Analysis
-
max time kernel
145s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
17-12-2024 22:07
General
-
Target
50194d616578f5fb4829cce92fbc27a2d55eeb8d756125a5b6109f73d4dffcda.apk
-
Size
2.7MB
-
MD5
b35e21ecf90df90f95564920c54248c5
-
SHA1
48a3f2a28fa1953c45248b175d62a9a0529d8821
-
SHA256
50194d616578f5fb4829cce92fbc27a2d55eeb8d756125a5b6109f73d4dffcda
-
SHA512
eab33b84a9eb92d1a38098f30fdb7ee5107ca2dd9dee30227f25b4e6c55b860f7f58462cf46ca82953261f304dfb03abdf03b2baa9b0328899b2b13f807a748b
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQf:InFjEI4iZaUzYH99yI2
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
68B
MD515cf771d14725967ef0f87f2eb7748c2
SHA1d1b4294e607547c103a00474995a75a3bc9af3a5
SHA25695b0eb6211f4d7b5ecaaa7b0870bc2e47b051cac8bd6c7bd8500070b67cd06bc
SHA5122be323d71ddae87a65d4db8c26b73f635b0937d371e7f7320a5ce5a6933a16913f0abfe57d6bc4e61c817308fc045b71718c32105df051e213620c10538298f6
-
Filesize
68B
MD5c146da6beaa0065797fb1d301b04a39a
SHA11db529db0655a129a1e32544241d5afabe200127
SHA2565f6391c72e3146083e63a392d1adce8f8ee8c3328a49263a8a910ceb56294076
SHA5126707e8ea7e05ffc065fcc9cdd8ff3100dc39b63a9cf0665b11c449a1232e900b46e9940bbddd809d4a5e31ec6ba7ec18dcd983ec88cd2f80a985cec04cbc7536
-
Filesize
214B
MD5af0ce0b33aec74eff4fdfeb610b9616d
SHA12413d1475fa6b7e5787b69fadf131efbea69d308
SHA256d894a2ec8966f3aa8b3bd62c6d10b65cf75635589b50d53a49d40c49035f0e8b
SHA512193667959fe63d5a21daabed14c4fdd7e2b994212c2aa04e16d7c338ae53e6ad9694cd2312f6ccffb8951554eb7432e06b1c94c93824b7d6efdbab702edd86f0
-
Filesize
54B
MD54cd46c190d0551c8887278625b837fb5
SHA11ce3025e470e608de1c80b7a55112906ffe40bfb
SHA2566a2413d4be09d7a1f7ea0acef7f7fda3dd9fd6fb410600c72467b0cf7d87dc8d
SHA5125dc1c0bc7f22828b44f1159b527058f4ed87353e5017f0be14f1babe7421e4fab1210a6b1a1ff9d647aa65dd57a69ca2ead594ab5510aba7e335a26746704eab
-
Filesize
68B
MD5f9b8ce26b91b1575f938a48bfb19c444
SHA1718f5036bdcea813814a2a66be1c0d2b4ba74c54
SHA256f0f87a405c2d4486b4501ddca0a247438eef70b7cc9e92837b0332105a3671c1
SHA5129104f0c3e223b1d9de6492c7017f3747cf42e5fd13b43dec9eea01aa9a89f10471a0da8dff9903e85e5629dbcebe09360c7db4898d9c662a4a2d4bba9d564cb8
-
Filesize
60B
MD5184919687389d6eb2f08ce651d4a084b
SHA12b4d4a1ff75278942630151ca893a74f55a71633
SHA256ee8a20c8ffffe22b9a7bd48a1e40bec84887f2ef382fc92bbf65a763b2939556
SHA5128c1d85c1abc0773039b4ecc7b30c385e15f3baa3f21b87bc26843736db08a3d87eb985d0f801fb70f3c46299341992368143a65cdab0cb117f0de302ca635714
-
Filesize
52B
MD5f23b8ce686a29c265f69cdf89c665101
SHA1ce8fd4e3996362e7400fd584ffae109f29d5e5ee
SHA256a0448c11af39590e5b1627c4c76558c9923beb19a6f4eda0ab84a68944baa8c4
SHA512bec2300c09fabf4cf416ac02cd5a2a53cd168418b8ee013c345283a7f61bf9086293a2bf9c7ce5636b7fc0ea9d4b7bd48d95847f8daeeba9cb3e520037074cc1
-
Filesize
70B
MD53021ff7b239c1ffc998d1d89a2efd844
SHA1dea8fef2ea9410fda92fb5a498fb1fd76ae6d19e
SHA2560daf419897bfcbeadf87ba2f89df047e5ee7fb002ff8e781f20efae24f7cc802
SHA5123739d98c28b5b8255df539cb754e5c571a626539dbd58a5515ca1068f8c1b993d6bf50824d0991c6d9565b5461ee8e99c9eddd544f8b3386cf763e1efd6edc35
-
Filesize
55B
MD5abb17bb3ae041ec2675552a28329a18d
SHA112353232a30c4d7571b513c9dd9f9b476fb91ce7
SHA25647d55d2982869fabac0b84f41590be7a502ee6fbc77773890a10959b6f52901c
SHA5127fe93cd9032d506ef97e1336c6b3ee6aa7fa4fc097e85a5190d2e43820cf7c03d632b045d031bbb909582741122585b9415a6e1c37cb6c7c0d32b248de6c94e3
-
Filesize
490B
MD528d2f4ce961936c52fa32cf374f8150c
SHA105568573568d8a078d9f116750f2a1e1ca66441a
SHA256f1873b00621ad1a38486631ec80f659793ec3caecd578403161befc07865a35f
SHA5123b884ac7456ad686d0dbdc63392616144e117237c2306c82af9b2a763bafce72d6a3895b98437fa1b1c868fcf9cb077c349aecfac78b2585bd01ab1e64a653a4