Analysis
-
max time kernel
149s -
max time network
142s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
27-11-2024 22:07
General
-
Target
f6f1ca882c7c57b0febdaed7d6550d6a7728c509f777f13eda865622d4a92e3a.apk
-
Size
4.7MB
-
MD5
27ae9eeffd6527ac8f9d10510782ba06
-
SHA1
2dc2ab260e65239632c5008818b83018f48bb80e
-
SHA256
f6f1ca882c7c57b0febdaed7d6550d6a7728c509f777f13eda865622d4a92e3a
-
SHA512
039cf5b515382fd577a1b9ffa9517d15d42e362f7e211feba82df7c7238b821f32a13e562586be20a77dd272a529fcb829d7eefe2162d0da1c580bcac9938da1
-
SSDEEP
98304:kI0aSZYGFxQ9KTG/FfyChfgZ95AIbfCKjVtDcKF7eG7lCOBB:kOcY0+trfgX2IO6VtQHHOBB
Malware Config
Extracted
octo
https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/
https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/
https://pigav233.com/ZTZkODUzMTBjYTA3/
https://tavaekemk42com/ZTZkODUzMTBjYTA3/
https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/
Extracted
octo
https://pildirpirpir34.com/ZTZkODUzMTBjYTA3/
https://pidlirmidlir23.com/ZTZkODUzMTBjYTA3/
https://pigav233.com/ZTZkODUzMTBjYTA3/
https://tavaekemk42com/ZTZkODUzMTBjYTA3/
https://pifvafaf42e42.site/ZTZkODUzMTBjYTA3/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.directwaryga1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
3KB
MD5896c2dbd74c4447931e7ee098459bf69
SHA17ec50d30e8f342a76415c5e968d940d05790147f
SHA2565a450300d95c39c275fec1fbf0ef684f59333ae46d89b970c06bd9bffe87fed0
SHA51203a5e7a14dc818fd40595be14696c0cc48eff2d10971eaf4c9c11bfd485fa14d2636672d6b630d020059ee3f59937429b379696280281a61abea1d5957987fa4
-
Filesize
1KB
MD57e01d9f4cbd6dc511dec9b2181129228
SHA14980455e97aa0f439ae41f610b5b2ad98176f684
SHA2561a83b53476d58743a52c61e2714e3fb44a3ce152eee6019bee9365639fa86ba3
SHA5129010731138da927f0767532825ead8fa515489b2fc5ca975a6aa78030630099e186f7e9f1c2e1ebb61147f59e5ea929541e9f27b6e880f5ebe7b91dae2920093
-
Filesize
1KB
MD5d6169be3971021ec7c891b655471c6fb
SHA12bd43567945b9823ef4dd6776cdce1f9975d13ce
SHA25616d6d17e3777eaf62d294126f7d0b0e7b15861fb80fa13aa8bd3f60ff23a4a32
SHA512842eaa3c65205c97524ed38da1e7041f911adfb85e0b5103cce0364b1fc1ce7f8d80a64fd1d69f57f0a97194708ba6736ae6c76468fd3a1e674324ec02e960d2
-
Filesize
1.4MB
MD554c7f73d84575b50df1d1480d636e014
SHA12046461311694049109428c56dcacf82e9f16de9
SHA25629196ed92fabe48356071dcf38cd7c7259ed9ec59ea36bfe162ef351d93bdc25
SHA512754028014c09a87e33ff4eae5fa45ebd3b86ce930806cacdb516091eef78bc8a46947ca879e778e513f4cb95da0d31381c4b76cd5a1e56e6b0bb656d52ed1b9a
-
Filesize
409B
MD5e1d7d2d58924fc480e6e9235cbbf6b6c
SHA1aa87631da1583656f605981afdad7c76927cf56f
SHA2562c2961ca3d94157e13f672e85ab989a78359be1847676e567369b6414703dcb2
SHA51225bcf526748a90ccb7c4229dc605936c6a54ab69cd88e9a41b82edaa9e1c51a69b5345e4652b3f0bc3c9391a9ccf57f1cca9b77afbcf410c032cd77ac274977d
-
Filesize
62B
MD57ea77698401f042c22efa24b69a9c8b7
SHA113b056ad3b118e1897ff5474a35d45f4ccc6de5e
SHA2566d676580065e73c350d9065f16a03118fd6a372845e325b47cd4914ff731f910
SHA51268f2c3c46d682b0d20687292c8c4963a80ec34b87904fe85a1f1e55aabb3aac660f0b1066898680f918a505f0fff9086f8f574ae1abbc11c000870bfe3b8550c
-
Filesize
504B
MD524f06fe7d1bc1174f44103f3d8836973
SHA1ab8dec3876ad3f305864b3570bc8dffb5d07feb5
SHA25614aa6cec900d075e9488d421692488c2b3c1a082635b001aebfb9e177e7b4a16
SHA51212d57aa1bd30f8dc473cec3914535e8547f36ecf2eb3228d37b9eae0b5d184dcf934e29e57dd6633856d4d339cfe62e6db1a66e54ed5f66bacda30172a18db8d
-
Filesize
221B
MD5bc5fc076c8d282eb6cd0af5ef26a53b7
SHA1117ea72ee636750b48923f8884e27e88cdb6a090
SHA256be28c6b46ff212b2d59be0fddd45487b0e5690e5f09fd12f687cac65e7477c7f
SHA5125f86ff62f2ba0c24189bb4500df4c979884c541da6f7ec6d3117fed79c6b8c03237567390d7c02d3a3e99469317145f01dc5a126633a24aa112a137b244296e2
-
Filesize
52B
MD5de2c4c95c818afcba00f8ddc5804e794
SHA1cefddac3b836c1503279070f18156d9d136aa185
SHA256e1c93df88ee49a432c3df9f7fc06196f1d778775231a1bfe364c905c47031fa8
SHA5127ec2e3c6c264f950b70a78a5e99dbf2028554f34ea42b4652d288ba1612181e9d7dca674ca75844bb198bf300a99622d1c39155d45f78fa3586f8d75d78ce7e1
-
Filesize
70B
MD50a335a0e5b0679a81b7b10eca7045bae
SHA1dadbaba2f47787bcadb303c084cf6e04caecf04e
SHA256a36d6fb751a32b378eeddb9dc6f38dd57c73950c21800ce2ca68989b1f86dbe1
SHA512917cd0f1a873a254532bf284b36ed41180dd12d9178713a68ab3f3d04e65669caabb5c7a32c00bc46252b8830982f544838c21b30a867507a6e9d7aca5905f82