Analysis
-
max time kernel
149s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
09-12-2024 22:13
General
-
Target
af34368e4fa5a48c5089c0993a6a5e3de98d336d3280e34abbfef9a104029a59.apk
-
Size
2.7MB
-
MD5
c3377cf6489047a0dd8b891006120766
-
SHA1
09af2ede989d5a75c3c69d2f0be28a252532a679
-
SHA256
af34368e4fa5a48c5089c0993a6a5e3de98d336d3280e34abbfef9a104029a59
-
SHA512
08b649bdc0796c99c7907a6fa37c91128168c87fdec63584a2e04d8d03d4a3389911efe94165d9d7490e0ea0ce9d611a44aefb1165e054df0f87dd264ad8859d
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQH:6oQrwFjEI4iZaUzYH99yII
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
60B
MD58ed46fa986ea0a7808ca26383bc43b64
SHA177684dedd2ba293cb8ea800d80cf59026fac0583
SHA2565479e8c4323b228fe58ebd20d767cc2c5154fbc5c883a2fe3908c0d6ea8f40cf
SHA512e0d5542ac40e12aec8d6b19547ee98b6e3867ca490e7e91438ca89a6900e749c15a4ec4cb01aedf163bd85eb2a49143ea427bd2263294ec24be1718e2c9bab23
-
Filesize
52B
MD535794fb7cc6ff7c9ed05f09ed0d82844
SHA17bfb30d5480cbbe79fb3178f0d421f3b8b957345
SHA2566096a9236621156f7afa7c7d94d2c0eb4bb700065730f5269c51843b16626f3d
SHA5120e21ce76c9cd4aab2f0a76c88a6c7e46f3b98413b0960a02b54047607a9d65b0e8396214e3c7f75ed350ea97cc1e9fee86d40568577204316c6ba9d3b2133c14
-
Filesize
66B
MD514044210657110c0c171f15a032e930f
SHA166ff983f084c2f320600360ea3ad1fc231be77bf
SHA2561f93af842368514012e0666d8c95e6ac574190edaf79adab46389f8961919066
SHA51225d9e8ae67829293c29770681e8916da5e912d95ad8c9430a558327c14beb906da21052e62ded2972509b87ec89cd0aba31d4d98f6068fb16b61ddeb03cdc4b5
-
Filesize
52B
MD5556c02f70744fb13da241aaa94bc0fac
SHA15ccf4c34d1f23147546c8734f36de8ac41925b48
SHA25643c5645fcef14afe5dfd4aebe230d65c629eba4163d9ea310fece538f60f263e
SHA512b6094085c5a5df69ac26737121c3da378c3eb8f98a4ee2e32d10a0af18661801bb61de7c3cc98b2d83e3b1f5e538491d1d2c9bdae2171e0c32b5ef190cb4f19c
-
Filesize
70B
MD509c78b4030641f1d45fa620ab8ccfa4a
SHA1a9af300884c01fa47a01e99ea92a169ebf2dc6c2
SHA256b2994095db874bf630b26fefd1f06ac6b7b25dc6ff7f3470dfc8f2a3c3151f56
SHA5123ac8c404ef5b550435a0d098b0d07a4bc7988f6e10e0e6dc69f317d2196cf8c843d70e9070b5cb91c1cbf10da92b66c18623cd092374f1d123feedc5ef31bb1a
-
Filesize
55B
MD531670ca8b1fe2ac608f5e5538d3ebde4
SHA1068ef7234f8023da9f90a99f3a2cd2524fbf0ad9
SHA256f5fd9d4ef5773e3d1217845684d33d470430dda2866dc8af22b3a2fb5245ae28
SHA512fab8136747ae2575474296cc6559b91143aa401e40de14ca2bd67decc180b07989dca7748af9086013a744edac6388fd14e7ad6de5496dc14e2f38a641d1feb8
-
Filesize
45B
MD50f3aeeae1a06c1d3115b8810c12b326b
SHA1ba81dcd76fccd6e082438e9d8f2b6499a20ea38b
SHA256fb8e2e0b104db603f42865a1a81c4c6fa81e1d36f85644b68eb92933cd68d9c3
SHA51203d021f8dbe3a304b324573d7c27a55904cdac4b42afb5022bbf15828be34744dccee1100d6cbb1bec1f50148761c69699bf8af99e36a632866ecc2f710aea7d
-
Filesize
70B
MD5c3e43f235295b551add4011b797d62f5
SHA1c2ce481a2c10f3d91d8688f87d795f5a8d6277ed
SHA256188b6134d0cb6e189b5e3d9f48b8ff6c94a2177f27b65b815b15af1818020997
SHA51251b5332cc6e6ec026e183879825e74f6c8e61b2b25047efeaa2cb4e80da74300f32023401de0f35431461c04595e70d1d0f30ec6257f6775e5bd87e4ebc348e9
-
Filesize
490B
MD5944d0c3d69db85f1980a275614c6c178
SHA1a59bcef4d18e23a1fd9a7b9ea53aedb5ec15078c
SHA25692152dd03e01fc8baa193c06841603c933c0a6cc277ad3718462c2dc96dbb23f
SHA5125cbca6658a455d9be486df5ad022426cfcccc3fcef333b0b0bbe1c3f21c235c3a41a4e34272006973738f6130860042b4327d07f82e05a33d66cf20ed0bc033f
-
Filesize
214B
MD588a6f524e74d35ad5a00b0b9b9dccaaf
SHA1b586e8897e56953b8045c278656d5bf0490f4f91
SHA256ed67d072013ce0730d68182da8eaced8b14856e62d0534952dd01596e8760b61
SHA512b27a4864593729470e55fb53c58950d634a5d09865a05f53f50aa162588647f098e04778fd6e6c6453dc417ac3614d34660da7f7564f851da2615332b0383b19
-
Filesize
60B
MD597f0d76e835d738a0e2b66609a4b9872
SHA12b3dbce07d679288800e919334aeb20e6578f8f6
SHA256a89bb4604ad935f88be7461bca49cf1b0ad945c28c130cb13c41c8513a9ffe58
SHA5120cb7e4ce20d675b7ffd40eb28287b78f8283a14d5f8511e8b415e699cf88bf4a24a06900bb142e9c00fd2de29fa10b0be150789389e472b381ad6d74d8b5122a
-
Filesize
70B
MD559fbd30965dff96ab9b67b9e7404fff4
SHA19bcfe02918b02d545b20023653ea645b721f4ce4
SHA256ae1564b2a158fca5efa24370b36f46c3ec9bbf22728b53c3d8428c953cbbe65e
SHA5123bd2087ba08a697887700b25e4756d43520566aee940ea82408c822f91e57fc86a4af173dd3de29165c9adef67fb212a5f4589a4258b02ba6846fcd599f9027b
-
Filesize
52B
MD58230225d95f34a8fe7c2f2e2852e6e90
SHA1adeb12a1c02a9713301043cbf1b114a5087e6f93
SHA2566d679ce21c8676c5e5aab07fcd5f3bcfa1aa78b9b365ad890788dd21a3176631
SHA512e7fa5c2a90619344bd3b120b127a57bca57f8b690d32eaabbbf473262b42e5b6c97f8d87887f83014fabea0bf94fe471b5571ef344adf4c7249b16c9362fa571
-
Filesize
70B
MD513bc83f92d85f97827d1ce1362ec0a88
SHA1a946dc361f8ab6ad2ca9f345180cf919b12d63d7
SHA25634e0a85a0815bb88626a37317d5f3033024895db98d051aa76ade2d9185f469d
SHA512b31fe735f85dc6b4eade890fd0ae688bd7c148a4c931339af5a268042e0f47893e8efd602b6d44501b868e599e4594017e0da3905ae885513d99b77c378fa132
-
Filesize
52B
MD51783520ddac96409d24c0c64e2912ef6
SHA1c0752739f07b89e574d62078c87fe0c23fbe1aa6
SHA256b074d1265120b86c89e0ae7ef8088a0a708d89af0546e0f61c8a8ea6d6d2dfd0
SHA5128f2d9c2ff256c9e96faf3069e108373fa1155b7513988cd35090c588170268f96a646d4d5dcf8e13b45e8d2fa255b27cc0fa476f8cc23c9c37da0f531ab12a63
-
Filesize
66B
MD50c4f0fe2b5a5949468ee1037747ace84
SHA1acdbf022cd6d78d1c2578b70259cc9f0e4442cfa
SHA2569ded53eaea3cc6f65be1947e22e22e1933e2c3d761f1d42290c875e5a07d30c5
SHA5120a7ac2967f6d0645aef7ba72d2c4a132a9cf9773400b0e546a3dba8fc5b03b7d8f971382571629dbf83dd2875a21e35556a86de2de85b9f08140be8b9ca9a0bd
-
Filesize
84B
MD5928e50493799788452b03f8aca731304
SHA135ac761732d64261ec4a2b379c11283dcd13ceb4
SHA256f81a1f35e011a36bc373dfeb8752c18bdfed4e6fe2c26b6fdfb1b2dee33ac927
SHA512095fed027a1706b39dc709d1743929c6aa2959abf37fd94b1cebbf61a6073fecae6a19f85ae9b72c50686841d486fb4dfb8f362cf79240e0cdb796fcd5cb8f25
-
Filesize
68B
MD5fb83fdf20cf54cf221ab15aae0b833b5
SHA1094175e6d079f696a1ee38fe9b846b759fd66fb5
SHA25606f11398d3be36165f3ef1d519a653d1a266c5b5db2715079ea7e03138138db9
SHA51285a83e698201a5708ac11d4d955eecbf18c1d19ebb809c3dd8d83f97f4d79925b6967a82ccca228f5ee033847c904c575c2b7254decd0a9b84a20f3d5d58fe6f
-
Filesize
68B
MD51e5dd4c5220d668a11eb73c80ca7b15a
SHA19318b99e2aee25cc7eacf72151a645bbe388b742
SHA2563bbbfba58642938a381da6bc29ac96191ec3346278938957b1ce5ca26ab535e2
SHA5127aa1e1d202ee49aec01a91311d6fc9c5baf6f9ab6e4a01aa43a30afad7680437a50cb52fc198277b29f572c7171e3032fee34fa31b73d6efb3f4c4cfafdcfca7