Analysis
-
max time kernel
148s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
29-11-2024 22:05
General
-
Target
3481e88a2ba06873d2bb24124771818f63415d06cfe6f4f78620e89eaea4f4e7.apk
-
Size
2.7MB
-
MD5
2540ba017f40930e948aa27e7718d238
-
SHA1
6f9f6ca9e3f98f2a80b235a9b8af3c1a9006fd0f
-
SHA256
3481e88a2ba06873d2bb24124771818f63415d06cfe6f4f78620e89eaea4f4e7
-
SHA512
aa58524308447f3a12390950407e2092cc279ea8b934343a8f4bdb0dbf4bfd21d5776c7cc9da1b91ebee252271a2dec308a5fc5de8d7506ed295f2a9613e0f64
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ1:e4FjEI4iZaUzYH99yI+
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
79B
MD561bb302aaf9facb62923b42e145cbaac
SHA13e78de48c01b37fe287fa43cc109647e381bb720
SHA2564bf04dca44188ae87c3479608f22571b399f1e4dde1e1b2fb8f27e0c2897ad91
SHA512be1e333da12e352af10ec3193d4b2752445fdf7839b39c22553ae0fbb97c4ac367f1243cb0f852f1428ba715267dfea8065df8d17a0e76a4858f041a5970ffdf
-
Filesize
490B
MD54b2fdafadb71027c06737e6e12860131
SHA1960bd59d0262eccca1e5dfff9c6a563ab8bc1a57
SHA2565cf07502baa67e59142d021a7b1b23fbb0a44b61d5bc6cbf63dab3b2ef0ca6a3
SHA512d6f152d751209a356fa5ff3189cc1a4ee06a5ce8df190d9bb2382e381428a641a64c6cc4b19c13e18c7f0a9df4d596bc9803bd56ebe0f940ee5e7dada7be5216
-
Filesize
68B
MD53120bfb05ac6708094a9f91fe31dfb27
SHA1d382412721cdb18f41b80af5390b76aeff4bfd2a
SHA256d7a52a42a474137771f5998a313e4d336a9832a9e2c475054808c625125a05be
SHA512e7fa7bbaf8eaa996269ac219399f8408bd88490784d4df538834fe62b2947808f85259482a2aa80277f26aaa679f6e13bbaea520d0eacf361c043a5de5e86d2d
-
Filesize
52B
MD58887bdf52b34184571de39cc29cb85c4
SHA1e5d8cb5597062233012b562234c1a2cb7173cccc
SHA25674c80bd48b5211bcd33165e0f0a92d5e689b77f088bd7072e9d6ea643fdfe605
SHA5123df48a74781b7ecd22782267b5e6e5783b2d1159e625528b8c4375a61a8809546e66670f287a4451efe286ef244fa18e45324ed9e4e07a2bce66880ebd1e8a26
-
Filesize
66B
MD506233f305f81d816634c079b7f2105cf
SHA130483794e540f3fa275b4ab271ebec3126957124
SHA256825bbeaa3ec6000954aab2390951e418f5e007dbded8d25e3df809700a6d9146
SHA51257932db4bfc6c4b5dfd73180d814050171ce697b262f5e26da74b041318cf5752cec4d0492b8b9e6422d651331a1d3a6e46c2e77cf20eed81913cdbcaf46578d
-
Filesize
60B
MD5922f104aedb00e017b5d85d33ab22b9d
SHA111904970b7da5891d740dbc5ddb013d3af9a47d9
SHA2566b5346e665f323fdcecf4162785e70a1f5b37af1ca6aef8f24d2d447c3415c21
SHA512a45c292a6cdfb06ec584e9a6cd5f48858c15de0ea56897fec39c87b1db3a780c80fb49a79c98ebcceeb0df4b888668669efe01242e75a2d8077a781e08b92eb0
-
Filesize
84B
MD54d74065beff7d5e2dbeb1a1b23ea6f5d
SHA1571d9547fd89fc2f7693eb8c62a6b40bf470324f
SHA2565df258ec0f0cbbca6c053f71a46de89af0ad5c348ce646ec14929db8156b8bc6
SHA5126a5484621de3e1cd3514f9a83b4d231c6ab86f048c29674c9abc0c4fd27e0d3132b55ae6bf474d815944dcbf6519519ff5f0e40c710756f8236063a1ea79c12a
-
Filesize
68B
MD5d947c9f2b515affb7797847f526da566
SHA1f6bbcb4b922da9910a74110e4ce778a347e3305f
SHA2566b106af79ea04159be44ae38e3669e16e200b5d488b0f410124d1ee3d9fd93f3
SHA512719b4a39c16e89ac770d864cc83281c39835b7cb4846ec365056c86b382937a97bb3b856a797a0108affaf42c2bae055a8a3166ec52a13d339b1c291fb71b51d
-
Filesize
214B
MD5ad1bc9afa482233c14b7bbbcbfecbad3
SHA1a5acaa80a40375afda0e1d81dc31951ae8b5c270
SHA2560eae1e9e072bf4af270268289f0de177d2a71027b9f3aba1fbbe5183f9e95210
SHA512a5e52862a88dd5daa2204a38d9e7b267f2f26e4dba5c8deb1163d817bed400a852d5c88adb7a698b99a8930ddffae63118bd44c6c59b39b5184ba08e754c47b8
-
Filesize
54B
MD56a66896748baa334ccdab835698aa51b
SHA1d754b0e6792ebef52b51772e16d23e74820aae73
SHA2563a217155cb6da2e9fa524d1eb6ae4cf589366236b09c93316914cfd437293b19
SHA512518cd9257abd5dc2ea21d1950912fb1410229c24fc68c9175b922ef69b64fc0ef0f0b08513b5ea951c2f48b2b0f5a7bff254d6116545b4d7277df130a18576e2
-
Filesize
68B
MD5083d9dc408c60926077e66b4e3dd0c11
SHA15e774145ab42f99dbdfbc31b36987a488c69f953
SHA2565348485302a172801022a36746a803916df4a57c85967738f46e9afa29e2aded
SHA5120b1cda89b46114b34a414ba7f2e8326a753dd24ebbae6a3ed11c20b61163dfa5f202893877e5a5044407a37dcc81361ad36146046d0135f6c79249cc25670e8b
-
Filesize
60B
MD5621d29d6708771c59f54608ee6acb1ae
SHA192e0e0acf95039c404361ecc60b4c92f916a29ea
SHA256849e40863b4ec63a02738d9e403c9a68c1bfdc759bbeb00876abb8250ea2a8a8
SHA5124d7776693b8b7ef0fd6ff2dfad61237d73f0546015a568645a63cceb6755338c4c0347a00b73c06a982afdfab4dd4492553a685ce50aa2b1fe2b5f764f10360c
-
Filesize
70B
MD5b29a5d7a87bba7ea6f894489772f5dd8
SHA197b5e158057a010620c6343e32803abcc29ebc96
SHA2561073e5d303d51e085bdeea833e5020dc3befcdcb2c381f050c08ca4eb891b56e
SHA512c09046998aa8086b5736b805c197ef41b16c7a36fcb7b26c204cc54351736335bd1a8a8179451ca74758cb61acbf046f341720d0a908f03eaf926e10407c057d
-
Filesize
55B
MD5edca0aa7a8089a4e4591b134f390333b
SHA1bc43fda130f7a7752ec1ffd98243835e978baaa7
SHA256cdbe03aaf0165306e8eab1c5591af13196b5ba32a0c2ce32c8c625c89b7a3e76
SHA512841c52073918073828d65afec24cdfc8004813213d89dd6319cb787b820392beefb1983640d2c20354e9956aea06084344312aea1fa9ffd6212aaea846fc3b6a
-
Filesize
45B
MD5aaf5d4ee9372b24fe52a1cef77e6edd5
SHA14f612d9360fbb26672b4dd534dacf3aef09ad924
SHA256d2ddb1dafe6294dd2aec3b5cc0761ed022c600ef746dad66c3e52d70b1ffcaf3
SHA512c78427561c09695a832503fe3f7a8c71536a785c4384f5180917d4296ea63fcd8aaf3f2c10216b6b963e6f0ec68553ccd1be9411045d464aff68e93f5917bd2d
-
Filesize
70B
MD5262db975f17c6da4c629b492db009d2b
SHA1ab75f16b274faad1b6dae39082158004cd4db787
SHA256b3bda4eb740c6918338aaa7bed5e696a8a9ed737030282d0b2b8bc311015979f
SHA512d43e2cf00073a061be3e703411f3af9410b2024d4e7c870f06a86063b82a15c59c1e6ba7d2a589bd5f69b9625e380bd3b3ff7528bef8aeb2b468e6f97aefd3a2