Analysis
-
max time kernel
146s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
18-11-2024 22:03
General
-
Target
ff79fca5d791bcb9320e6b713bfe7e444a99b0a2e7977b813e58cdc738aa0633.apk
-
Size
2.7MB
-
MD5
1b7c72ccef28db93bbc5bfe9f39ba9cd
-
SHA1
3113e933edbf184bce389da1ee4d80a356fcc0eb
-
SHA256
ff79fca5d791bcb9320e6b713bfe7e444a99b0a2e7977b813e58cdc738aa0633
-
SHA512
aa70592c2acfcd3e2d48a9daf85f76923fca7823019868b3a5e0625e68aa2a4c7e31543b507bde42afdbd0b1bd1eaad68dde7869e2ac35ca48b302bc883850e0
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQI:e4FjEI4iZaUzYH99yIr
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD596247fd9e7fb8b73dab315725bcca798
SHA12a223183a74ea778affa15c90680785e3f8921c1
SHA256aa748c29093914cac1cee45fe1a20701d40c7c2b7ffc84593770d2e780165f8c
SHA512f7c4e6ae91c670f3297dc59f56ac0ff06a1fd85c8e24ad582f8b71d9c164d55242858bd70ecdbcebcd3e9c0aa33a6738714b4129d73999f97dde48422c1a6341
-
Filesize
214B
MD505cf781714b4f412e83c8a3ef2b018c7
SHA1cd9a78ce8af6b0a9e6d4d530048da2188985c702
SHA25617c35796f187b6db073fad6b6f252584ad5a1931daaeebe542c2d2af33dd1473
SHA512ddca98640e71aacf9e1f81b218a96fc367072f79af52717eeac8dc74e95cd9f78f9b4ca48eb4eef4fe001af4962e74b0d97450084854fc6f876a3e10e7421891
-
Filesize
52B
MD52fb9104287d6c1164540d1f934472bde
SHA10e00cd2c21f604865f6cbd6b92ef7678f25ef98b
SHA256d97977d21fa9aa606bf9d19783f2e3cbbe7225cb7bcc477b85f40617ebbed7af
SHA512d861768bbc99eef6b8dff4393ca962e72542f2e512c0f0d83bf914157453f89582f986232fa4a8a75a757236524a5f6e1fdec843c8551d338088f26b69c8b74f
-
Filesize
70B
MD554d80b16bf1f47c73838823527ce80d8
SHA17fb753292e4f96cd007b0e83e606a86cad6a435c
SHA25676efa0170ed9973e1b0441b10e0f2f2407e0aa27985c4269eb349cee0d642ae2
SHA5120dd0c97c7417a5c884fada92a775d7c21b47f6007d9ca5995117658f22775247ca79580977cbddd589d76ad749f33102652b8d5f97470a95b732c60129838179
-
Filesize
55B
MD5b71cdc6fdce46840f94c16f84d7eaec5
SHA1840436d8df98b94ac0b65bc6ab884daf16e4ccd4
SHA256691c9f8c09a78a434340d9b6190bc0d6fdd05263527dd4b4d82e55ee4ece52c9
SHA512b3ef5eab1ba0083d312e4ad1abe3ba4dc99c773350b9d6212bc13c2ceaa275aa7a2eed0c31ee1793614e69b107a01dbda1b7b6a22fc9e29f8df192ec29d010e4
-
Filesize
490B
MD5926483a469264a7e0c499fea15d27b1f
SHA1cd4c016f8cfe29ea86c4b73dcb2a260c31d7cb59
SHA25616269fa6de3d1df413c82b91f85779b90e3be740716cb2ad46c3dac9976678f4
SHA5126ece4ab09d3b350b658888b41976d807c6cc996df37c598eefc6d667f95c63d709197a27447aaf693eb07e3325e31c3aeaaf8c0e999bd41ea8376be306806822
-
Filesize
52B
MD547f3c110fa1ca461504cfd8112282882
SHA1d12b6264134f728a168fc23ad7e35c1f89c2b14b
SHA256b2f6e3116c640052b804ddad7ec44f824400a0ad9f86ba84d400bddb826dc90e
SHA512c1529275883e247b6010fd4989f5457bfb232d95def031116bd5cb4ce9132d52d281d11420a2ae4e628b4ba845e2df743b3fd030d6477db464d662cfe0fd465e
-
Filesize
66B
MD56fd64cf4cb27750aafebe240d20ad5f7
SHA1b4eb0bd4234cdafe62e0fdda2dec6bd688e78ae0
SHA25679f3dc09dce23e5e33e6beede09734ed991dd2803ef5f32e7c0dd3ebe50fdace
SHA512e522204575206f0272a1ebca2ec4053d154e772de002aa18cdafd1474cc2f3d8e70d29d2029c4edca0a49840ff09e293b069b95758987511d96afc875fa1e931
-
Filesize
84B
MD5cded8389846373eacd5448cd3e6126a6
SHA1bc138e9705bd1b3b9bd7152079017b557879642e
SHA256f3892891a02ef68957faf6dacb0560897a72be553925ee68cb06a5ab66e1f7a2
SHA512be68cfc09be778589a6702b5f8dbad283e1355ed357ebb093c3f86a5aa46d6e731f5277f5fcec3590267c6807b0ba147a29fd467b4afa0ca4d4875471ad69b82