Analysis
-
max time kernel
148s -
max time network
141s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
03-12-2024 22:20
General
-
Target
f33faffca09ea4ba743184ab6135ae59c90d3216309073670ce5d57c87d9e02a.apk
-
Size
2.7MB
-
MD5
52574d1b96c0d6d20f5869326ce16315
-
SHA1
2045ed7ad5770590aa102b5ada53974feff4a67a
-
SHA256
f33faffca09ea4ba743184ab6135ae59c90d3216309073670ce5d57c87d9e02a
-
SHA512
771a58e29b800fc0d14b4206437392b84be3f33c5e75e68edd4da4f7501dc4e5e21606db41c9d2cfdbe11f87e948d8d078af6bb30405557212a7c3112724e3d6
-
SSDEEP
49152:eGd6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQW:e4FjEI4iZaUzYH99yI1
Malware Config
Extracted
octo
https://45.88.88.100:7117/gate/
https://45.88.88.100:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.88.88.100:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD57c618eb735e5070d6c4807fd45008ae8
SHA1ad39e7e00d07098319b3afe7f708fb6220808f07
SHA256dbb8ad76dc58ab4d97c0286cd63b553d0f6b670095303ba2169a41b257f91597
SHA512aa537c66389f4f2bcdcefbd35d5ed320b33cd36779a931cfa8d092519196e562939a4a9054c0803dc52aae920a5c773b4a49f96fd714cec8892ae2a2deb34db0
-
Filesize
68B
MD55388b5d1dbac124076d06b1e0079a577
SHA1a6ca70a478b5ac3fe6e70384a2a9731eb7e51484
SHA25659f7c9b4c5e7a5c3b48ddcabb1da111e365824d0f6d49c5cc60c4e06cb5f2192
SHA51229e72ee9d09761f7d01d13c8f1248ae992f3f382b03c9edebdd25a007bad224eeb6c17558008310667b6b7a0ef6750798bf4663e4c6c1449705cd6a84f439673
-
Filesize
70B
MD56bc6eb26c8bd5e5af4924403710b8e71
SHA158c0ebd6282ce43d199a6df0fed917229ff16601
SHA25671638b8ddac71e960f5ddb335608a50fed8c6a39c6e7c80a1d9e8cf558c5390d
SHA5121deef9534d5380f02bcd78c655bfc571e73428469834d5c3c065e59a6dd991a0adc79c5c67627fca87ba2590be07199723f744b83e8e050112e8526c3d6b8909
-
Filesize
52B
MD55ffe104692e62f5f7298726037a88938
SHA1cc802a2a48dd0405ca18919526b742d7db5e7ad7
SHA256c9b84641a184f80b7aab94438bcc78ae4969f7b848acce892be644626ee4213a
SHA512bc7c7b10493bc065f2a5117657e4b4db162c4b815d65941ac70aeb32cccbabf5562407bfc79bac6860155f874ea5d20f5989d3699cfebc8f9b10725b18e49d14
-
Filesize
214B
MD5707b567a637576d7e9f9521b76d3da37
SHA1302601793f852ce5577709a7432fecc8f13a7f61
SHA256d406aa54b1c697c8789aa26a9aaab9878f3f8fb81e3276228b1fbc2a05326a50
SHA512a9a07be155a9c160bb5e04a5efb09ff63c01edacfaaf8a9850658c942319140287d994a76d4e90ea556ad46c94c0661aaaf30e55ba8b877448d5d9c47e949135
-
Filesize
214B
MD540d621c8368dd6ded0d4fe6c4a59ad16
SHA14d4a2f3a3d801633dacc633abeff2d53e710594d
SHA256bc65e464670d2355107dd67d4ad4fab4472bb4f87f3a83d77e8ce11ac11042ec
SHA51230f517390a86441f638d60a749358c9eef0c7353c6e5755a1d1512b21c79c8e1e33b60afb8e071081e4b0deafbd1c7b45d60523dd825c2b1b0778b061921f584
-
Filesize
52B
MD52254c0c3787f83670d97108e69c9d3c6
SHA1f08e9bddd23a6d563752c371e0ffdb792ccbfc50
SHA25607a4de89183a5c59c68b765fd84975e800ae570e73a1212157f7a479786b7742
SHA512ddd375addb9fc2b1d25bb091f67eabec6abec4d46f34d30c06cc2e9c2a763e4259e212e0c01c5e66422a6511da1e952f374dda2ed8b9762209a5aa3742a67c4c
-
Filesize
70B
MD548ed9a14193579e4aa614a7e1d4156c3
SHA104b05a3671de686b6f657d59d1abd31df4936730
SHA2564d1a614c5363c4da2849514a89985e0934af834476c320646b3bc0c73b1e1268
SHA512250a051cc903aeb1f4075bc861cd1b2d31cc292b83b6e43318375f2def91566053d7a053f16bf8648b3788aa30b08451f29a902b6057fdcc84c6592de480ca66
-
Filesize
55B
MD52d1a9f373af8025b115e66d2effffc34
SHA167f56a6202b60b57104a793eeda8f5dea32722d7
SHA2563cb60d320ce15c0f8b97461422ece85fffea3d38ba039c217e26fd8df8d8407d
SHA512adb2064b076541d1e7d92d88bd5698d4336fb6bcce2c72b6c04adf3d3f4e64a8cb75e43a650cd8283d42744e38116b69a9169ddab0b4ec579c71313732f2f281
-
Filesize
45B
MD512ad1367b7859287bffd21c9e07d677b
SHA17914283bcdcb2c41c598747880c36c2fb210bf5d
SHA256a2cc773628f57c4dc3c8f6bcad8911f1456068512f29aaa020b0f41791d3e378
SHA5122f111df45d2c3c4ccde3f57fb1f58b64f32ece6f40cd3b9654dc16b7f0537be6a314950d3e7a14c3c105d6f176adb9ff0d0e66ec9095685aa0f2855ef2b4737d
-
Filesize
70B
MD5ffc83574c3a56feb17ee77f1419a8e3b
SHA153d84bd4dd154824e20e2c026811ce94e5e4d299
SHA2560e5efb17a0ad7b7f638c2f35658dd60b8c54b9793c53038b37a4741852ac7b8c
SHA5125de85a316508e1eba4ded0bf3e867b16bfe59596d85ec61209783c5d980ed05a7b75c18af1d82771e5439b95216750132d790f4eed9f87a43630b77a0363be20
-
Filesize
45B
MD533eff9986318b9a954a1ff9a3ed37a4b
SHA17d116dbc9242614e9c007e5abfab38148ef58a9b
SHA25641aac67112df99ee7f3f9c450d43dba2b0944d4aef23a99b00fe2fe12bcf4b50
SHA5126d9cfe134b59e654288167a7fa1cdb59bb90a87c82c182d2ec1072304d24cdefe99e133c3295bbebfe12d430a091f95c11337ac5e3239e105662caa90b273aea
-
Filesize
490B
MD5176f8162ccf91bf05bdf004aadd82b2d
SHA1953bf0f94fa308d83247f62e1361422c431d11cd
SHA256d0bb4535016f5833aa682e8b66a55b9db009bafc22b01cb20e7a4606cc9fb975
SHA512a5eba9d74e998962067a49bf0867711b18673d5213559f7b55934c91f6fe12cb655795f0e1a7013ce4daf5cc3b96b942e46d4899c8c55fd92f778e37f4308d2f