6
SHA1160029f3d015712ba274b8423ef41c4f4788b4b9
SHA256f79d43a8d1c9b9e116bca0021a9440ec9db857305e558b0a0856bad4abeeb04d
SHA51276daaeca4d8519d4e988fcb58c6639570ee15e392bd3b6372d0d0ce3308490b114b6d386116479f92539b98a32c4281e654d4b86d1af64443a577ce2111125bc
-
Filesize
466B
MD54656d8763b5a6a90a81782cda34d1c8c
SHA10e571269058145203310c10c4dda07397f9ca45e
SHA2561ddddde8061252f198b7277dadf5d427a412a7c2119b02f0de4363fc27faed67
SHA5125b6030543693a2cd51c55291fe63b11010db68ad04e8c60a0bd94086df723f0b526dd2e809ca6ffa62146bd22c43e11fed5ef9de713d6076c6aa4c4ed429761c
-
Filesize
63B
MD532fe73dd363c688e11e826e6628e23f5
SHA107b7731f9baa209ec9dd33379efe1a5ac2400747
SHA2568009dc3ffd8c823a18d1279d0213c022be25e955a0526e46edacc869a6916115
SHA51250a2db3aa587d77660d9c7d0d99620bab3b575e747a7d1aac0ad7a2bc7db43de3313c892f14c6497e8b9375135d7a1bf5f22d87176317696f2c30a88471c3e91
-
Filesize
58B
MD59e9b209febd8ed7e55ec44830b37d3f6
SHA11e5ae00a398d6d0405bce1f9be77f7752927aca4
SHA2566ea08d46b49052e36d92a12e54eb8968e8c0e5ff7e6914189e6926bca08382e7
SHA512367def4b13a8e6d4625f1ba418b5e95d2c8441a573ece82d0a3926e369c9af65bff905a09d8dac57e3a77db2f6ac5d6692d33d5198c3159eedcd13ef8fe87667