Analysis
-
max time kernel
150s -
max time network
139s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
01-12-2024 22:02
General
-
Target
1d79760e48d2bb803b55b1bc21592ed20843dc08dfe98ce00c9d4422bfc95f58.apk
-
Size
2.7MB
-
MD5
c908ae07692e087ccca485f5200a8b57
-
SHA1
ac65de421b8617be68197812504da2a19096c811
-
SHA256
1d79760e48d2bb803b55b1bc21592ed20843dc08dfe98ce00c9d4422bfc95f58
-
SHA512
b64cd0f7296891f6d2796cdcf7f0d99447713c66e3a00e02a1f7c883b1506e167c2586a08e5f2b31e9c56898fc29ed887f4e8700c5163c22f425d9909d6f3585
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQE:6oQrwFjEI4iZaUzYH99yIj
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
https://alicetvyineyayinde.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5d1ce6269c6409ed859ae6e650ff381cb
SHA15506a5a86e6cb3c5810b30d438bc411758a15f35
SHA25680d0c84915020b2608ddc877690ca0d52d8ffec72fecca935b38b3e12abbd08f
SHA512327f9cca4df77232a56d28de4b8b679f1422bc2a6557d6e5c2fa3e831489b1b03b6dd7523dd0de20c476fd1305c6db5af6fb494cb4a10cddf936cd99ec43ced8
-
Filesize
84B
MD5370102cde69945c1786c54bee2c890f2
SHA19654937829995452d588885217d1ec92bb3dbb73
SHA2562fe57c51e4410655ebe48ec23570e2874e6f3f216e9c032086c29e70e30b7755
SHA5121232f952e143ef1c992012037e726bbf8d0ac41e3f41e18a8f7d255a4ebd5479f7b3eae8bd06fc6c0ee49f959ae9188047a17f7b2f14f1f4bd484a7b8147c5e6
-
Filesize
63B
MD596b1135b42bfabaf2b7ebc2b66a79c65
SHA1d498660c209238e89291ac4012981f71428233ed
SHA256b35a3ce6c9504cf3d10ac979de5c19ffaa6545a949bac646f11b5f55787606f4
SHA512bb8733e1624d2cc7a04047fc1151a5c6d11e8c899a449742962d25b9ee98495ee81b07cc85873ae879b625185d91d49cf608cdec9ac5a61c2153b875b25d8506
-
Filesize
58B
MD584fa8839f8df1eec9fe30d9a16379471
SHA1a562d0f8bf4b62dc2f948862edac0b28449524ea
SHA256d0a03e1de233052e50b33fe857e1e07e7ae25fdc0ab5ea83f2c8dd5741519f2d
SHA512fb79994e7daefccba40b3955cbe4dff20b7144ca0e637303bf7cdac9e274059b2bc8e668cf7c124356479a0c45b3802b7a02cba886895461c6f23cacdcf16fc0
-
Filesize
230B
MD54be118aedf72a341734aea169877b792
SHA1cb865eaa486f5024d7396ca7d426e0abc6a2ad6d
SHA2563651089b0bd2ec3e06f42c9a2d70bad36558e369c0ae0562e2b5e3df3715bbde
SHA51207c7c5d3034e6aa21412b636430471069c0f4ba50c25ab651c9bd787e46a4e349227a83e5ee0dbc154ab3ccb9ee2e7dfc43dd8ca909d21eb806cb053a37dee9a
-
Filesize
45B
MD5a5a1e8b0ad6824de90bf870d1eec74d3
SHA16c214062b61bc8da430e7ef528230daba9a6865f
SHA256c508257c01b507b5290473024bc85cf34e48968fabe9efb483beca322715fa1d
SHA5129613a559c503c0897b9f7d2a12ee0d319d497960cc9d2149f6b39d41475e43a192fb20656bf72e63c92f2e6cd4c2fe8943dd5f3d156eabc3d1aadb92528dd1f2
-
Filesize
63B
MD519cdc92b0b8fe8da131b84b2cca9d2b1
SHA1a0dc234c107c30eabea5d5bef6767798332b4dcf
SHA2569d25e887d10121e7827ce298fae0eb3be2681058e39cafab62899fead80c071b
SHA512cfa3695252aa0d040c5a4a35269155197818f8071e405317ae171d22404e50c7747f7e4a3389bd7b86a38d03943ddc12d42d2a7888bbc208d69622b3ce3e2505
-
Filesize
45B
MD5452758f7ed3c92b2f64d2fbb57b464e3
SHA1e8900a5fc269b729390c85ac5a8c7407d9526d2a
SHA256b39c5c03085c157f95e8acce82e3cdc6c19746d31387f492484f64d4ff6c6eb7
SHA51290df718c8d89fb9e122a3e45d80e50673e66134a68a221212be107cbe63b88747d8ed9f2feef5240dacf88ab900375f67dd0d02624fa2b87255a5d4ea28ac8c6
-
Filesize
466B
MD57e5f8082571111c54240c539761f062a
SHA158241c856c108bd51e62be1d32a90f9776d1ae7b
SHA2561483c267fd3fd0f0253d4a1ced1ef8fbb12f11f22d9a60b6755c15b8aacc99b6
SHA51222bc7300e6110c3c8a4db5dd55dac03c000bb97cb8f0540fd7d48a14992e0456c14b3c25bdac628e01c876a8820cf5e8cb86aed50fba2424f73cac9147a716de
-
Filesize
63B
MD577678791f5608e124ebd124e5aba9a92
SHA1e6f3aa18d06a7f966d177ab36f41f2be5d384897
SHA256fcf04552abc5d8dca7232895d2859723aa15a8c557c2090c625ac9783dfe7632
SHA51232eca2061178b7f406eb9ba627965be71bcb51ba732082cdd10a26fc6cf89f01c648e7824f7f0d5b00ef051f900c35dd4b6d61f93d935d7331a4a0006aeb6205
-
Filesize
58B
MD52d378ca89a8a3d1e6df9a3e9d9556974
SHA145f915fec1721f6389992a7c5d84e62622852e1a
SHA256f85b8f4c1675165c7bd9934c4f17e41fd7c48652ca6841dc9ab0d5ca5ed5b46b
SHA5123320856475b08de239b44ea27b178e39055bdf5545f7314280f2041d0472836f6d51d8dc88bff648f6b34effa5b13a013d9ee1827b5b747caa3674a8ab5d699f