Analysis
-
max time kernel
148s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
17-11-2024 22:01
General
-
Target
126880c968903064da3f196ecd0547c3095f3d225e84767462ddeb3bb3f5d130.apk
-
Size
2.7MB
-
MD5
4f75646ef15bb1c4417b6b3b17c25264
-
SHA1
038af6e1ad79152e97dc7ff53606d75a305a83c0
-
SHA256
126880c968903064da3f196ecd0547c3095f3d225e84767462ddeb3bb3f5d130
-
SHA512
7b803a7dfbd54741617e55e82d64bc8f6ec58cc57fbd60777a22df4f0e5f79b540451e20675c6c0a3c8a3b5101d8c611df2c748769bf0559670609a420378a7a
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQN:e4FjEI4iZaUzYH99yI2
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5346aa1d5b5d5d29257f3fc80a3f22f1c
SHA1ef3b7a9ba92c883f4386f58399aa882319daad0a
SHA256961e14f5ab6eefdda8364c9c961b2eeb42432b9bc47ae2e4db0cc17dc346ce46
SHA512a8e739d3dabd7d21a8cb3b31dbd2a458b5a410f76d8d864de17df30a0e95dca2be77402716bb0ee9821e0d065f8337e7e2bf0aa2d27039099044068270827d83
-
Filesize
79B
MD506654647681aa7916b984d1b45341c06
SHA1a0119d455da424985fb19e37e6b027fc38166741
SHA2568f67e8cfb77cd39d212bf1c6461d674ce159847d9743d038e04abdb1678daeb8
SHA512b23cb1b0b84b1bbb0f3a1e2ba611164e455b03aa901571fdab46ceaa09f44b72779b2fa71e2c2682bb8a809c07987a2688f1664735d2a40143d7d99878ef0d76
-
Filesize
490B
MD53b22800a2c7d90d70411ac4e2efb4ee2
SHA1f8f0e00fd43ce8181f0cce91eb18b23b579dd617
SHA256f8c3872d01460a4182e5d39c7921ca8c95f32c9c98e09da4c01b253a0ee33472
SHA512a13ca77f7185639af2a550d705611eafa11e018f0f31b2a1ce5d25d1c256fa6952559fe421c54b1a8bce550f0c3aa0044fde35a070afec3597b31f9b8e821892
-
Filesize
68B
MD5b81c20942c2b1f81f72fd052d2acb251
SHA189d8469b78157cb1421af766a00141448c419c93
SHA256d533acdc59781ee591852c648060eb29c7d5fee2fc1bf68fdce8b46cca28dc25
SHA512abf18cf85a21510076e9467728447a60dc0c8e39467906a0a1b7905989de7b40185d50b7e98be7f9e41c371395fe534080776d686dbe40e0974ea13febf78293
-
Filesize
60B
MD523b569c9d0dcf2d5f364f8c353839d75
SHA1c93f88ecfba32cca1e1f7b637dc93ea5d14d581a
SHA256b001d1ca999a25e3d1143a567703a4dd1c7b44eefebccd08df45148f5294fdbe
SHA512fd728ac2363609b7c6c434756d399a3f400842d2880795ea0bb162d772d5d26e669dfa94237906637fd1fbfe30f568d869fe6854fd2bf1067154183cd25def79
-
Filesize
52B
MD576f4a189ca29ff6c162f8e28081bc9b5
SHA103458ef7f2a595b7d8d0e672e77591b9ecd94cab
SHA2567d0244789a5ad41d1ea77639a769a0814fe2ad7bfe865c814a840df086e3b072
SHA51202b3e99181687d34c53441c0b343b74c591ee22d2697bc25a526fdfbd806a92c09c4b857d4ed47c61460de79ef763a4d8a2f6596c898e18ee8facabd798e454a
-
Filesize
66B
MD53a6e1b660996ff3d8258c0e72b232de2
SHA1733683d08a063d052de3a2f7f88e497cc2097a44
SHA25636616e0821a8ed12747cf30e3fac322315787c52be134bbcb10dcd1ca498ca11
SHA512649a6e8d417331e1c5288f157a76cc97bf3d3fb4194cb4ea2251c2068c1c410aec25d02d0515061e7efb25fbfd1a5c16e518901b407f32c8cdf1ca307cf90214
-
Filesize
84B
MD57f1030ca66f928456e8af974cc1d1336
SHA171e106b6a55dcc7e9ad1a78754dc4b8df6cca30b
SHA25637766cdec6be8e52985842b516932d09b5e1d20dbcc5469ec58a7cae03114f02
SHA5127be445554211823fb923a49216c8463035f76e28a719df3e077ddfad2da2471ee0bcac7eb914c6e85af7409c423ac4d09f523437963eecbcd3487d0dc73501e0
-
Filesize
68B
MD5e30fb051fb136d5541586a93d857acbc
SHA15532c0d1c29f3c043fe6e532a9f92a033b3e3e34
SHA2563e6a24abd68cba5bc6b590240b4f791f27659790c8e9f36ca05c7506f42fa171
SHA512fe6a6b43b19c5d1c06f04de4115f584ab9dbed0defd04bf83bc84cc8935e557d25ad77abfb8d8a2f5e5b28b90a2a0880da527ebcac8bfe46302eb7f8b82b1322
-
Filesize
214B
MD50849dbb0244011de32d4367f97bd71a3
SHA1ac87ae8548ab8ed6896f22a172cf96bff016c7eb
SHA2563f8019976c5fd7d42d2860dea58f24c3fc5537e7f826523472ea9b11ea488323
SHA512e313839d720c6e4e3a756715e14acdaccb06b98bbf30bbcf73f5eacc21355a6057f3f864a90ee50d4747b17bdb4776642170073096118f7ef4bf78ad6880f172
-
Filesize
54B
MD58cb9ee903e8f0fae4bc6ae442374adf1
SHA1e49c88626d0c8325218f340798043ff44a0c4992
SHA2563fc4ddadeefb09d37649ee370c46f3040810728e441f9ed890b7e306d8ecae1e
SHA512c7039a1f87d1dc5aa924a17ab4a9ef2a7026dbf775c69ac62a546ef02df3c1945bb56921bbc6e4b56abd1e68cb978438fe3fbd67b93dfdcac0331d9bcae9340f
-
Filesize
68B
MD5cc8974cf207a4bd31c2140988c3c27fd
SHA1b148ab55bb8c88c9ae1be6b42df2adb1dfb7df59
SHA25600ca05d5d1abd76a168064fa913e452e11260cdeac6ed7ad0b3403017257cada
SHA512a92c711482844d29a9b911966f007c8eac0c4635f24df61db3a706e90546e2a4bdcb9d0c6b25639efe423fae8d649ce6938d58db75b0dcb9b7b318ce9c102697
-
Filesize
60B
MD5477c2debca23bd00a12704cb833803c3
SHA104b373810a6717d5f2aa6550218abebda14e61ce
SHA256384109c6f82b353b20a1d569eba260fc5c01a94b2bd4b64b480f5c6f4735202b
SHA512320430bf8f047ec5ecc3510b13b18f004a99b8ab9c0c39012157ca915cfe1d2bedca7e3e244247f244e7d8a485c44100945f576389a51a570c5504680f6b084a
-
Filesize
70B
MD5833aaf71e7381ee5a210594cdfd3d9f8
SHA1f2955e89e7bfa86fb3621da8594040df817de2fd
SHA25662251041ca9b1615ab7de28fc2a9f6ce7a18999d55efa63225729c6626957a50
SHA5124f6ee186ac2123ba115a3f1afc46071581237fe6ee2223283afc6b8b6b4c633fc510ee47e38c2441042660bc6339cdf6e1c21ea2cf32e699c22dc4bd03ee5f71
-
Filesize
55B
MD57c8367088728844db758962899aba241
SHA1c370eb38e9ef4ca59b5fdc3530492693e1613230
SHA256e06e535b4a54ef7c5d52ebf0b2c86221da201475b94d70b7bd6e55ad1cd82281
SHA5120fc42b31752ba71e7a585b7a9522cc0938102d95874f7d2b2809badda749e2ba2455fb887a4688b4ce244f01e33fd498e3b96aa2a3529807d843ea9c2cfda078
-
Filesize
45B
MD56c9f5583ebfd3088f8f0afa73d2805ca
SHA11a3620ecfb8578c3814eedc2b3eb3ce2df2e4df4
SHA256fa570ea1ee60b04c97002f9d2c6251039ffac2aa65e72b431ccb284bcec5759e
SHA512f19ac37020395f2f3494ac7f5da682b9b6e69c14a6203844f70b7e0720969cbb2b229a62ad65e83fa67d2bb1d93f3744e6bcb971a4b84b473bd4512ec66cea55
-
Filesize
70B
MD50927e0c5c52d4e7471335fb1b2b2c007
SHA1fd4c32745b5cab1cc79e92c0c03caaeeb3be54b3
SHA2563790257bd7f31efc8ed0e790fc07f4bbdadf25e8e7aefe7467d0b069781be506
SHA512ff4323d4c4e92c48c963c991712cb1ad3a65cee0169aae72d9d1edadfa2f09ed59b77c631b678cc79d2f3c3a833deb6fba6b46c11c8c9eb92d3fbc81cccccb48