Analysis
-
max time kernel
148s -
max time network
146s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
09-12-2024 22:06
General
-
Target
6f4053d01d91d0cc29177b6439fedb60a660a707679d2354e74b0888ace02d26.apk
-
Size
2.7MB
-
MD5
04990eb8629e99128d6e84271d659e1b
-
SHA1
82a6e186f10d2cb2845d530e66978b46d1fe5dae
-
SHA256
6f4053d01d91d0cc29177b6439fedb60a660a707679d2354e74b0888ace02d26
-
SHA512
1e3ffaccb47cc462ea95cec16a25393f0a682a60ebfb117596e9189367757a17c6b6808887090ceac88b82405f24c2b49a0cae23c98fbaedf86d67cba51cc021
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQU:6oQrwFjEI4iZaUzYH99yIb
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD58877fed50ab60ee7535d2825eb28ce88
SHA10a8e0119ce59275bbd3cc07366d79b84cad5ad9f
SHA256e5e7dc385967a6246681c6c1611514369b9aa08f673eeded65a2caa3f2482762
SHA512030ff6dd31ea9a896081ba7f2d6b9bafe7f277a4d39628cd7b01195ee86b1ae680d6dcd3f58aa9c958afc087184da1113431eac909efc2381620da45a08ca0bd
-
Filesize
66B
MD59e31cfeacc51a8a6df21e59085736dc9
SHA179a186702fa114eab76942a4bc1485015bd5582a
SHA256bbc444a01f0c129cd490f67513fe49164d694b5b6d4faa6ee3f87b94bb1e90fc
SHA51208b20fcb04993668d89c1d0cb05e68bf985e8fc169432b835048b63d1cce682d1c88802a9ed3ee0c0d1b23eaac2112036d18de2925ef7afc0b1dffb9b2135853
-
Filesize
84B
MD5c8c6929c9549caaece36e88a6d60ab62
SHA1392b5ab509936509bfb045d2bd22f5b300012be6
SHA25665ad5497ad770d66b9c4b55f0a2e5a0e3b30bf5ada3f2b29355b6c9c88480cb7
SHA5129253aa3bde89a1fc398fbc6a2bbebdb19705135457f76fe6382b9c258a204220ddc7728f676cc3d80fd89b2ad8c690c1d40edb0b98990e0ba76f4a7868ff8069
-
Filesize
63B
MD58ff95af945f5f327711986a5c58d814f
SHA1b0114406ba0bc11d66354d09ba7755d3af67e0e7
SHA2563a1e58b8abe2a15982b71d383b7bf8a027942521b02046ed631b14241eed461f
SHA51288ef911f5e1d02aa98b61eeb5bda69845fb8d1d658332380888b740cb9dc688e71e5d24ef6fe1f16737ffdadf246efe4f1c2b4b31ea2c0d7e57408d6f52cf47e
-
Filesize
58B
MD550013af36ba4fc7b9955224b501168b7
SHA16c8da9bb98304404a5b927f55fe489b1bf90dc54
SHA256f4e45bdc6b3849ca443e7ffbe1ffbfcda201fc662c60bf00bc552bd7c37b3494
SHA5127de9262fefbe38daa6146fe07d9c709c4a4c9d4c66755f974b9d2ea5a8902c66956d2c1b1a9c578256d4b97258ff6f634da2ef88bc90bc6904fff4f7a4769160
-
Filesize
63B
MD544ab7d49cdb9385618b50f65587bad08
SHA1990d0601b04321fa4dc060f9238589c95fa5a440
SHA256a439fb7f4f89e888fe40792af43a6a2c372635bf50e164e41ee2fe39736f29d0
SHA512496c1c3b85a32f144dae7ed8e403800f140dec9b6b44d9d00072b1b586fa0d0cf9f6c0a3952a013798ff1d40fa2e3b382a58f9ead0735f82c3a2810cac0faac4
-
Filesize
230B
MD52749f4075d14cd23c720b492fc5396c4
SHA1c82ab59b948c7e9e02a42cbabb8c314796e75eea
SHA2563b5b9dd57c717b4628bae3a407ff1de6c3893c14132999dc86f4c8985467bd7e
SHA51281054e99d091ea9f62371b741b90cc6c28920a526657951eecffe20cd50cf43dfb267bce199d7e9aec1af19528b96a70d1011e5412b9fc2a966d5d2888ab7b4c
-
Filesize
63B
MD55df2cefc33c657ee7ee52a287f67f958
SHA1a10d26bba7b8c1c5cf388d6a0197659c538e576c
SHA2563c685500dcb7b577c702d2ad4e220b24a9ade464320d22c9f09f948e3043159e
SHA5122ba83d97bdcdfe10a27eb7e1c65320b20b009e42feb29ad701e38c5b62f5d57f1c0c262080270785ff30479f63c7a9e787510e2671d84863c6f745b3ff630841
-
Filesize
68B
MD5a38e64944f894f7f46ba5ac2b09072f9
SHA13e79f7fc39ff4f688da05d8a83735d6091f9814e
SHA256ef82d7b3700e7ff1b8e06e00d2becd7a12819fdc180acea81c8cf34d52722873
SHA5122bbd6d139e60773c2a84d738db425883ae9c537a3a9e3448d1f0db93001734ad3768801bb7191457a0447b70a5ea8b837586d017a32fccde613bae33ccb42524
-
Filesize
45B
MD56fc685040d368a0643e13cbb9d8ff433
SHA141843a981c7a8aacc76b09c96676d2b1c1324fbe
SHA2566837f257272e5e42884dd86afd68d8585007d5a8ebca0b3969790836ac42b97f
SHA512499f9a1c64d69e2a4d8caf6b258c886dc27c28e0d0252b9ef0cd956559359496d29d0b5b0def6f1964d4f7ff4920ee882dddb68672445b4fd16f77fafca9000b
-
Filesize
466B
MD5dca7ffc72b5b6b807b0422cd4b018337
SHA10a20beec52f4a0799464ae90bf0d8d8861ea8360
SHA256f7a4e95ef5e75278d41b2318bf9dc0087b41e3ae55bbe3923c201aaf1a0ae3be
SHA512d67768361e2997a56869136844ab172223bfd4bccf0c4e74f236812f7829c8545712accfb63c11075ebdd6984400d5a84d1f67e6fbbb87b535e24a4ca5657284
-
Filesize
63B
MD5f378eb2a49b59ef2c958a86d9cef556e
SHA1721bee66316268f20ba8efc449bace79859d46ca
SHA256a646342c0f5e8ba940cf1265c108db3e05f0d99f353a33981aae72f5ed29fcd9
SHA512a9ee1552e0ecd61f981749d6ff177603404c9eae267c39563c4de7c84d7b98d04426fbaba089fb70ddefbcfc739ebdc142bface6ebd2cd49f618b0e9774651e1
-
Filesize
58B
MD557a35a1242dad9034f07bc1cf1bcf0c6
SHA1baa3e14830864b69534cebfc4872f586de4bc311
SHA256134cb716a33c80342fb7d9849896951d43ae19fd27c6e79670bb26c9b3117f5d
SHA512d766495a961e36c04b19c0d00cdbe2550f14565e21ec04ddfddb291bbe77288a14bdc146a396c53d5ef7f9ce7f96e60a7c4bfac59a4e6b5a95a1d25142f4a869