Analysis
-
max time kernel
148s -
max time network
139s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
30-11-2024 22:04
General
-
Target
d3cb79cfb04834a9d65c5ff387e3b3d4e70bb30bbcae3c238a54ad2dd237b1e0.apk
-
Size
2.7MB
-
MD5
d7c9ebdc0290a49b840a206c63707ddc
-
SHA1
6c97eed631ebd51ea1fc9ba4b4e46681927571aa
-
SHA256
d3cb79cfb04834a9d65c5ff387e3b3d4e70bb30bbcae3c238a54ad2dd237b1e0
-
SHA512
5840df229d31f3e65ec14ade967752f6d84dc5d1dcb2992a845c7fb4679b8b1c2d6b2f82ed3307092ef9b15034ce7a073898c9936184357ddc99debe0bf47745
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQv:e4FjEI4iZaUzYH99yI8
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5d9723d69e8c4643558d4ae7a7c378ab4
SHA1678b71b826cd8602ef95e15413d7ab28d1e8e8b7
SHA25695ce49b8c540abadc6ecdbf69053cd9cc1d936f2cf9ccdc9804c9738601e5404
SHA512e5d654bb67b1175330868ce735342911d1aadc433f0ea74d8f3886f37485cc1fcef1f1ebcf3a67091c384e037a1a26053cbd6efdb1a1cb95f3a0a139f1c9f180
-
Filesize
60B
MD56ec1e27a4c1a1a76d70c9bab905920b8
SHA1b11d97390feabe18bfe015114d9eff249f7460c1
SHA256dba58e1a3fc9b836a50ba6754bcb5df28ca375d18a47b3d0bf7377f4bb029995
SHA5124265ed633f5dedaf2632ba8962cc817f15fb5e549846d4b8dcde76adb8547ffdf152ff771ec8ac21df63a7cc0f5e1c2d13c90092cf6a6475412349c3b6cf2bbd
-
Filesize
70B
MD57425e286b513ad612f94c63d2135e518
SHA18a8e9718c39eb93a9fcdfb48c2e1a5cd664a4b00
SHA2569322a5638d532fe1f46d25a24ddfa8b5b61c006592290edd0b569c6ef7e189d8
SHA512c1bfc10d4c8b87ec94b7344bd4aef8e9c41e6fe39f264a979c52daac47f6e11245c64337871bbae68bab1b2ba108b835010a4b95b42deef1e9d49d1d8e20c881
-
Filesize
52B
MD5c2a72312132521b4c419b00d7a35db1d
SHA1765063b37e061dc926019128eb780741b9dd91c5
SHA256c83cd69633d7dbdbd4251bb262d57627bf449867c7f7b2927c166ace7282d8bc
SHA512007ac26dcb8ac8b622e555d958e561e5eb75ef52f4f8373a799e4dc79c85051c87e330bfaecda95bfbd36824b4d1ae67644e3bd5272d92e6bc5082318f720b2b
-
Filesize
214B
MD5194a22a4bc1406913e13a45d996ad9bf
SHA1b6e21959b0b655c087708d966a086ff7be7c5ba2
SHA2563078d5de433520364ae6048d039c83456f428a9d4a3af15f42901c4cb1b6b437
SHA5124316701f647a431d8b0fe6c709d2204f0de87e441f05b9423035ec0a872bb5696b8369959f02cb486516a78dd75113e9ca06cea06472022d893b61ce98fc8827
-
Filesize
214B
MD51b9a49c93b376bd57549da32f44ba69b
SHA18dfcbbbd710a0b0d7f3d1c2b3f85c5a696a26b92
SHA2566593cc7af33888301d62827aecd94d6e5a4f975427174286b89c098fcebe4895
SHA512df0ac591c158bd6a549ad744e22abd1294b19b3cba741d273d96d31f3b0c99430d6af5e7179f5f704bacce0db1befcf22b46937e9c419d3a3cb94f91cc44ad0d
-
Filesize
52B
MD5808c663622a55e1af4f63d69a9bb6aa6
SHA14aeee30296d7de8d65d5b7552835016bf7375cb6
SHA256c2af4c9a45c4b8c8ddd78044624ee9a4a9cc7cde03fdac982573ca52eb8caf09
SHA512f8418e63e8a3cdf4dc551c8ab5b2085fdccef1686269ab451cd5b70a836dc421d7f23819140af95229f1e4b179be27bbfbeb2a59894d7323afe8fb4d7d401fb3
-
Filesize
70B
MD5dff78fb9d0003d8e4f3d5dd111dad968
SHA1cc3d906ab658cc5a65daa7200f7dbcb7771e34cf
SHA256da3dce2461235dfb28fa1202b8b654b6579d80f47202e66ed558355369ac40e8
SHA512085ff9b2ff23bc1c1161a9d945fe92cebc4d6be45315e35fe0b17e3fc58549ffc74b8e3e57e59d2cfafd3a663b0115e866b584899827356248cb5516d1af27fd
-
Filesize
45B
MD51fbbba02102d76d82e4ac36b0a560ab6
SHA1b8daa2c7803aaa898ad6de7af14bcb6ae51faabf
SHA256a34783678b2b1c968074eaa84eb0cef2f224adf327b581be99a5b6abaa34985c
SHA512fe00ab829d9a2b2e37ff7c52558aeb5ed6ab5e2bc044e77f0da88214d9689821d9090c13446d263fb502c0c05252b62b41feeabfcebc1b183c655b0dbed28c9c
-
Filesize
70B
MD5e7745be1e45e8bf6a1a361e9e0743ff0
SHA196184951b872cb583c5746470f4f3ff10d82daba
SHA256f382c32b1c507da22565702e2f87021482783314461e8fd4ccb8f4ea29a1c163
SHA512ec9e7b48f80d49dc309e94d148abb3b6d0d1c0e214f2eca8bd80e3e7a82cf8e3f357eb0100aa29fa45f8abc6df7acac754f0cab757dbb5e3c619f2d8ca1d94ca
-
Filesize
45B
MD5710017fc0ca81204dacf56ccc2adb787
SHA1a6b3b8c7737d0a7e1a41a12376ae7883d04b238d
SHA2565778d6b4a7647eb43013eb19601658b6bb542332090b3e45d45d1fc84b4dadb2
SHA51282efe40ed966629071940c73d14d7307633bfeabb2d3a300fd39943b2b1e83f8b243fa4644a50c7815027db253310d6833ff606627d92481b8573d35a47cf12b
-
Filesize
79B
MD596766e0abf9985939e98713f228a7d91
SHA19c5ce51097681687d796597c729259a101ee9ccb
SHA25685541af13955f797bcfabcb10f28f6781001ae2f45edd0d828d00cd8c8aa10c8
SHA5125446c4caf3836030638acae3edda8f7f41488354c3233a17f157c76c96dbc9fa2a627fa0fc90815830f06ff1678ca611f8db356b58368706baf20c9528f688f4
-
Filesize
490B
MD54e9c756a5f080ab4ac1480cb2dcca45a
SHA18514c7655bfa50eafe24beb2e5327e83d2cf6eec
SHA25686bdea6979cd626c0dab68a125fead5e97b1f7f5ddee1846934a41d10afa25ec
SHA512546e04516858323bfba3651cc3e8681a0676a710afb117c8606f5067ac14ebfc99dc9cae92846ee206e8765b9eab1eef6f2a5fc449b99b7fba83d5fcf1d83e1d