Analysis
-
max time kernel
149s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
17-11-2024 22:02
General
-
Target
3c17c8780747d72674796558cc3219c517769c00aed942c9ca05db536ab91519.apk
-
Size
2.7MB
-
MD5
168284e4f9fc6d8cc336d9246ebee657
-
SHA1
64781d44777c1f863dd2ad998216e6ddb4f3254f
-
SHA256
3c17c8780747d72674796558cc3219c517769c00aed942c9ca05db536ab91519
-
SHA512
98d707c8dba1fef5ab71a6968263f29e01811f480f1477e7ff1fc42d5c40a7dee81a7bb5330a8181a79be9f7dc5c4abbaa3031574a738ed93ab4dcbb5c31b150
-
SSDEEP
49152:B86Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ/:yFjEI4iZaUzYH99yII
Malware Config
Extracted
octo
https://178.215.224.87:7117/gate/
https://178.215.224.87:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://178.215.224.87:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
66B
MD58b8cc1071fe102211fa5f046a77a9fc0
SHA1f25018bd0a6172103f8bb82e955ea76e1333bf4a
SHA2561fffc7b641eb8f5c50fbabbd14f209b3f7a568e2a04a152abb114b39fee91d92
SHA5125ae023f4778486b2dbc9e3774f35cae65e60c8e04a95446fbfda0c4720b74d51488c049ecb18efab652f26d9cea663e83698e45f88c7878811e01f7388851713
-
Filesize
45B
MD59f91bab94a35183082c6745aa708f015
SHA1a108631153f5b97eebb2adeaeb11747b06fe76bd
SHA256040cb34f2f7f8bfc37d7e7e956f75eca4f1a9c60b67528c449cbad45bf982159
SHA512ebd880d779ab5afaf65948a12ea09158cfe52cf38922d0fb23b55019149c856b2bfc144e9a59d49d5077337b9dde4c6c6cd38fa56c11c62d5998dc4c350d910c
-
Filesize
84B
MD57ffda875453daffe8de67cf5310fbf09
SHA12e7f5341709644ade8c3ef6dbeeb741b49606992
SHA2560805a6c1c8ad11dd1aa4eec8395d0376c3c1e224ea8254c96de24c9001bf7428
SHA512d190a2f5fdaad1b29128d43373fabbd019564eed11f18cb0084f9072930a1cacd1e61c5149fe8933a7c36eb3f92212879d4419c4973b5dd189f7ba07c176fc2f
-
Filesize
63B
MD51ce4235a55472e339ff55ca84b6a26cd
SHA11ebdc4616d03560bd376820bc62c1f9288ce0464
SHA2569aaca67db592c7a48eb6270821215114d287cabe36bef8ba0eb0329465294f08
SHA512f6bcd6e362326122214afa6192bde1a5bdc15e0bea924abc6d1a1f5635a8023b7ec9e3f4fc12c526e8e0a734a55d5844b105a888a3070da9a91d319015971e93
-
Filesize
230B
MD57cac0804be1a860cb8de4ff004cffcf1
SHA1cd7ed41223128e0283ab15974fcbf6f14f10a508
SHA256258c6b4fc0a0f4cc0c8a795ceeb066c3c1f3995caea4fe9d45510a2508b6f27c
SHA512854ba6a401770242e1c07cc19c9714f3a468a123fb15172d2e122f827963c92009a02230f134002c881358c18bed5283e54b557e172efd796f50fa7a3d3277cc
-
Filesize
45B
MD5b773e1563397020185617dc7d894f349
SHA15c823b7289ec3a1777e56968004d08f11afe84ba
SHA25650a09669ead64a7a9af3391abaee5022386342748e401bcdba166a360b22365e
SHA5126d5c10faefedf9137402f46df83dad4bebb0d89d54c1d05a5e0f20bcadaa587c7726bcdb8ab5c369156f1e3af56692786e3f7cba0fba5f06cd4a3afb9f939f21
-
Filesize
63B
MD516b37acb41541e1de9db9a442ac7f814
SHA10119ffa4a0ff1a457d3e2fc85f398c68f95c6934
SHA2563ee17ec2b2d6c8fb72165da34631454e7ca0f3740fefe8455e93c113c1c06ae6
SHA512766b4aeeba9152ece24ce4102cab48cf4e8b6fe2c2c6afa0c7f0d303a2fba8067eb988c63d01206128a301b4fbd54ede69fe6207e666c985b405f0bee66da4a8
-
Filesize
45B
MD59c87f6a383de90fcad75996fe11a464c
SHA1719195e4f3d2f1bcfe9959f120b052da832dd6ba
SHA256b3f6a37bcd596254f5563b54de5754ca7439f2243f2d010c7c57f59019578fc4
SHA51281f267f8652f84a2974598e8f8ffa1a6fa9e7f09dd6d711f4b5ab0ede877bf4e218449f97092019f310ed830e8895cb70af47e5697e631f576027291c2a3d007
-
Filesize
466B
MD548521a8d6454f31966d8411b7efa4a93
SHA19114599ad4319a134628110cbf0d1ae1a7f57114
SHA2565ad5a03aafff5eaa5a2f13a5ee2f1866364533e6aa1cef0a61f9ab3ab3480208
SHA512bd6375d05bf2b73834eaa620873229d752b4d9f2ea6ce41c230412c2a52d82fec72280fdbdc4362f58f33edfbe9ba0d998e6ea3c9bfb756d5e242460736d1151
-
Filesize
63B
MD5299ac56b83c0e85ab1742e0ca017dbcf
SHA1c0a303f8b694c82d53dc742249bef080b3d638ef
SHA25667a6c86faf48590c751f3d589ff96cdef856f7a492c2fb00dd3e3c5c155ce24f
SHA51215ce110b7a0988178c571c7e4ef5c11472b1fdef7a93337efa9801768042b63e1d33962a73f0687217940a154064493a299173da218ebd45849b497763d91a21
-
Filesize
45B
MD5977fa261b1953f0c773ad1c2d40de3c4
SHA1572249b36fae5fecb5924c60bbb4d0cf9b6ff280
SHA2560a7d9c3d89410d10d11bfc6d8c5027b5ccfe6cfc52e9482c4bb1aedc3aa6dca8
SHA51252b6711c353f348bc9868de8ddd0f6814477c446f15233669e17638f9a9b4173e6f588622690a22c3592707b9830f14a5c93f9149267743d000fc7363eac011e