Analysis
-
max time kernel
148s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
04-12-2024 22:00
General
-
Target
f036864c94ac808c80b21baa1b4b6e23a8d504101da825bd1cf011f8c7405450.apk
-
Size
2.7MB
-
MD5
ed2508cb3a1f25c2af32d68951d4b77e
-
SHA1
cb27612b87ad5240d9348db367323c0ab459e050
-
SHA256
f036864c94ac808c80b21baa1b4b6e23a8d504101da825bd1cf011f8c7405450
-
SHA512
eea43fbf076315aab3e32220bf3250d8f975b38e3dd35ead7f45c1f8ae609d289b7a02bf6a739a555191f4c519d15bf9b2ab4f737874c31300dce4183e649b48
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQl:6oQrwFjEI4iZaUzYH99yIu
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
https://alicetvyineyayinde.xyz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD55d8b2bd6718065e6050ff8eec7e19242
SHA1ab6fd1b6e6ecda8638ce6827a3b82c04e7080f08
SHA2569e23053e516cd16f9783bceb8585d3cff320bfc013c62714f04f699a50bc10f9
SHA512316590092a0370bf004f1b3f660d7bee2c6c8ef46597bfa49d9ba39f8d92138fb90457f7877c1c75c6b6a178a7dd69b95c5039deeedd0fafd8bef080d3128d25
-
Filesize
66B
MD581443e52128ac497214da784e7ea5c2f
SHA19db08e8351a64897eec29d5518b29b404101d42e
SHA256307ec42bd4980cd0504ea3601ffe3cc17119458d38e020a8c57c7669589168b2
SHA51294250ea5be90cc2561a225da6401585727cb8a6835a2b3de3fbe566792a126ee38b7f8c4cae0e250ecbd512a078e151d63395fc70ee9bdc69498ad9775d05c10
-
Filesize
84B
MD56506bbb47db80b238d35f1b91a617e60
SHA1a7bc77148add82e042393790744dcacb78764679
SHA25697b6df03492ef48915835a94966bb09d8a2313f44755dc5471f8d681284f17f6
SHA512fe1c256fdcf74b7eb309aac7b52f1fb2b60ddadff35c097c1bbe91d550c40834a3f95fd83054e88daf9afb6aeebea816d038f717e6962430392c658cce55585b
-
Filesize
63B
MD5a251f1d983854c8a4d64c8510d752f2b
SHA1a0b9d92c8483921ecaecae3f8def037c9b7877ba
SHA2560b50fc5bbfc4a85e4b1f6486333fa5a59e76cf00b0d6063ff33ca5248a5a80df
SHA51269e750f7544987e15bb2cf4909343f9c8955b1ca3f0aa162275192bc524a6219ac560578ac91cca84794812560ea97ca3c4de423382ab38ed0719d08a5dd3e44
-
Filesize
58B
MD50f205995cb9a643b7b448f010259e078
SHA15df6bbea880f067ef3e1022e7aa82096413ec99f
SHA256f992e89bd7f05f979ae9f8236e3bb62e99ebfd77534fdf1e1cd1990f1e4f0912
SHA512b45094478926813fecb3cf99a663d9f4401a74fd617c0bc337efa5dfddd3a96295053c92bfd1fd6526398d9d398413011b40fe6fefeec9945223e1241675e32b
-
Filesize
63B
MD595f8e52afdc491f6a760a6d0dc9062ff
SHA13312ecd34589ffe29796b12f6f1703c3d442d9a9
SHA25613461c424de091497617310794325fa363420f128d9748a84f8b61fee5ad550a
SHA5125a5b1b2b29991d14158174913a1f3aabeebd384dc5556662c8b6116c339249372e126fda6d09f843785da01c4fe876f5fd08dee4c782b9821e2f6968ac06086f
-
Filesize
230B
MD54019ad6ee393b2598a57128609994d8b
SHA1d2ae15950cae024f9923d9d76ccd12c2d2a1b1d4
SHA256baeb1400ca2e7ad1fe263bcac3151c573f76e90601955bee70a145eab8059854
SHA51220a28dde47e8e82c835a252f5d2ff589499bc81f49a84f3a8c760d6187ff0ba03dd584364a8a121c89c9d7bf63af9da48d7b5a6a0349babedc8db3a804b0c1ca
-
Filesize
63B
MD5b4861c67d073cfeee468547153dd55ff
SHA1d047296bca446e4541f126b298a41da560806add
SHA256aac82547873faaec22ef1dd4d63bda5d46a53a5e9bfbe940c61238e46c4fc11d
SHA512079ff03e29cd16fa523494be015d297711c8921c4fa768e55ae0b923060b360e65b3f19af51cbf95fa9a618b8ddfc2de283222ddc15232b1f44c5c2092497e21
-
Filesize
68B
MD5b76baa6a867889d0b6b8e73f1d547996
SHA13e4c3b6bdd11b1c3dbabf8c65ab1b75062dd8b3b
SHA256a31e5639f1e873e7a8b5aad88ffbddd32c7496ef9832c38ee8442862de9bacd6
SHA5128c30ec31823d4fd7347dd180e0af41ecfa91b7266d60e0ea26d87bf9d608a15107a37c9c1f8bea78f00402da9a1020abb9cce29fea3d47339931852eea032821
-
Filesize
45B
MD595bdf00b46d7f8f7dc49e6b03594ee53
SHA1c0521122b390cb6d481cbf4012be34ffbd0dceab
SHA25629fd45d641754fa82c46dbff33f530b6acfd06d1baaf4ba50103c0cfc7307b0d
SHA512524b2babc99b66dec1c2fc508df4a779618c7865120454aad7c3f84c18e827d77db3dc330611c7f4260c2ffa61542427661ab85345534fadc2b378a13d7d493d
-
Filesize
466B
MD5394f1344ea82fee5474841b911fff6a3
SHA151d2933b94c8e631c41eb9acc6ba9ae7ac01ec0e
SHA2564fa5e05614f9abbe2be9d496e1e7212c921aa27e6cade879396732fa29d10306
SHA51286306889cdbb63e5a3d31dc5759d20d9e982b2335a7e3e0ced5991cb7d47058025ecb40cbcc6942f09c3d20db12ed729b6d18d47a18cc7168f9b57d87dac318f
-
Filesize
63B
MD5dde743d74fe64efefda5aed892d0e6e2
SHA1b436a8233c92585598ee87b81ff37e445e806f72
SHA256c7c6b209584f2f5c12c4d7300867dfc595dfd05124277bed218020a08593ce50
SHA512eaa335c0e27604fd0452de19fcb577cd300a2b2eb2b5c939bb2ac1e32292b437a6276e5f9f7f58a43ae8122420eebd0e8eaebfd3fd8257bcf96ac7f5547917bd
-
Filesize
58B
MD5738621ca6389b1179498a8d113f49516
SHA18e18b5b36a2c9863836c49b0f56798072ed391ad
SHA2561f7e657c71c0e858f4ba70436eb97df428fc4930dea71a23eff25d6ebf9c4ccb
SHA5120d024505aed679b21edebd6c8ed38633c6b24cc4829254108eef93a567db4cfa9ea51a5986a91d21b58f9129a0e995c353c4b70763c5aed2869a7791c8455894