Analysis
-
max time kernel
148s -
max time network
135s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
23-11-2024 22:01
General
-
Target
ce3e04281ff4463fbfbb5eda1b756886324a17c8b1097dd5b0b29991f8bbd342.apk
-
Size
2.7MB
-
MD5
3f581775f531ddbe3780a9129c4ab9c4
-
SHA1
472c124fdec66b1bd2ca7b24e133d64da2ed3144
-
SHA256
ce3e04281ff4463fbfbb5eda1b756886324a17c8b1097dd5b0b29991f8bbd342
-
SHA512
3c613ab956fbf821f4f5c34de90200e1e1f256c567e167ec8997ad441cd6b7627cd12d195b013348f2075ac81e30eed8763a39d67e66c8e06bf9256059b9dc05
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQb:e4FjEI4iZaUzYH99yI8
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5ede0923212fc5ff0e85e8d4d770e7f46
SHA16a1cb3a05f1fa8ab360d6d0de7d98fa2770cd114
SHA256573acea1a2aefb0fe41bd8dffd2583dd5616766058723c7ff820db50eb09988b
SHA512a78df57d24cb9f670cc6ad55b1af0e426f1524f18ac0fcd4c01be4d01eb9741aebfc3863f67e30683d5ae8a5d466496df9f3d81ef8c465109602ffefc1ca92f4
-
Filesize
70B
MD58db7a191c8d90d55da3c71b18c4e0522
SHA15f4cdac20359f1521bc76f8f7c1e8c58aed13acb
SHA2561c9d21aa04fb257bedf2a7604e6e7706986f1647d269a04d3669bfd25dee3de8
SHA51270bbdfd9030fd6bfa07f9c9913ea35bbe51ea7cbffa8fb1135ba95fbc7f49c87d75c1aea09875614ab54bcdc2fa2d8d75562fd6febc823bb3782c0c2fa8e40e2
-
Filesize
70B
MD553954ac12633218998bff65d91b262c2
SHA1856a810786dba4f057bedf45c1e00db92ae642f9
SHA256871da4835d402b59aa7f1c8f8b94bab0193d52e055fa4d94fe9461ba6454e31f
SHA512d20e4550d0258197a6fa54adeb8eed5a66317fec85065be46a4647daa6ccf42aa6515353ac4f64de4b7d0daa5a731f18eba4b428c8a2a64461bd19a11dd109a3
-
Filesize
70B
MD51164571dc1029798cacb1365a2e112a0
SHA101280681fbd762cb33c94234ff31757d1fe67561
SHA2568f73ee58efa04bc1e5f31995badcdd1fe9e5029f8ab895dc592a1e053f7d34fa
SHA512a342859bd9497e3dcc914f510785d5cf5c667fb52a40b389b10100080958b68198e3c9d4556593d1d12190c7fd45937e6ea04b039f3a813e5ba8d1f3b6ea131d
-
Filesize
84B
MD585d39fc37dbadb9cde12133a05a8c169
SHA1b060dcfb861da41ef9399d2fdbc9cbed28c4d373
SHA25605e02863ae3652989f36fd91ee74d30e7fc208e6c06a29161b3f78d7d824fe1b
SHA51290dce75d74731d2329c92c310b4d468e5f7c71733ab6a2641916f872a4827956695be2dc16c18d87d05966f8181ff6adf7dda0578fb7170fd7bb315f41b2ae7e
-
Filesize
68B
MD505c0c9d6e48658f7db47b0da931072c6
SHA1d597a7d6153d9b2bd78fccb1c8e36e4b15991962
SHA256f52caab264bfea57e7d7c727117459fcf423d8052313183553e2978c8876764e
SHA512f7ae3fe21177b76e81e6d561274e214da069c40485cf17f440beb94177a9fed7f4aef4f23d7ee779e72601eab6e1993bef00ea32e814f355a543c14415abfdaa
-
Filesize
214B
MD5967c189e1a359de9852c4eea0a18b00b
SHA10f18f0e97c2cb260fc7a0fd4ceefa7e1cd9240d8
SHA2564de8e13ca49c9050ae911a3314a3e34eac98f97c0186e1d4aaa7a8eae0721511
SHA512a78aca87c3b936a507ea2a65f236b2bcfbedf6a7b92d642bc82e8319db2369028c1cc24cb24490284175b3905a61b67cddbdcab21bbfa8bb7556588c1d9ae51b
-
Filesize
54B
MD5ea1fa7b3fec24ebe11af5d299992c40b
SHA19a3c98ad63104e2d251459af95644fc7cee065e0
SHA256b30d0b3661f87dadca841a723e54002edb439b10961cfd0e8263aa67c5ea7a91
SHA5127e7246feb96dc5171af9e924770a1cd0b31752b0b3796ea1a5891c1c80874271118fdf4b69f6111cf91075c3f42f3491aa21b11c981a307332a56c6136e19af3
-
Filesize
68B
MD575535460731ff226e245bb3ae7bd7674
SHA114ff9e6d26be83f06906f7322930c8509c2a05e8
SHA2568705940f04af5748a96e07bb3ae819e48fdfcc0511d0e6310d3caab3fe09a0cc
SHA5126f78dd619fe62b2fb0abc2e443c960f79de6a7837492493da099ce9f7865df64f7046e0ff22d40c7d97beb307d1ca0c5b2a7d20feafd7875b15d309c7ddcf143
-
Filesize
214B
MD576c337e3975e93f8a972bedb8429cb3f
SHA1378d1d8163096eb15f84b05756a7631b958f4923
SHA256cd81c4d1335eeba8f7c785d7854387978773cc952b6879795ec13d52a5ede8a9
SHA51272ce252d92c68e6af246b4641c348fcbda439bd0f1ae1e1cadc3e81103f2b22bea6667878f5bbc1fc40726dccbd70032ce6fc22a28f7e00e12e08018a2489f40
-
Filesize
52B
MD55ed8f5eb737361f05dd0eaad9104bd6f
SHA1a24f05ab5d9c81e6c2d70279b97ba3afbc496242
SHA25605b1dd2afc29dc35ff77ca185f46a69c4a1bbda54bfea53c3d8e4294240c6380
SHA51279446e6ebe39700575a063964b811ccb95e05a9cdaeba540348958823aa0a1efb668f59618fe7dc7dc7e5da0e1fcf28b3df02e00509d74351ec13d3a79193a3b
-
Filesize
70B
MD51ad4ae141a9d89580483a9755fc8e978
SHA1dc823606d69fde2ccf409ba2edf2573c2a306249
SHA256aef7ff19683ed59b9a3966277fb08185ee255a52d3567c462de0db049bc27032
SHA5123856a2fe39049df1d1378f04958b5fc02f21b150ed8ff7edef0754a9fa12003c8e72c9d2102f18344b1188a8428759c00a6a37a9b30903a284cc40160604be19
-
Filesize
55B
MD5f8ff425dd22c52c57a44168b9ccc473c
SHA1d98487fe8f230d8cd8187631370e132f494971fe
SHA25670e74abc381b375788a8d36783ea2709c76f529fab89e36093dc272e85a938d3
SHA512fde1dd11c512fbba4c10d81442d03fc17d4c555289b9591aab72c228e0fbcd0e7c189909c27ef761b6747ee4f74638887af91c2ecd413fbd44cc2f745daaccc8
-
Filesize
45B
MD5350ac065c8555e0ddd010e8e381fa590
SHA1b6b72432076888b4f83c0afd965ae124ab5b237d
SHA256286a4f50f8230c73ad739e0a9c09f3fb5d9655d044ea722fef58348c73809c88
SHA512afff1d5c0342682735607670dc63a6938c50abc084704e31d45fabd8805c88b0097926c3c54e352c28db39316090c016ff59c7a215f1e346f64b5fab1ef0a153
-
Filesize
70B
MD55854c80883c348f7553eb87100e87662
SHA1753a79ebeea80307eef9b98ae08616e1000d39c1
SHA2566d8c91e57ce08c4338274481c4fea1ac125e2293adabc3c74ff2d6dd6a8f6400
SHA512a50d791f1549cc140420965165ec363359d86f9f9129267e564f9d68dde3a3b5aa05e81096c44fd4425b1f3a0da192d4ca33b2e246d17c22137b24da99da3acd
-
Filesize
79B
MD506169bac317949ffa747852d5cdc2522
SHA185d6fcce3ece6a193f38b4183694dc5c377319c3
SHA256c3ae0dd07f1809be829bf745881809e507315bda522872bd57506817011f1ddc
SHA51221a115c1731b2baa219c634cb220017004792c16e7b71af29d433e253e229d5c769e98a60f3e89961425ed0ed58a26e289a30e94e27f30b3f493fe1aa13d69aa
-
Filesize
490B
MD5559ecbc6be703b099c2d7d2c0ac439a5
SHA1c69759452d36878ed35d9e5bb20cc09cde8f4da0
SHA256a483dd13fa1f159674a97b508e30029deb9a751fdea02684f4e6ced782edc4cd
SHA51204468b30fc856f38360fd25547b3aa8930ffc49110d9c7a1d3813cf5238731c866bd66a8524393f40e64817fd6a2b3d6b90676b77449d34ed8b0b79650aad868