Analysis
-
max time kernel
148s -
max time network
145s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
29-11-2024 22:00
General
-
Target
7c6bb49c4d9de1008b29d1e42cbc4418a4256d381a0071c469dfc5790ec4b25a.apk
-
Size
2.7MB
-
MD5
6b78c5b3c105a8746c22e5eedba30293
-
SHA1
796515deeb15a377260325bd11e642fbd46e5e40
-
SHA256
7c6bb49c4d9de1008b29d1e42cbc4418a4256d381a0071c469dfc5790ec4b25a
-
SHA512
c87d50650b5fe043e49897607d6b8b829b38ede22fc65040272c2230f89b4318cfa89fc7ecd30af345cef9ce4167e9d066379d7a7c9485164005e84bf2cb5da4
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:6oQrwFjEI4iZaUzYH99yIR
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
https://alicetvyineyayinde.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD54eeb0ff99de94e0f061850485773c63a
SHA10c3fdcff139184b9c25aa30099678b90e35e770e
SHA256213a5cada22bb123dea9bb9057f2a9ad0a75f81f81d4d1f8ccd37f8fbaf44ecf
SHA5122bca4764f2c9eedea97ae19a69b7ef064b7b35a06973d7fee7ee9d22b1c7e6895601aec289a28206a666baa8056bf81cda5f13e1b5fedab72da8514adc5ab259
-
Filesize
66B
MD51d51283e193071b769e6f92245ecca57
SHA1afac07cbdfd6a1bb5ea5e05a20242a4aacb1c2cb
SHA256b49ab09cf6edbefb552859da8732823ed717e97ed8e66177b84d23cad98eb4d9
SHA512e584febcc12564529f698981f60f845899e9c8a6eabe4e82adee64002e3a218cef9ea69061b8ffa00e231148d42d429744ac66fd08697dc93df030af270cd01d
-
Filesize
84B
MD5a8f9236fb41333f8645a38f20d74a53b
SHA101f706cb755ab08ef62a4da907213fac7c307a30
SHA256c4403912c5bd1714a631d92899718518b3811f7fe9f910b3c8182087b201031c
SHA512ef7828a58987269e46eabec05e216663ea34a5deba880719ebd4dc3d1c77417eae20ad10d918f6a304794cf8cc41c14b8d4259f6cb7f8aaaf189a6108c7cb2a1
-
Filesize
63B
MD5091b25856f396dd68c794672d01bafdd
SHA1a02696bca70934ea169c72ce3261e103a5e60e04
SHA2562e5a07b7ad254133706ddfc9511c0a09074b6e94bc91aad0248eba3ad5848a23
SHA51210690719e938b3fb6f29b70b83eaaca1ddbbe14650805f6f67e83673bd99b28179b73169ff0aa0ef0095709f0207840561046019efd000e4a5d69d6f84e49587
-
Filesize
58B
MD529298f219b01979a4a3953bbb6f51800
SHA1d881e18d06bb333564d6df9faa07ae13f4ed85ef
SHA2567012a3c50b3397da39a826c96c392084752cc20899437f223507a4b89df92d1c
SHA512d233b0ecdc16baaf92fb1f3aa482ce88d0a30148366f8f5882c90897b2ef2933a634285575e28ef3ddf7b1a9f2d7bb2582f767793654fe6ffbd2bea5c2fbe39b
-
Filesize
63B
MD53f602d6b79dfad5ded38d5d705730752
SHA1acb61eee35f9b587637b0e1e66bc2341fdd44d3f
SHA2562c6812ed6a2c11808ca82812ab626aac1c2250014d87c8c3c9a607ca97b1ff8e
SHA51266e9e37c73ab2c5dea186ab2565ecf2e8253d1fd346ad683755ccb6b1065d5bd01af46f5018075488668a8d7280e8ba78a0f5c9fe7b37257c356996ee30d0bcf
-
Filesize
230B
MD5dd9da8716cbf9a1573ae34f4775edd68
SHA1d1c2ffc8837929508bfbacb1ba53caa8efd8e76f
SHA256d0fe37868da276bb0e94465052d2b9b985c34b47dbf8aabd2ef2b6395373600b
SHA512ef9363ddd571e4dbd88ef98a2f71da5392f6db6b8d9bc5b55ce6f837a61787db2a6c8bdd2aa0eddf258a948ed4441a8637ba7900bcad1052ca7ea9cd3e4c22b4
-
Filesize
45B
MD55496e5bbbefc51d78525a2dd8c9f5be3
SHA1a03d589d901a151e5aadd813a626933d52440a10
SHA256b65b3808ca37bc836772b67b1993633acce778bef326add229478260a16daed8
SHA512a68dacac439567226468903cf3afb2c7ddff55d1072225d87c2e0f6cb550bdca28be6091fa51e29348ea3f77e7cb05d570c258d1502ff6df608a726d1a3c13eb
-
Filesize
63B
MD5440dbdc45896dcc26613b07d87f00f78
SHA110594b9117779f8a0d0b44a78263be6c46612689
SHA256105919533821b0a4868880160d75b13eed3218c38d0d4116aa827806ce57098f
SHA512c8ffba910eb885fd66ed25641bf922c1063f3af78c55a2cf4686d0dfb87a11880c26b53282130139e17b4b6fc74dc3c02d2ab29c81a4a9fbad46b6dcd2ef168e
-
Filesize
45B
MD59fb718b7c24d01d50e98173321ba1039
SHA136f9783d9a5bbf8d115bbcc7905c7417301c2d68
SHA2561055cc5699d4b7506b1a9e81f9288316598f5b69380398652a5eb2d14d06f655
SHA512a68b4c021d45e07f813e0a30306cdf020bdd2533e63b2dae6eeef699481f2ad89cd78c282fc949092ddd940f307227a797bbf8b28cbcdda8bbcd501dc6c4d2bf
-
Filesize
466B
MD5f90c3e07c071011fe66da62ee77f4920
SHA1dea7213174701e107528da15ae9d177ff7a0fec6
SHA2565a2daf3484e76c353d69629693852208cf2fbe1b99b318a35dec0185a1f6b044
SHA5125797adbff3d937a431284de21a3b4d9da18b5361656d9343d8efcfcd064e5a9be6380185a3d0ab18f0166e4cce314c2c2d7978e03a147ff0c915561366d6b8ad
-
Filesize
63B
MD5eeeb300781e468eb11aa5d1b3231b964
SHA14107e8bc07c9011ab0c88add8f6b201cab6bacbf
SHA256174a76960e85501bf7058a41746c00686538b909a8c941f9d7cbc34372868a40
SHA5122e720863e6c12190d3cc1e607d67ae1f41b52d254abf957adceb65b016c12013814b27689e964c381022f10dfc812484db933b38846a8fbed0e9aa4a6d765514
-
Filesize
58B
MD53ab5b24e5b2a2d6ef2c755c8b8812515
SHA120cab079d3443c443c91a898264ab63c372565bb
SHA2560aa0cfef56cb424b9a478cd48e8a9f03ad82b119e82d36c88ca8338b674db76e
SHA51207f7bfd5b0fa41cab63c766656859be2c8a8cd759702925cebcb79e669f525aa34fe99bcef61b84643bd80dd23a4f6d4efaddafced3316dc3a9ad192c2ab882a