Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
14-12-2024 22:06
General
-
Target
280ed3d22a28ef3cf500ccb3e262697b036a9e153dbcacad0994b61854b18b49.apk
-
Size
2.7MB
-
MD5
e5c129f588dfa13f394433d331049c95
-
SHA1
e270f24e5a599927964c5e8273068e2cfafcbe90
-
SHA256
280ed3d22a28ef3cf500ccb3e262697b036a9e153dbcacad0994b61854b18b49
-
SHA512
e123f6204d849be743201d482c6844f2607543d8214066af76bb7f1c33582d2648e56b011e4bb4278f05554ce6621db6f2059c59a975b9ef12f39df051270957
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQV:6oQrwFjEI4iZaUzYH99yIe
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5a19e44ebfd314e97d9edda625bc96dce
SHA1e4d9fe0d3eeaa3648c3e90bfbc52d4d07dbf3933
SHA25640272e2f64e0d5637d581a452176ed980c677ecca45411b2f49898cd74bb221d
SHA512ac5ffc0424844c98a6a8e3eeedc79def0f92eeffe21decddc437a76f48ff6c3311528e936d2eb3495f941613258a808fe2b7417028c7be2cd70abcd4dd57d0c6
-
Filesize
68B
MD53403a49b8ea24b0aa4883f675d0a8198
SHA185c4bc87968c669e657fcbce86199240ac9594e2
SHA2565cac58103cea83ab4fff703111a3e8970292f1fe6cb0375e4bd35aa4e6587b9c
SHA5124b4507572c6fac9b659c842d0da5dec6a30fce51e09e2bf1593ecf317682d4a18eacff0c819835425d292271e7fe0f2908d889e284672b049e7a6531fbd76d07
-
Filesize
214B
MD5c30bb53ab391c4e4ce3af74a98f9ef97
SHA179a53a1911c7a5c0f698e5c4345040dac1a504c0
SHA25623690b9e3cf57131e60f880c1f78d386ae6827c3a98a276ee910326ab64cc691
SHA512fb4afeed8fc8fa7a872661710b2ea3aec8f4bd787a78f5ee6870bdea4576defd3bb214743717ed74b880dc1c29a95d4d0635c4ea86fb394c12191e759d79dd39
-
Filesize
54B
MD5c95fbba4d7d5b9d4b22a685572e00395
SHA1e054c97d1431db8299816813edd149595e499730
SHA25695e64c3a14fe93eb7b737d53b2302c1b46fc072a503ab3d703b1029d9343a5bb
SHA5123a8bdc52cc60b7b221de1c3750fcca5cedd0a812d4d4b1cb4147a3069229ce62727a0a91ae12d704e35ae323dcdf8228c4fab5d8aa2da33b7838a2d6a79f3cd2
-
Filesize
68B
MD5c4e89e9440244a120ec0c1d7420d9998
SHA1c022ec5f1607ecbcbda9e6dd1ec235aba7e04d2c
SHA256e7f6a4e6ff4529d0c83f4de4122123352951a16055fa6916d17cf8704f1d18f1
SHA5124b48d51b079f783239d0ac57acf94b574a012bf590d109a7e6c90ad6ede7f9ff3694b330407de8254e51440d61482dc2c6b25451bc0638094db959558a158846
-
Filesize
60B
MD583734b6d29471cb277f42348170dd79c
SHA189855592041ea6978ae45708e5aef6f05a6eb427
SHA25697b69e4a1aa9e90e0ab96424c774e0399725744a8045f7e171d1912bcfe5ebe8
SHA512c71803ac6f177a7cc1ae0a5631e545a7545a88a5d5dd14003afbb16025a15298e4a2e8e7aedd2a955f3d97d19566e1ba10c68c0b37b9a4d37d63da5519e00ec2
-
Filesize
490B
MD5458b3111aa054b683f2691814c38f271
SHA14350b82cfbba6aa0581f09969e1791d0d722df37
SHA25623f226d81d3b1f5b8873ecf9766f243127243801ee0b266329432b4807a99731
SHA5123089c928f3ddcb7edd78d713f0fac68fbe1a5e94d7e48d8853ca078be842ca60bf8e6314358830c560481df3ea9f6376498620b9e3261839cb8f5c313443fc93
-
Filesize
60B
MD52eef1d4749b11b797f4eaff741864718
SHA1eb71b98a00d81c7b2da28137a3210fc721548d5e
SHA25619ff5629530d2f2041976de32a9c354b98c198fbec6b8518dcf774aad348b692
SHA5127bf5f3988d4184601bc7c63ef064d96e54d5deb5a1d7c1898607883cad4602b246e8eefb89be80937f8238ffc4050b5d112443c2552bf0fbe4f5a19e1beb54e7
-
Filesize
52B
MD56e6ed75fef54fe738d1ce151c76866db
SHA1fe062053e9318573c2036e3bd66954f2fc4f69f2
SHA2560dc668b28e709eae4e9adfc44a9dad3264f8819f9f437bdaaf16edda2e895091
SHA5126d6f2e6fa7adc0eaa71c7bb5131a9aca425886db09a6cb143cc0b4c3f797f72584c07c169606451175a6998b9e30e89072fd25662bb7da40f2cc4a8c4e36b9dd
-
Filesize
66B
MD5b2c6c9f6b9062943371dde4ca456812a
SHA10f6628c8ec3397ea914fed604a48fff30eb89c15
SHA256be6150bf1ffbe4d989a4bbf5e6c08ee899c0b4213098308f62d903820d5e0195
SHA51288ca52407935ceccc855a61d60aedb0f3219abe113c42541730f9d0ab0f2c318df569eaaeae46431f40ccc1219344b0f726148fac8c8fa0ceef3abf37639dd2b