Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
08-12-2024 22:00
General
-
Target
72b714bada87c8afeee9ac825e7548e7164984168d0c70d91b0c563d32039afd.apk
-
Size
2.7MB
-
MD5
bf05bc07e2c9d4b7c84385892fcaaf37
-
SHA1
71e92878d21e053094db1833fc5a0db073187faf
-
SHA256
72b714bada87c8afeee9ac825e7548e7164984168d0c70d91b0c563d32039afd
-
SHA512
f31a624fc1b15d453d20da11c47d9f97de8040851bc9db8d090c08cec735888d958c784651294dae89de8935947eaa45340234847bca23086c40a651f1581a9c
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ0:InFjEI4iZaUzYH99yIF
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5d25e76efaff457ad2bc14bf2273c75cd
SHA19a8a33409910e530a8fc69bbc6a97540c1c8812a
SHA256d474ee91afd5cb690ad687b2add6c6c9c26d7d1a81d41c60ab85c248cd92d632
SHA5128e057dd5c0f5910951b2365aec21a412da1596321bf70be892b42e447145cde7e092b534c42698c0365734f4c324ec60e39030cd0dd3121a917843061bd212de
-
Filesize
79B
MD5e9e63d3257d87ae5ec80429f69497490
SHA1992938141ac99502a8160f201dc2330a987b20fd
SHA25648e6707e79c7a8ccf778b71e77178f3e794166867bf41ae4ed5be9d2e745ef82
SHA5127a4e1740c36b4a1d5e4b55cad2e1152818ddac7f24565b756bac49ed44ccd808d78815f3bc658ecf46122b25b3ea9901560582f507773398fb654106098b8b7d
-
Filesize
490B
MD5f40d154ca7f2629558edacf15e97bea9
SHA1aa822b910250e2e44b2847546af0aad966a8df67
SHA256c3d0abeb32814a334832b2a90dbb0540ca9725b3af0efc2cef5f431880721e9b
SHA512492bed9f1910634fbfdff04ac5aecdbeabfe8c59893545561b91b2c2fa8916f72a90fc6d258ff39134323211f24c185cb9d5cb4e48e0a9b02196af3c82753be0
-
Filesize
52B
MD54a3eef9327df1cd4bf48df040535be51
SHA11c80b0133da1662e41d42394c49046dff5bfea9d
SHA256756d598181d16db851cb477451c7f5cd8bb903bf9f0a18a5cbca8554158adbf0
SHA512ffe908e938387c22cb79b80782fcfa0465f83c343832a46c6c566e12a757b43d38c6ed9e9260512c2e02348523aceda476d3a8b04e122c11c328f70213c0b927
-
Filesize
60B
MD519742ab1aad00149963553fe28635586
SHA136918fe76dc77241de7b8bfdeaf515d34b298d9b
SHA2564d20f0c879f388322e36c4ee4c410f1abb93c686223dd72b3eb2fc8d1a972424
SHA512c4618a1e536a2485ab5ad67cd9f3a2452fecf5d886e92045f300934ae42db4e0dc6bd0b7d678dc1427ac26c23ca96b38f9b32768fe6eef38dc73c2e2abc95d98
-
Filesize
66B
MD5de813970ff3307df814b7717302981de
SHA1c9b83e607477a09c51d561811ba178960bf371d1
SHA2562f5443d99c616f6f2b4ad0c16c9cf437ea4c4b94d93bcaa51476d82d78db25c4
SHA5126fe368d9d5ff7551467a74218efc7a695e45d20113cf1521f0d9b66f7ea48fb4d82b14f81f0ef986269e97aa8621369df9662e14b825d5e71892b18727e16306
-
Filesize
84B
MD5d88608a63e47f95bbb8395c8d5f23801
SHA19f39eef64050fbfb78e6e1289c2cb1feba372549
SHA2569e72d6d60b7ccae65601399f1a9621a7a790579fea3f9d2b7098f2e63e61a2ff
SHA51281fd3de6286bd650d4c1de5a87e00f5e283aed0319207331fdcb8fb996d60051be0ba9a1bcba9a6d6c802db5e4ae0e8e47389fedc03642a224399c3de5b75362
-
Filesize
68B
MD55bd4c732e3b5aaf4007aef24ac4042d5
SHA1093caa6206ff4785244ae25524b2d5e02d4c7933
SHA256bd50a89b8e17a218f4c9a0f6af5a5dac6e3cdcd976c9bf69930e705336155f34
SHA512064dfdbe3976c8414e70ce5b71f9907c7323872a4dbe5e94a417a5e4b27f26747b4f2747d3901859f7399f5a07ae8258d4d66c96e665ac3a5dad809e77d132f5
-
Filesize
68B
MD53c80bf71898d79c23dd7bbe78074540a
SHA1e70b61065bb6f2e2a3dc8a3d3397791c3e1ea017
SHA25633b73122536586fa4d264e0a4ce317de5ce38bc0ff844cc766adaab159ebb220
SHA512568e6a035617bcbb88edb3c5ff03dbed1684ef07fe8d5f0f2e0e4f847ef610ddd42c06c3a0ac32138ad3388436fb28f961c22db41196972c46f39927b9c66b68
-
Filesize
214B
MD51a4f7468dbcb7b39b412feea9a9c4b80
SHA192360189ea098d5476124a8f36e30373acc01436
SHA25689c8ecbc961b82ea4e1b8e849cdebd6c90e7ec70fe500fe59b7766de9097caad
SHA5125aa1ca540a14ac43125d3cee087b60fc8292f06734dd7a02e6a914d065b97e3ad783fb773e30ce6d815b920862ad9df9ae51d82d9569b465cf61a64cb64b8069
-
Filesize
54B
MD5d251f05ebdc714955c5ecc51a4d6dec8
SHA13329ac4a404560b83149b1f30c7d024d7944de6f
SHA256f343e7aaaa43ddcbbf383bf61026f17906e535637f2002b6a275c45728191532
SHA512406d1eb7c034eee1f6e61d3d8cdebe8481de4b9517d5f8ed902085682d2803321a438e968e3d760a72be3823e802508973c01f23ee7c2360f7ebef49c6140775
-
Filesize
68B
MD50743a71b1f8ddf5676986cd8daccfa75
SHA11dd31794ba64c59f589c541d7e4f2d7faca15f58
SHA256915954b326463e27c25ddc7cbdff6a82de765558ced9f29195cfab0b123949c3
SHA512a0ec5d627f0d07dc31d437f86fd8193dcae1c6311e468016a1cd8301dd2d78f77be2ca5fb13712af351d4412b75c4f908781e64eff287f98fdee574a6b97e9d1
-
Filesize
60B
MD504e2c541ab44ceae2367a2795255b0a3
SHA1a961435d25d9f7894794a89c60f6eef1ad42849d
SHA2566a3fb7d49c3bb2767eaaeab1c36c48fc580c73fba1b499e817c3a7aa22791cef
SHA512a23dc902fd1a0aac3cb8a9976d73da5dc599a9694373d1f687265e60ec5583740850ead79aaef2a02974f4d0fc2f267e6f94b267c9416078aa35a31c0218fc37
-
Filesize
70B
MD5d7c1ae750cd56971310b25e18def85de
SHA1c455e5f3c909dca86c250ab701b5d039f0f9ab83
SHA2568059ae141fb658f0fd6176f6b3a3af2e782f203c43c8801515a8ab2e05d59008
SHA5129bc2b091574ced244796bdf95bae3c13f9b622f355b550db1020e8e33965868f5c78dcc0bd35262472aeac816295db3ed901a92f471423866a186955eaac2894
-
Filesize
55B
MD5c5c05a5a1d5bcab1008e9992ef5b49d4
SHA15bcfd7e95c9e8990fa29bf6dd729aa0c5ba18619
SHA2563eaa61246bdeb2a27d580199b39187a00f4c6939b34f7984528222d9d7bbbe81
SHA51218a9e9e4fad66b56e2109032c23569f7b8b951cf468ef6f88266f9ba61c166fc3e9ba25d9bb9f7010561a607c00c95261fdbca41bb01a9afe5f48ead63918e91
-
Filesize
45B
MD5ae9d0f8dddd82d805fb401072c39d439
SHA1249521123a345b383c7f3f53d7b40925be467c30
SHA2561e45b95f68551e43ac55bcace876431d467c54cd9356e572935cd507ad4403bc
SHA512da3000168b35ced566fcfde07b109498f5d4c4a089121832fd0df76299eb3b3963459d83071942a28eb1510634453ce7c8edef051e86f4c52ab98de9539f5591
-
Filesize
70B
MD57395292cfca50bdac1bbe4e7cae15efa
SHA19d2d52397c644a9d1b4682999fcc971d1686113c
SHA2567e57843acd20b0411761e5d367ccb167f15acbe5420d726f823d8da604d1a9c8
SHA512986b3d9827c067d37dcbf92981f34b3614279f50ce607b3bda6d61a407360fab991f46a3936777d1d62965c986a07b9bfea0e87b6e1a5a685304f00653d82e88