Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
14-12-2024 22:01
General
-
Target
3191f425ef1b5ec9f21c9dffe352dd0d053c52e6aeb983a1faf458a4717ca3d3.apk
-
Size
2.7MB
-
MD5
2c35109da80908af5afe44e71bc27ab3
-
SHA1
1f3e26423dbb81f02917c5e8dec67e4e1a5e951e
-
SHA256
3191f425ef1b5ec9f21c9dffe352dd0d053c52e6aeb983a1faf458a4717ca3d3
-
SHA512
5d45ca6373d82ba88bccfb1e8681994478bc2e40da7250866c8c32d4ceb01836b7910f6ef8a3c4abd0389e3e8a5814f488f6fd6f175f6cd6b07f69034c8eac6b
-
SSDEEP
49152:Rkdz6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQSu:RWzFjEI4iZaUzYH99yIG
Malware Config
Extracted
octo
https://87.120.116.233:7117/gate/
https://87.120.116.233:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://87.120.116.233:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5c6e27bea19f3bdc0c40b7f7b75dd1add
SHA1e355c8e1cd9aada05434cc7c675241bb05688211
SHA2563963246b29d37ddb2813019c66ccab49c92700204c724500561ca374e88e8d32
SHA512182b6c3b4ff2ced58f381c745f08ded45fbcd749bb0546362661823aab6fdacfe91b8e48f7981a1fa25754b82298b016e7273ea2772769495dd3dbf2fd49d853
-
Filesize
79B
MD50cba12839c1b22077127f2bb64110c87
SHA10fe9aefcf664fa4063e34fdba9aba871b9c0793f
SHA2562da4d2f383f6a5f28ca3b0447b732e939560cc5b38b7983b826c07bfbc0ecc9c
SHA51284e6754f16b6fc449903df458b1c45f3febd10d290bb98e9e0a62b48691b27fb8e6ad54d5cd1c986b1a8932c84807da0f30d068506b521ab85a8092f7e434aa1
-
Filesize
490B
MD5dbdde77a0d3b3b6a694539a536a1c20b
SHA1103430ffa95276f7885f4f1ae5d19a139239d176
SHA256daec6a04bf85407995dfd447e52ea20a54141d2731f763205ee95d9089e0dd0c
SHA512a31e3f63d416a2da7f6f5a93bad74ae69e40bdc514e1ebd3955fe37dbb744d00e37c5deaed9b228c43f128bb66820796cd8e287d3c59411765952c3e1753a3f1
-
Filesize
70B
MD513b1c34e36487287aa7334805d838ec0
SHA18c11bf46c96d923e3fda61c428d91ba37d8d3132
SHA2568f74fac868bdecf4c836978165a4541508a6b60a53a3e90ad4eeef6e7ea422de
SHA5129d3c06f1279609fd3d44dde7f49186c53aa7a5c00c0d214e9ebd0402b59821f535d9a4b817c4cd7a20c4d47301a06dfb833fb221dd84930195b41803d097d4da
-
Filesize
68B
MD55cd82fc0b04519a50d52760b36e8e2ce
SHA10670adf95db5b702d2528a90631edc027326fb48
SHA2564cdfa8186b92a6e368b51918a3eac45a1483b038683083f8b8a6020c5863ed9d
SHA512a09ead68d86b2e5ded4a546ce5a2deb646580e2298c1feaae3f42fe640fa81b21d5dcbe9838b23f6a0ae6483f699339adda3a8a78cec5e03ba8872f83aca158a
-
Filesize
60B
MD54eca03032af28c8b065bec9a762ccfe0
SHA1e6521f8b65d12217df26101bc29a700489a6d2c9
SHA2565a552a917a61c9fbe6a26734aa69be46146e01ea652652ef99461346b53a437b
SHA512da3ef2ee9477803a5b920b58315d7abae42be8b43a8ae500e260b54cc7e8e26c4c2238f5ca5e3dc7d2fcb3c17cd40ad487ca5e02f8ae5ca221d22e9ff2cf06dc
-
Filesize
52B
MD590af2110c9aa37ab1be95a9cb81d598c
SHA14fd491efc856cc9f90ce742847bc7a58438aef00
SHA256298d307193069f9b80f43e4c68c80ef97c1abbbe27fd8b861d61d6cf4bdc7a18
SHA5120386918026a5ee88929c48ca757fe78c2f9e788d26c2a59fde4a472f264292f8016da16b678670dd086d158014050994143f5b4942841b3a77bd534e192fc0ad
-
Filesize
84B
MD591c7a2cea0cbb532873b17ce30e34fff
SHA16d411d9bd832898b0b0bc9617516027c19287cee
SHA2568d6b771be321d0bd86e2712a60c8442df610119fe4513ae480ae93d613264c25
SHA512d5d53e74d334f7c588b59fcded63337be4029dffd1f874232eb3c5f22f514f4076d2a30d32ff4b902752c92485a07915fecc2194401fb50cbbfcf31aef081147
-
Filesize
54B
MD5ae0b10e814761d1fb7bb97a3c13ddb7e
SHA1220dac9b7746d26be7e4da2028d557485b29739d
SHA256d76ea5ea4283893cf0e1a87f3758f0bdcc23fdbde172ade6f3a6a32c96b2cec9
SHA512d04d7f52dc5b689d5834cd95e798acf081ef8c3a9986f25ed8985e22875712e1e40ff26bb1e81931767777a1d07e30433235aab286713072f3da4f8322e1f04b
-
Filesize
68B
MD587f09b5e79cfbfa4634bcd432f45c36e
SHA1b1c9f6fc8492fc541cb999d2138d5ac470255f75
SHA25688721c68e325137d9b71803aee97953036a14b3c164e36737f460f14131c6bee
SHA5121072320c46cecb4664dae7a79b53b44db206f3de9e34a52543fee5714eecd749cc5da4276f0e3cc2b3da80604d7622fa3379b0d5ec565c46ec8b9f0b62a22cab
-
Filesize
60B
MD5ba5efd77b503d2a2bf3b21cac1553e7c
SHA150c685e030b9ce5ee482d1d2947060b0962e7622
SHA2563cc0dc3ff4b7d12c664de70b2851830a5233a5e12ccbf43f1288d57dd9c0d5bc
SHA512a341b4fbfbdb5cda83ee0d71aa856c203b4635d8f7bf43de5708cb89e63f6481a52fe9c06da7be3d76cfc9775ea26fcda6e5e654a98bb1f5b071601febddf435
-
Filesize
52B
MD54ede6f2ed1db56bb3e7bbda5b4b49c93
SHA19c2972f91870e721f0706917b8be9b1d73f2e2ce
SHA2569f9ae29bae073a3ea2166d8172858e941d900caadf60dc524723f228b3b2b699
SHA5128f1482f8f44fdfa073d57a70275d7a7cfbaba84bdbff2f39fe64d9b96eaa468590ef6cd8da4b7f8d8682a4d9502be0439b8bed603e869c2f5b8279ca1acb354d
-
Filesize
70B
MD55194ef4115ea79c15b3405890f947372
SHA15137096c493fd4fd1c7baf3c3bea4b82734976b8
SHA256b3466043a3baf70fa33ea3710838c62d0926fd208c81ad1999f0a265715d31fc
SHA5125c3c8daa1241b4cb214228975e750ca1e96b00dba76fe2b08584ab903cc177688a85280ae5f4b385f00d48329869eaccb5443c2191f4694abc8aa8d8672e4e85
-
Filesize
55B
MD51e06fd1be158b37fa9599daea1fbf2bc
SHA105aa331feaa9a6226c106d823f81e83d816504fe
SHA256fcdbd173fabc2e3e43cfdf5e7a075412154c94b494ba5187ff3a870e4d71c3a5
SHA512894519e330d58505b29564026a23c62a2ab24082f7f9b950457cec0887554c4fdf873ed89687a480023e0bc46a77ddc7b6b9a5180bfa44d8efa64fd9d4827995
-
Filesize
45B
MD5ad9722a4d8b92bd78b0bda9a9f580f69
SHA1c5b3de8b39b04fc846163fe73352a4254b3ddf61
SHA256eb0ec8463ae61dbeae0210b66a47e261d09f30dc1070463d55cf5728add55c89
SHA51273ddeb0ff8fced576e2c47c7ab60bf02e95275f4c85efcc879b506865f921155d7193b80dce2392ebbd8b76c1c2d248234e22879415a7d113bbdd6345e1e040a
-
Filesize
70B
MD55230084fcc7ba7efaf38d61d8de58674
SHA16fc303214773abc028a17dbb9994621b3f5f67b5
SHA256115b5df7d28f090b800b219faf4d6e918fe73ab7672c521d1a0b1034fb66b11d
SHA512c2ae9f32afd3f9936d7674c4b3dabdb5c99751075ecbec0f5213d153eb43a4e23f1ef34479e60999590eee2d98c913d5795f0ad0224682c8e04cc7d853927239