Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
12-12-2024 22:03
General
-
Target
5c600f2accad9a49bfcf78feaf61232c1652f4db906b58a96393fda076779327.apk
-
Size
2.7MB
-
MD5
8368cb4d7f82adb405af66a87d35d709
-
SHA1
b4f405330034f4f16e3608040abf536875f1aef0
-
SHA256
5c600f2accad9a49bfcf78feaf61232c1652f4db906b58a96393fda076779327
-
SHA512
15cd673f8bf800e34658e9680cdaab74bba3742b1da905d56a2b5b251856a6c968daeb539ff4e7a5c3a18d9f0806f6635f7acf99fbf7003e41c3a52f1f012b4e
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQR:6oQrwFjEI4iZaUzYH99yI2
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD558c3f27836dcbd07a7e522f0462e7826
SHA10b1a0174b7a421a0aef1f854b96bb2344ff30985
SHA256fc507c1b4599c8c3153523c7df86d229a305031e4f6579d6d6675a0b1725b3f4
SHA512319b0e75aa2cf29ed415b433380c06d054ea19f7ffed9deab93fa7f9f6004eca0bed9be626f04bad7d3661991eb479a41cddd624fe1a4f09dd22c064764f87fe
-
Filesize
68B
MD53b371d29f86bf82fec718766a18279ab
SHA11b3e5fba028048402eb15a750fe1d52edcb5b5ff
SHA2565d5f6f55c108b49488063b5e49aaa90513512bdf97b1753f310a374e0fe14e1d
SHA51212a6347bfe5a5bbb87c1710434a0bb7e184668154a9ac8cf12996bb330b28dd7fc61a04757beab6e629c1d6d4e1834ae6d775abfa2fe8ca630b2acab8a2cb132
-
Filesize
230B
MD5a556eafc8b6b71b2bc750194a285d784
SHA1f6dcb57b0d65b804f97ac0f9c2c4c0fb201093bd
SHA2563053b531f477e6d64752495e5848d91245c7d438d3ad25e780d3e6235799a724
SHA512854f929caacaf14355b4e2a116653caed13d147294735e51c63aba5ef99c085d048324dc7f7337c7af216a032495779b325a4aaa79b536d13b3c8dab03bcd55e
-
Filesize
54B
MD549ffede7b4e1fef53bcd95781dddc310
SHA1a5fb982ad5451b937c974256a27e12592c40ef4b
SHA25652647ea606c8c67589b36a8349a4efcaebde369f56ed6335f387a32d5405d5f3
SHA5121eddb90866021f5fbb9712d389d2bfae79053541516c92e727598ee9164ffaf087121cfb94f0d4a065a26d84c304bdb04575ace9886face23242ea9a50fa9a90
-
Filesize
63B
MD52c1ba324ceed4292e13cf809812fe050
SHA11bddc76c90428647c08592b5af5d4213497e10ef
SHA256d72b538d622f8b42ae968f25f50d87924ba2c1784addf78e5fc7ec7bfba33f46
SHA512a835e165a3574fcab59c2c49544727760ed1f7328b3544095fa51d94be36be2ef3ae238c0ca209fc7305b094542fe9dfd88132865148b298afe315f0f3bc3d80
-
Filesize
45B
MD5133a014a55bd011a451a5e6b309fc080
SHA1e62f43a787f08cc37dd1cf25f0a4e87265cd0e1f
SHA256a43fe7bac1c2e20a1f75f51c2d32f25bb20efe5dcfe8b9b4f7e395690b765832
SHA5128aaa698e4f0b7c41005c0e0e112100418417d60ec12a88cfcec06f064d3b9e4c0a82a7df9ddac27228b638dd44a116b0a54101ee2a080b7730a980a3f8c694a2
-
Filesize
466B
MD57a747c77444c45add6a5af1b06dc84b2
SHA184e1a87a88f8f8bb1e66ac7e507a0d7ee359378a
SHA2562a8699652c4a6a5f406f31b8cf583a994169207ed343eafc5d499112d9f99d83
SHA51239da218386e71ecc6d6365b82032822396369be08b995a7e84d43176242f58ecb45037d408b913014d3fbf0e589f9697bf7e15728e5ca3453ad4cb8fe1ef18c5
-
Filesize
45B
MD5567b3ad498be8fa5b2f272b0512001cc
SHA1c96fae8c3afc94b6ac790dc1823c892ec2a1d889
SHA256665de7bfa548e48f95296d4c3f5342280bd7e0169b5aaad051d5da329b6fc6db
SHA5128029e8b3eeb08430aa6b9a46fbd1aef44d200e25d192726e4e1aab40462f40d24bd873c60eb5a3cff4ee32634004a66ffdb3b62cc2fe44a17a408f3426468f34
-
Filesize
66B
MD5d85c397204e521272c3d7d2739e5bb78
SHA150b00b070ec6fe760ce4234a6ee9e35834d2592a
SHA256998033b9f034d29cbf9de4191224050884f2629bba40a9ad3cba7ec98ec1a6f1
SHA5124bb1bb1182c8db5b1e19a3f3d79097cb8d41283ea1003e9f1ea1b5dca8a573bc7baf438880ccbd0d7899f0ee8ae16756c006cac6efab23239e0215a363760cab