Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
20-11-2024 22:02
General
-
Target
174d6b3d78ae05442410a527959d80a18cc60fff45e591589d41e7da46e6071a.apk
-
Size
2.7MB
-
MD5
fc612aeebd84ed3c98da0cf37df5b6c4
-
SHA1
a444fafcb12d85d1422432632158295c0bb257b2
-
SHA256
174d6b3d78ae05442410a527959d80a18cc60fff45e591589d41e7da46e6071a
-
SHA512
698b2781ab3fa970f288a285f01f043305a7348e471bda84f7470b26379c9a7c34fda32aebc82b614a40aef2897c6294a610361c9c1c498b4e1b47d9083d4d0a
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQC:6oQrwFjEI4iZaUzYH99yId
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
https://alicetvyineyayinde.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5b3f182defd2031bce62a8966a3515351
SHA139a35458183b481daf64bd016aeb8be4a2efb0fb
SHA25644f78ca5b73f0b5cede6f58626258d82bbea3e62ded30e9bde68ba05b7bd7c56
SHA512c37fb00bfb568f5a51af931e48a81131b52fc2a0329b1e1860d08f86c23fca219974f929cb9850a8d578f37c2e3be6e23aeb7c7bd302da34ef3b218a672a509a
-
Filesize
68B
MD5cb9007f29f32f6fa9fccd1bc4fedc365
SHA1b92a2142e9b091895fa4f9076d3260a361cb86c6
SHA256f779cca6ecec9c2b2cd488f34bd80b142c4dd82ea2c8880ca92ba708402336a3
SHA512b122910fe2d62cd7ac00c6e28a1fb9b5952ed8fa851ef47daba9ec05cda5172fd48dd0789fca54a2af71c8b4dcf978fb1f09c672ecf11dbc215f473468c9c158
-
Filesize
214B
MD5989c2e6da0c20d0c19133e50fa99c2f6
SHA16a7911c5839a3cc9503d3ef78fe26cf0825dd808
SHA2561c2caaa26d92ed0f6cfb8c0235d141c4dffd49a102a9134969a4e12950d705ba
SHA512248f83be5712f17f14bf7005088353ebf9901d48a3bab7b31590c3d3b9159eefbb2c059a300a5c72231e5ad1e9820e06db2f2d993f8c30f6d4a084acb18a3278
-
Filesize
54B
MD53ff165d9f638857735c6466579941706
SHA1703a7c5fef23f3ac95699c5fc7fa343c0a343481
SHA256d9f2767c777a6195b6f33b50795bdc9dfaacb4282ac39b6cccd6e5abff15f023
SHA512d3963c4470c2ab8d92aec5a1b793d3e0963bc9a343ee201f8c7bab9cdc732e02bc6105248d8a8ebe3bdfec7831035c36cce4ffdcf56795da446e9f445b5c6290
-
Filesize
68B
MD560747a67be97b973da14ac5a9f0cc25e
SHA142fcb4b7ecf4e14e8688cd244faed8b782ab7c40
SHA25602d8cb42924a46dc70c6a8aae641206f0a3e3721974a41d418e19727117c2723
SHA51234e6eafa9259580af45efe545cece5fa5d61d3bda3524b913b66f93c2a9975228ccad9ec09c43214860ad7c189a646621ff76a2281c39ae8d2f7af53c85847c7
-
Filesize
60B
MD55107b074e54e3b3533cda5d0ffebaf16
SHA1c64657e92f5104f954d3541f6db98ea1698d3219
SHA256e52c9d0e5c1cd044f757abb3d79646197bbb71c61621cf796e4a1aab9479f710
SHA512386f7a955cf66a3e83a38125c4405bac12bc389ac6c3a9204debb01cf11c5cd78a94259a9110d8df793c71289afd2214a2b570da514c7ca070993cc57311dab3
-
Filesize
490B
MD56f18644ff8947ba244073c1fd5dfe262
SHA1717f33c21711bf9c761c0ff1e4984d6c211a2d75
SHA256a0d1f19c5e2db70feecd330e5609c8062dbed333e3b10fc320805c1b445ec681
SHA5128343228f5bb87ec2276b69aa9a65ac19d40db44f5ff773637626f1d475d1ce074080efc80fb2ad9d64bb179d13f25dfa8f1cd9e2a71353949f33daf6f98ea1d7
-
Filesize
60B
MD5dca50b4459b718f5e5941148d818c196
SHA16dce5f8cfb3257050e495720ce4247630b03f884
SHA256521aa1f8ccac6a2ebfc204b5b7a4c5f73dea7f04f508cc37c0dab80d9ca8f886
SHA512b06284ae548f00a847b6a491bca01167b800881f75398319dc7a6f2b03f78440f1f1db2efa59d5822b133855dbc0dd561de3a6f3ad9add18f0583eaa85eb54d6
-
Filesize
52B
MD58115bd9f6c4b0ab45bd075599c0d4a0e
SHA102c2460867edf99eddbcfc27cba9ff6405f510f6
SHA256db39d39ebe88ea1144c1e0e839addb1f5de2ab6a853063b4899c66db29428586
SHA512647c93ec6bfdbdb933218bfaee063ce92baaf3bd6d48725f295ef35b280b5955d2924934ded223601f439c615dfa31adb4a50e94fd2890133ecbbc5ab6f93f7d
-
Filesize
66B
MD54156eb6cb953cafa644af442551a7b37
SHA11ac8ed3237ebc492024f8c56dabd34f7c6d4d4d8
SHA256daf99d64d8161a0a3c431a2ae98a226dfb1823e6bc126a2f8575f58273dbda88
SHA5129d6627d9bf90f8ef58bb0d0ed1a2d4439cc876987bed4522eef84534665b01cb618225d9b68f64d333fb5e49f4e6edaa3e50d3a2dc1e42174badfa6d05b97408