Analysis
-
max time kernel
148s -
max time network
140s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
12-12-2024 22:07
General
-
Target
189f3f0a276c67bf875df6f614f28a41a40c7ddf42764335ddf655d5e3d656ef.apk
-
Size
2.7MB
-
MD5
d587834f30f1d628d6fbea3e312a61a8
-
SHA1
e368497bf395a9dbd3a00c933006b2f7084642e5
-
SHA256
189f3f0a276c67bf875df6f614f28a41a40c7ddf42764335ddf655d5e3d656ef
-
SHA512
1854bf63bf77fcdac33149ae057994b34ab15f096b5b1544c309dfbad516a9b40990ab35ac34d5cd863bbf14de50adbe928f576f485cd55569fe014771242cb6
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQs:6oQrwFjEI4iZaUzYH99yIr
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5c8439bf57a63c4148e487ca211f43b3f
SHA188e8408b260ba9b63d93584668643359767e0d8f
SHA25672c882dd4f80f14fa3e0715ef140380db1df605cc8fbd78008cfa14696fdc683
SHA51279db459dc049774126407495db1cf3b074637a034aa22f48a0f47bf6c4a62dfcb691ea997f0ab0926b55ee29fec41696bfd03020215c64b0b950f7e492ff11b3
-
Filesize
68B
MD5991029fb6d816fa603a57034e8a02b6d
SHA1ec9d3935f6cb0b841b5685d29906ea61406e878d
SHA256c21c2b41c2c39e6f5c8d2523a894806bf7484b31bc07562945cc1aa7c4cfb5bf
SHA512c72f10bf036c5368944ba98bc0ab5926c466baff095cf77ff333d1f8f48782c1f0ac0cb61d5028e467b7db1ac64dffb5f4115cd914b6585b642e8f9e9294fc61
-
Filesize
70B
MD5b6cc368f006c9a3492c10b43d82f367b
SHA14df84e4ab2b5fbb131133ce1d00951381eba22dd
SHA256d5f9c47b2a8d6f0bc5f0b0662529798bee7916971bb7c03ec8a2f7fd5cfdca3d
SHA512069ccbb66d24ed9504290e04a5e25d9d1324dbaf5742f37c5ee67c618611dabf9c69bb928399d826ccec30435f903b8ec30c3a2087ce54800361df52b1a4cb41
-
Filesize
60B
MD5f5cc771e4154f1d5e079174d1ff0ac7f
SHA11a37cf571cbee07cc9a3ecb2fcfcad3e0daa0c15
SHA256fafa3b05151e862c07e596e7989db315166de0b67d42bdf38da4aefd0f388d6c
SHA5129456c2daece7c7ad759c5c1f31c7f0a0ace76b5f7ad1e6fd9bf4d46fea597676192c31ed521aa17154f9f7da7bfb97b8da7ffdb465d1293ef2107b6498552ab1
-
Filesize
84B
MD5a4158516488d252129447ca1df5bdc39
SHA1a5803d8b39efe9118bea50fd85545465ef2374da
SHA2564430858acf2a915325da617ecf4c89b38465dae198be54ab15de7ccfed6f9aea
SHA5128b952d8d803e248ba527a97cb1fe26344df6756a89d1a1efd18511c76752ec3d2f06911734f77c08dbba72e405fab3d015a7bd1e80aac9d5e1882f0bbbe59718
-
Filesize
214B
MD5b3bcffbbd97de6c6b1594e0c540881d9
SHA1604d97a482687d5dc280a2e99baa2aed6b6f915d
SHA2561d2bf0e787cd4add9590a5265ea2e52a0036576cf1848de85eead1296881fee4
SHA512707f4b559b0b9f3488f71a80a557ea7b3d54b1538abf077fb8df8b0b74a49a79db73530eb88ea49312acd923ba338f3e21a473ed0e3293f92cad18e2b4f7cc42
-
Filesize
54B
MD5d73228ccccdddd0e6a459694b0da2a54
SHA1290dafd9131b9daac3ea0a1fde94773b74af50d5
SHA256544d5b6ccaf2d2a0fc9c42812a4a99abb5d90c606f0b96584a95fbb3329a8e44
SHA512b6c5365bfd7231b0e5af4fd79fc5c5d5af866ea212493dac67f218f41ba38b3f706376b5bb59650bac0ca16894a701a11432d9b503bf9ccbe2d2b61eef66c558
-
Filesize
68B
MD5caed1c6d39d8a91dfa7e8103e531230e
SHA155888ce36f6bca6c528fe6dbd2125c803eee8c1d
SHA25605b3f1e2d098efdd24679846658545e9479d204d98e209437a561caa0b48c47d
SHA512b939d752281a99903513cbc756dd65276bc7c0c6a038a4c5bc0a5e8f40eee239fb7f1baba66b4e3b67a1a47651af36a2d28c0597646bf0c4ad6075de8752df36
-
Filesize
214B
MD56a71b9248e1009ac7140e66a2e0cac49
SHA126eb8dad316ba18204a2f8c66c2b8272de1c3002
SHA25664c3a777a72e1d895e5ee862be487eaa4e724ad0103b37b8e8c1c079aeb62f8b
SHA5124fdb664698293bfc5db0895515b4db1ee55bfaea8d680e5703534eb837906ef69c170218530f0789aa3bbe80be862faebe508ac66ed867aea89c589964cad412
-
Filesize
52B
MD5ca2ca7105608f3ac557ecb850335d415
SHA1f034b78ad14b3920b59bca3b74f0bd63cc4be758
SHA256bef6961de157e7bbbf798b28c63099aee48c74930e57d6e103cf6f34187a5f02
SHA512f91a91addd5d742cbe2b0b430a7af0564a69993a89f15a58b486054e0b4ce3777b9ff9b60c0dbd815a14071b1dbd8e0240589978ffd5637a72e549b32c0e9251
-
Filesize
70B
MD5a717ee6e36611367e77ab816de0ae91e
SHA1cbf3a6c57aef1e9be4cf8b7aea18ec8bfddd0170
SHA25650a39e469cf86adc4818d113281e99c03409a3b67df4d2aab339070d39e7bc86
SHA51285b81fd391430b9825e71cbe3227cd61c9c8054e2c73bb4c02affca9a8640ae7b1009577cccfd1ced1c7de46106a22fd2a16ce6f160a2d45c72813456ab17ec2
-
Filesize
55B
MD5d0fc780aa89bb4b7f177ecb5e20a06d7
SHA1e945f1addff036b1f69c308069747f9aa1e12322
SHA256e8b6bd6daa5d60c8415cb0354ce84feea6da1f174d0eadb4683489bd7b807cce
SHA512aef47060928e1b7f2014f862dab0ea60939b2c93537bea2b225e21c3909d01fc18d9f6be6fe9645fd8f9d5572ea7296b02896b60a3dcf6153aef08ee8506ffe2
-
Filesize
45B
MD5f42a7c08cd1111c803a2a6ab800da662
SHA100abe771b418eb25ff2dbf1b2a75dacea4043871
SHA2561499ab39b8f86a578bee2ccd49c6296d3bf3b75a1c426ffe7341689f8aec0282
SHA5123a790acb93dabd7d7ea931dd894ea2cc82408d6ca771ad1eddc6d8d396ea144a5ae4286461977ec1f68dd0f900e0aa5adeb6a5bda7119d8bd6078c92b3723315
-
Filesize
70B
MD50a97a5d674032aff60e387c4be0de013
SHA130ceb201a7f4226ff5c3cd5c2c60a18af15cc2f9
SHA2562b5b898a5140117d2a1629302f7916acbe4d4f6b90b0b82aec26beed415d7e5d
SHA51228f5658c42d188f73191199261cb45da42b71efe24255b24b17f542453c679472b517281c26aa87d79d5efd1bc16852308bdc465e81eb93e15c6c29c14bc55a7
-
Filesize
490B
MD5bf0c9bc9f330db685959c30aea3e865a
SHA191d332670da2ee164d80c98d58808fe56021ca91
SHA2564ccb177f1112ac299a42f67e319f44a7669496cb9d9aef7cc746d4897517da12
SHA5122d4f53aeabc2c71bd9ee251355cdaa077e73046948afe3f8e8929213c0d5c8ef8955b7cd77ace7569dea1cbbca52f2541381f2467b521d674fe641a92fa826fb
-
Filesize
70B
MD5e541f1b55406af057d525d942eaeb636
SHA12cc46093e632b5ba32d72c307a6cbf70be00bac2
SHA2564f4e65748584e1f83a2093980fe1e8a675ad418e727e94e4e95551777d353b7b
SHA5124289ea155f57ef34f170614e48bf99d9bac64280b2420bfce874c4f50422057589ef8f0c13806738ffadf83a1a0e9812942f4de5e45c0634082dd9b0e480a4fe