Analysis
-
max time kernel
147s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
14-12-2024 22:00
General
-
Target
cea9b5f6ba247cd03c6ee036068aff48e5dc8848eafd3425ec4db2b9a57b6d8f.apk
-
Size
2.7MB
-
MD5
d89fae5a798680a4ff328c9f288e01de
-
SHA1
64eae1c3ed6d270cf051d3a2d4fc2e03020ef5db
-
SHA256
cea9b5f6ba247cd03c6ee036068aff48e5dc8848eafd3425ec4db2b9a57b6d8f
-
SHA512
e019f35588aa0a19b8efb7ff3af6287cb92300af6cb269be71139676d249840ee33b4a5b7894fc05e41d93bd833ab2746a6127f0df2321fd3df88421550d8543
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQw:InFjEI4iZaUzYH99yIl
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD5e00856dbc1b23c51dc51d21e4bbc62c3
SHA103c72cbbee59002bf09f7c4ec5cdb3b3d7baad8c
SHA25648ba2e588fd885605bdb9d4b40552ff2e3d5782bb3f755cfe3c499ab07d33a9c
SHA5128f48e4847ea991679514c8a14479068c93b86fc6d22c030fb42169fa2bea7ead1fb6f3cc2264b34cc5cfd0401017188f4ba220f0aa77f7b54e030f0562bb699f
-
Filesize
60B
MD56eeb26de6d082a9046bd7eea97439c6e
SHA1e21bf1b998ac3fb33bc91401ae64588cbac98dc4
SHA25605e3563a07c34fafff028316a014a17245e221b412e04b8a0713f85ca1b2760b
SHA5122c0689417edaac81485786bd3869b26da9cf5dcee4cfe354ef7a1ae07957167e8abe670498e65f7358bbdd689e29c8dc2194819b0eb06b65a388dc5dbb65b992
-
Filesize
52B
MD5a16b9b27742637b512b6a98c2f34fca2
SHA163e6974d470a09546e1581f5a487a810902e62ec
SHA2565f0183a3b57c03f9d58be149246e486b1b7941936d729b2cde47b3fc8780bcc7
SHA5129681c40c0bd9c8d67b13dbe0e3517efd65604846622f3af99320dc12abc533b62f19dc04d99da1e25ae1108f42cbd6922d4ed0fa8608257fa942f278f981337f
-
Filesize
70B
MD5a218f3a8f002cbfe70ddcf7d7cc0cfe6
SHA15e1d4bdb478f2970550b3e8e3a2b4da79a585ee3
SHA2567bbf06606e00751d466958b3be9a71e29b8a846377850768c3a63fd734705c8e
SHA51277c72eca2b5879772a1409ed72fcb4bf3850668d20e2c21795e7753aa387f0f1bed153b5ca731da5101d2094b4c70a10e5215ba35bbf4826b65afb2a3892e2c2
-
Filesize
55B
MD59413f2effe89ff385369bea5ed1e5c9d
SHA10099beec87c6ea63443505fdcdff1984553cb7fc
SHA256aa962629163ee96959a1b7b80aad71510a7106a4ba13fa80794d72bb969c0f02
SHA512f9bae14335a32d7123eaab8b1f9fd7309a2742e3989f3fb198ba23527db42ed03cce10fd3b09119051f143bc9e1d6aaf161fdae646ce5ca66d188ebc8bcab52d
-
Filesize
45B
MD5be1b318e18a2e0e7d704981ef30daa9c
SHA1447566d718f97440eeebd226055de3afc0327cbe
SHA25684d8b3c7502b2edd53352f15b23086e54b117d52a59607eb491bae5f99677a35
SHA51238ce5b551ec4359323db3794b2dd760ed831cea711bad5f6e4a91d2de5f56bcd99e3b3f6745e378015e67c4ee25348d58fe4530448db34dce24a2a3a9ffaa110
-
Filesize
70B
MD53604f07688f23bff5d5552a154920860
SHA1c30f64b78ab6f086b8dda78a8045463955f812ac
SHA256343b5ccfb9c3aa28110dacb51f99158df83397a1e5e2457c1570da7e8bfcbde8
SHA512a4214d7636b5a539da60c08f158c94fa6d5083b3ec515b9de1ec7353d9f53d28bb8ae743177d0378bc0197970958a16729e1c3d5ee9207c8cddeae90e7051f7e
-
Filesize
45B
MD5dd133fe1cd22ce62a581f47ffd3479ec
SHA1e16584335feef2d0d8bb08cf49de9b8ac5c6cb3f
SHA256de61ab3f5456f25ea131dad7cacc12e7e08661fe9b7f46227ed02cc8b6ad9a65
SHA5128cdde0ffad02e40d1aadd91f6d8e08f46974c1d969a843b55854fe85d15b326e7e8281d083c692ebd7c56ad11e6b00ea77aa7d26eaa1eb83afac874db650c4c5
-
Filesize
79B
MD56fd5f6978fbd6e640729f908332d82ab
SHA138ae5444e5852d46b20ca70bb7ae90cc9579049c
SHA25608d3acacc8bd4d81b0a951878ccbe52e11bcefef86021c4bd074f62334e0cc96
SHA512f21788e426d2872968e5b2daa5ad3ebf0caa057b954d07dd5f71065afe729dcb8cfd4b1a34c4547adf25a86e3e48dddcc65315e404fbfc76c893f05ed2923214
-
Filesize
490B
MD5b612ac80286f6886c835b5b3bb21f1f1
SHA15df3714a7255b568dd4f5a49749c83331fba578a
SHA256e3a749fe56e244b2fe4b4630396b9d37435513fa739cb6d57667d93113dcc70b
SHA51254e04d52031d1e544e843dc679674c440d65301575f8cfa6626d77ae515f5286c6b33e1acc30d501df4f4b5e21d5aa8e37d1d5693cf3ce8df6c8c991c9e8d4d2
-
Filesize
214B
MD59d82e1999e1e686fda1a8ef7c9e2c428
SHA1df4e39270c0cce661215f026e8fb1664c995e03b
SHA256077a3c056ac56a50e294ac9424e46feb1bbc002ec7f4baab311a05ba2f23c382
SHA51242fe899150762bd03403e2b88bc189e43db7971c2380f24e7bf9aa6e75edb0550e9eea4ec3248fd428065ca077db1b414acc4051b5cacc1dba48b6e0692281b0
-
Filesize
45B
MD528e7041f156375e10417c950df060347
SHA1997247e09b8b3a1b298fe4d4018d65b6db6e89c2
SHA256f45567118186fab9869dd37ec70f97a68821279cf90a196024ff1cefa88b9860
SHA512fcf32984ab74900112e3d2580a33570005f0e4e1d88e6126710aa792801e3fa0f54884c36a492fedcc018ec6aa99952647f4159c236ead09845c119e461e181b
-
Filesize
70B
MD5fee9ac21bbb623e4a1bdfa6f42f939f9
SHA1b743be2903eb464348a49341806aac421098354c
SHA256441a6d834f3e81326e65bc7bc99eaea992fc3094f906ac9b871a3dc1872b9458
SHA5126129e5a8b53d130f779cf3badb298769880cb915e03412fe7958f9f91e8550e451225ab8f14baa94c99d771e15dd8c259ac2e773c25f77259cda3f4f68238c12
-
Filesize
70B
MD5625e4473bf75c51cd6dd020f6500d4af
SHA148b4cfb111bfee689843c8b9da48d931147d6af5
SHA256642e5cb37ddb1c5657dabff24c7b78808ede3e3c8d6833a92002025247a3d6da
SHA51225167486618320314d5d5896c708da86451918caebefa09af527bc959d6cea321539f4c33f2b292c174d884e2fda502b9ff6f47b2c08f8d20ecd80098cfbb292
-
Filesize
54B
MD559a6776aa651f9c59735702324077a45
SHA1742bc29805d7a81815345816510c5fc80c9cab73
SHA2568d73ff465bf274118641b34b3ab00683a06b3b56ae280a326f3b5d92c7ef9ea7
SHA512a8280a622d32c17bd31d97961962ea7f5d597faa9ed3cf63d0dc03a2ee56376f364697ac879a91dba3731436faeb2a51d4663b1529382e1d831d860314a99569
-
Filesize
52B
MD582be28684eb9ee0501096ae68b75f343
SHA1e9fce3f0acebef6c8e6fceae89b42c4e9ca1d170
SHA25617d173870b329be6ffaec7ed9884d161f59c6992be462783c83ea65316722663
SHA51287250a19286ebdc190e49b938335b3eb6291543e8c13f109c6e50aa5090bd73c40be473758a360eb8703ecafa453c3aaf0dcf00277bb3e321c6bc3e8b987d24d
-
Filesize
70B
MD5aa5bdbc4a43ebb696584a2c020887d16
SHA13a97ed56df8e6a15b4ce23a7d9494aeef67db17e
SHA256796ac8d0a1c3f7733650af0b0f3236725a124bf39a147f338064ea108fd95280
SHA512ba6f072ad6b586252df2f018236a602894c0e601601903b324e9dcf929924116536d000eaaaa86a4cbf10a7730b4257832f195fd7a55962596f1cc1d4ec71c3d
-
Filesize
52B
MD5b78629e0154eeb8568f2f254cfc826e4
SHA1c330fb7dc3ff2463b8c8ba3d9f577ea0bd315ed5
SHA25600ccc2f52ddc6e4e2bae6c671e22a93aade46f5d9c9fbac86d053b90eedf41ad
SHA512cb1c8dc4a8a1daae8fbaae8693de2dabf43d32c78d6b2944cc488d990a0c81e10f594654513f711a3c2c5969c4ad54b25798ab33f4832a31f26a62c41440908c
-
Filesize
66B
MD57bade04c3eacce6b54c051fcc3fd7648
SHA1ec8059a1b37a6de2f1f5b45448d88149a4241709
SHA2567c2b70a3b37061f85f0265437a99d8c5049408ee0c3a3281cd1063a35de1188b
SHA51241895894f5039cd5dac3521631d78b8c31652df9000f24fa795ece76c18d3be10d1f652bde792127d4c57fcd287ab7ce997678ea05ff02053132ede2129c1fde
-
Filesize
84B
MD514c5c4e8b327419b1fdabe01dccee0aa
SHA1f36d5785677a277fa807c07f965ec5f423325881
SHA2563a5ac334e8252c483563ac025dbded98fccb2d03cf6c5f80e91ed69b407f9b33
SHA512b8e10784109470c9b493d5bc90889a8712e49322d1a6d26e5c9b8b9eaac53663319abfae81af359ed5fe04d47e27da435d46355fe92f577d397a1b8243b21d6a
-
Filesize
68B
MD5fe9987c3c47ceb199dd00a24cb83e67d
SHA16c6b099d226bb47cd4c39a5a783fbf0268e213ca
SHA2561bf768032b88b087fd9e12910a6c98c13857f49a02bba1f1bfcdfb072480c402
SHA51211bb0742a1c0bb337e5d539e9ba9801f4717ed3efb602e9b82df7bb03df407542e96d9761b73350b437c793efac219a5733bec5263e268c7332e436fa2747ce9