Analysis
-
max time kernel
148s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
24-11-2024 22:02
General
-
Target
f019f7fb6a49753955082ce74b4359bafd4b88dae3965596cc02ee019a525de9.apk
-
Size
2.7MB
-
MD5
286768556f16132a67cb3985665b3e36
-
SHA1
512673f2e09fa8b3bcf724b2990310e7d0337755
-
SHA256
f019f7fb6a49753955082ce74b4359bafd4b88dae3965596cc02ee019a525de9
-
SHA512
36d3147bb279d9f0f62f305b87041bcdb9a5f9d3c2ce4d1ffafd267e018f7f579fdd6b3e450676abcab3afb598083875da799fd7da82cf223d3fc6b46d999347
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQd:e4FjEI4iZaUzYH99yIq
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5576e31485bb499564d6dae6e64cb9286
SHA1bcd9203ee5b32a7f89f9386c2a90bac4c0296129
SHA2564bbb6c37936c18fc972cff9dbd27ca7358e2fe7aa1e934c30b845807a6a84028
SHA512cb68ee82203a2c24abd1b0fc4c29bf5d4db187d33090d877568134c5efe6183ee6e748b08d8b33799cd14ee5cd3603169caac2c0a398c0a31bd9ba0106df28be
-
Filesize
60B
MD537eb5fafd95283d05ae67d3b85b557bb
SHA17d38cdedae0ec1da7ba151960b415a5aa3ced170
SHA2562bbb738c1cba69e58062029c77fcf0d382b4ad511c3a6c76fb4abddf9aca04f8
SHA51254ce7c5fa75e788cb3947ed802b0718c28b64d0fd7d715f07fa8c6bf603051ec770b312dcb0f2665e5cde1aa8d159d6bf3e4d3916828cf1b9cb3c137d89ec9d2
-
Filesize
52B
MD5b21601b1e849e04ddafe81d1fa4c763f
SHA12c9240022a047543ef590a3a6afe6a2316042e70
SHA2563e43d0553d998908de3dc5604b1d55696f9e4e84f6047ba09de6b3593b717fd4
SHA512cd52939579a9a577ceb31cf2215499d8964c66ee12d6e3560bb4f10eef48b46baa2a09072c769254a9fc69dd97962848c9aa72a1bec21683658de89042316189
-
Filesize
70B
MD5aa6e98827c7f08c745ad6719c37ec2de
SHA1ac8114ce2f9891ced9d6ba620b04132afa3a81d9
SHA25650e544401d00c299764e5b9d35f01c72e79d4af53a9f2dff3e52890db20b2e5e
SHA51251b1a9153dee00fadd1e119679562abd5ce1ef169378cd82a27b886adec4d0219e99211b23a490c9f95cf1fe77b33fa2a5ac4127974869c03007168c63261490
-
Filesize
55B
MD5a0f8bd7ca826798bbf0564ac1bfa889b
SHA12ea8ebea17c91978491af2a933152d92ef89f8b3
SHA256cfbd3007fc24eaacac2cb0458adc5a6a564c6c9fa509affff54700d177afc5af
SHA512e3b1e93c4506d42a119b8cdb031c9588c4636b1713155483c43cfa4a4eea2cbc03d9eef72dc1d162899a32b85772e889a898eee9c1ea0ff73eb6ebe37404b926
-
Filesize
45B
MD5128f4a518320873bf659843109f55af1
SHA1c85c22c9c39c6a9d20d844076382b704035f54f9
SHA2567d939efdedb64d466752f3ac24b47e89a72905858bd93a3ba606927f385e2972
SHA5127346985873ba51db25055a3e08321e44ed5a2fe7b76b372dbf5dbd9bcb968ebf3b3cae8c5d01ac30ad3069ff2f7936fb09da1857cbc3c37832f75d5501fd3390
-
Filesize
70B
MD5cc5d534b9efe62364879c4e566b289b8
SHA1ee89fe57e021ca7d0d94ba6a7ca0d3d6ce58da1b
SHA256522b91a2aa720004b6b95e0c338105c8c20cf90912e5927e03519495ab02c1e1
SHA51274b4e6a26037611f0b486ad311e371fac8b2eaf78efee8838425808a2caeb34f05726c5c0fcadc059b26a9d57c1bf7eb4bbb7ea7bcab8e1c52f9894f7fb7045a
-
Filesize
45B
MD52f137021d532e7c896871306f9f3dfbb
SHA188998dcba91694f1f4ce24cde6edfe96f592529a
SHA25697753267e6a096dd1d8105a7de36e85bf7b73a4aff8bf1edbb738c51bdafcb52
SHA5125ce58a9aca30d0b2fd20248fabb6fbb867e1cd50ee4e802e6454b5d99172043bed923e0956285188ce3b411f7b33f2e39881bc2b1e4d4442dc34a4f453fc0e00
-
Filesize
79B
MD5c1c2bf13a5045619d2a4dbe96f6539e5
SHA15ec2a397313e8e51a0aaa7a03853cce04cb59a78
SHA25690ac3583f250b0da7a1691ea04ff1faec93f755fa7bdcbde84d07a5ecd10246e
SHA512f27040eec56d206309c9bf9f185d4f37ca510277092c0f75caa36515cc94476593874124c109ab999e9ae39cf61b6819b93b65486ba468abc20cd959cef65a28
-
Filesize
490B
MD5b7126d42b38b694df5c207a7bc91fb46
SHA1ebd9ee1fd9ebc16a2b10de12e733a4b90ccae3ff
SHA256f6ca413cdce03cdb496eb14dc6f68434a3587c49e4899e5ff598b0a80efd99e7
SHA512ba7cb5640b4119e099f8b268ceba428f7142fa017425819476b461a4a9644383b2a1b58cee43bf8bc635b33cd68dffcf1ce1b433392b99d45baa7bc7e6b585e8
-
Filesize
214B
MD586f0593952449c18ff8cacb068a881a4
SHA15fa3d191b8403462cd413e35286bfb7c336897da
SHA256cfcae2d7dadb417f069704d6e2acafe1a99dbe4f67779a63780e50d9f03b2d70
SHA51228e50af03cbfda0cb0d7d5662408ac49143c1c0ad7b376fb9fff7cfdf1497a337eb1aed4a12581969b4e8a9af9f7df811b725b7f3a02a81d9d33852c8ac11705
-
Filesize
54B
MD5145998005614b60d5c7e19881933cb5e
SHA1c566e2c9267e21a8b3d9476889b132da3495c5e3
SHA256d21024450b0cf0630edcae9f1fb1b33f0bd7f6fe115e8572720db636b50aa3ed
SHA512da9710fa79cfdc91921ec4670f73ab48f70ab3448e004656b4954d51e4cdc943e5c331137e6593504c6121424244335454b5e5694b5d022667659d5c9d4e656a
-
Filesize
52B
MD5d0e146ecfb5713df766e810b49fc1e1e
SHA1094ff8a8e2ceb177db0c4b1f1cd231382dd4310a
SHA256744faa4815b05fdeb57b539c539b8c1dfd44f6eaa95c772e1ace432764b68dae
SHA512b500e5f4089482aa64344cca4f6fcc5da4b05d493fab6c21024b31b0223935340d76a3d71987a5b0c976f4070bc062ca2428cc3f7f3083de285c6097bc633c78
-
Filesize
70B
MD551e5d8993c7dd8eed9b134ae8f0dcc60
SHA111ddcfa07c5f096515cd0a6e08b8dad0a006c172
SHA2561a4c54e4845fa608874bd06e01bfcebdee12b69d222485152f71beb90038db22
SHA512faa3c05f4519bb90c3104b78a59545e6bd1c218dc8fa289e089a9d7fc30d021177be7a36e05990dda2474aed69bf9c56f8ca3352c5c7007d12b1e13a35e6d880
-
Filesize
52B
MD553cf30dd8cfafba8988e9a4dd1cf38d0
SHA101c3dc49368f4b256f856dbeff94b35751d08414
SHA2565fc10f87c849efb42cc16842514cc06fe6dc31e6149199426e6cfc0e1ee6f271
SHA51284e18eb535c0c0ad48f0809c0b9330b4a67fc620883a5e2eb21e1118f39729b830595662702271cead522c6815df82afe9115943340ad25327dbffe249a1bbdb
-
Filesize
66B
MD543249ea6fc7ea9bb8fb4f6e28a6f53bb
SHA19c5c1182949d424b24705dc966564080446db6ae
SHA25637e354348977002cf921092f56ad9dcd91274153d5a7d114d9428d677f2a12a0
SHA512749a3c927090937dced40a586f94fea8ce1dda9cc8feabc492f5e558e7145a3e3ca32061bb8484d3ab7795c6069173b2224b98a6e34dc6bbc1708e43892f8150
-
Filesize
84B
MD5a235ab2e5e2218e43d0b102474962e6f
SHA196fa92cc7a41870f0c0f6dc92d4428fdd353fbce
SHA2561bf2e23d002807741f81dc63f82eaf4c5a7c4fa0f2c0f6ce820a5334cc7bc4f9
SHA51229d8dbdbc69d480e9a05c5c44f1e80ad1a25813fe64d2a9d61e3a0a6521fcb64d98ca09182ecc43f827ae674c7f0224d998e78c39e0401f06dd4fa57dead1ea3
-
Filesize
68B
MD5fe35250878d7a114a01ac5c8d4612b96
SHA1d21029e9912538f363d00e44ef3ff670a60398a7
SHA256d954be703f414feed0b86582ad74fcfd47288a78bbc8651f0ac554440085c8f3
SHA512d143b8fbc0bb1efc7297bee097f6fb5dc8fccad70781d2e463a029686d1ad5fd12229c66b4632f2b0f7767aaaec8f187b0c55387c3ee1638f95112924c9ccc5f