Analysis
-
max time kernel
149s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
15-12-2024 22:04
General
-
Target
ecfe4e59b6ee9a1c10517b8cf3d202f4ddbfaae3fb47042de2af7c6209b5fa43.apk
-
Size
2.7MB
-
MD5
581495e90db6cd3227f37346b79da6e9
-
SHA1
ee414b5d437d525dd655ec0f4348f46dcac477bc
-
SHA256
ecfe4e59b6ee9a1c10517b8cf3d202f4ddbfaae3fb47042de2af7c6209b5fa43
-
SHA512
6bda54561ea2df6233466432d015c161da1a4f1d6e568f7c0d5a53311909c364bee4cb386bea8d1c087cc51953376913c897b02228caecf9560a3cd3bd8e6d36
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQE:InFjEI4iZaUzYH99yId
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5eec07cdb66bd6023d072ae4aa240651a
SHA16f969134fdc78546acd8162616599b424667af68
SHA256367b997ccb6092c6f9dd897602386bd5556546c3f9fa0d79f7203a9f6924d0c2
SHA5128fd93ebc46ef15391122f0ba7a92b6fbf8a84cb9f7e8795451795d52a3311bc86a8b145ef2e94164f42b9252859b40bd6eaf81906b5e8f056e3ccc616049e9ce
-
Filesize
66B
MD5bcc115f5b537ca0284e9d7257054cc1e
SHA1a56245f17740a81af70a3b9a8dcb01f76a9de83f
SHA256e4542a42502e7fc5655f42d37deacb9babd8a8402d1e9089b3d2bbc5b9c34004
SHA5123b7f476baa86e73a406759c7e04cbe298893bd7223fe31de11b36acf75f1234b3364ba4f363a20ac13c08a8f62e648e5a1195b5dfed6434660bb292d530da9f9
-
Filesize
84B
MD54ae711db6e2f1b1fd643d33faadceaed
SHA1865d9c948893c5d9776129c75f1ab780ecec5a5d
SHA256ac014555fb160a8150dc7c50ee4ed54979e5e16e1379cd45162f560847f3edf8
SHA5127bc2dbabc12fc6b374cac7993fa127a3c6e7584aecb582e234bd84b296ea1db3b5ccb195a8c189da040e2fed43212bf07f2b32d23d65a5ff4b9316a3a2f0bdf1
-
Filesize
63B
MD59a2a8fbba9e362a257c476548016ad8d
SHA117cbc6ddcc0d71c821938ea7d238f663f6691dbe
SHA25607d31a827b10bf9c2c4724df26494c69caaa87e348b35811df29e8332e7ccd93
SHA5122ee68af979f9b9a783e1f546031c04122fdf856322ab17956839cb650d71d64567013e3894604093198178f9e86506bd10c7d34279b3c4b71968c44437ebd36c
-
Filesize
58B
MD5c11d9da9206e730d15c9d323a0850a76
SHA10b1b7645dd611b91900b808f43df1ea28d1e1a38
SHA256a5b5324a656cb95715a4bad4e75d445a3a002334c32a47374bc109a8dc63ff41
SHA5128da8afac848467c92b7938032bc02c0a0e7e0f295a9a9eb07fdc19c89b481a7283da6768935eb3c7a41b9b980c05bad787a67fdeda2c2dc81e27386aba69277f
-
Filesize
230B
MD5f366cd9cd5a7eb0b092f3e3dddde2b5b
SHA1f64baedb0b826fbc80cf914fe3f26cce5fcc1c99
SHA2568e4271f780e5953fa9931923399eb928f6770d9b0b52a2f5d179adcb91f07e98
SHA512c171492f12551bc40084bc8c25b978b1e2aed26c8b12c8905e09a4f53b4e1f32a1c97cdd0784d7645b634e0a4a3ab13b6a9286b13dd9b7bb5d9fc87bcff67535
-
Filesize
63B
MD53649b97c009f254400928e657a85e9da
SHA1f3e03e9d0aaba6a027bb9e0eb4138705b05633a7
SHA256d7e4e39ec9af7c1b9910c15fc1aced4538b08572193fd5f762f3835e51d1bc83
SHA512f9017c5202825d84a525728d8bc3bb0cad72c196a7e7a6695a881c1232563a13f8120abada46e8c0b6732f8048952b59638f7b26bb65dd4e7dbf464782feebcb
-
Filesize
68B
MD5984a00a67ab59a0eef703fc618f5bb6c
SHA13c2398208a4c8a8abe28268cc71e27491bfd5589
SHA256e722edd9e4ed4cabdeec061448146fbbdeaf67a6950b2a136a940e59e433ace9
SHA5122077f3650c80e853d8c4091b3409998e1eeb5c1716ed4162b25f005a9aa82f62bf40e513fa1b92c9a9918c6ae3ab7b840df03eea63676d38a2d4f84f3e58257b
-
Filesize
45B
MD56f534acdb552f8bbd1a9a8c3a715bc79
SHA13bdcf776ba19306e1d839a6667394e4416cf83cf
SHA2564eac01096306fa26fbb22b69a1645b9f66e1eab527071db23aaea0e1efa90f1e
SHA512308bb0f28a117caec802589697ff944dacbd997dbf925e735ff6f176bac1e8243776fbf4f8051b826c20c3598db25fec0f6931ef4eb342b6d8e5b00fc3dbb0ab
-
Filesize
466B
MD5825ef6dd7ebc0c6819815a9e5569470c
SHA1c667b035626e24beb743495c92b012bdb1b8c88d
SHA25653ae86107c23fee0dcc95f8440282c73a4266e4cba926a67a576e4b5b8f08c4f
SHA512950ee61930c2dcd7e17139503bf828d1107545969ae8d151938691941e4f501f9d60bc1ad14781896f76a1c44d1c7bfadb2774b53418fe35ec3ff51f7c8a923f
-
Filesize
63B
MD59323effe31ddb268d26c637f3567932c
SHA18dee57f2e8f52df639ad171043ce97e71180acd7
SHA256731000a761b0d84eaaa6e59fd92aa54eaf472d001cd72de3abb3d4287caa7b09
SHA5129eca3fda06b0b8cfc2a7baa51b1c5c0a370177fb726ec166bef17a48f5a77ac188784737cbcf42e49062c2bff5db12a62125b51fd58ed25217c83b6c1afc333b
-
Filesize
58B
MD51d37f062615716e12d41530dcf5dc8fd
SHA13906fe7acd615ded7e25d773edff55a397e7671e
SHA256590cf7f16888c3a4988f323598722ebbc25a9195b2f8db0eb24e8cde3e0bdd53
SHA512808138bace9d69826bb1e78330179379d6688e868b3cef839274b9250a3e5c9eff7114c9de408c438636a02e66e3a7c8a46fbb91c952438a45c6f802cfc7d520
-
Filesize
63B
MD584c3bacc3c3371a48a1068c3c04b6f17
SHA1b75d9578b7ba6dcfe3d2a2ae6779e8c7b5aca887
SHA256d89c82a2fae4541f7d137bea0c05e42e3165a1509af5040f3425cf5986b88bb4
SHA512668636d76928db9ab1d9c5d135892174b1dab4e0a0ee7a061458faee9a7be41e4525279d17e2ceee8c49f19fa24b0760d23912e2056f709d8a37cc25bb5c00ff