Analysis
-
max time kernel
149s -
max time network
156s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
17-12-2024 22:10
General
-
Target
0bd9464940571ed14603159a26d07033d271e08d9d0c1059b32b1c96df22fc4a.apk
-
Size
2.7MB
-
MD5
a971f554138ec1668dbe2d1bf489f270
-
SHA1
59347568f381f0307820d3cfa7bb0cd5c421a00e
-
SHA256
0bd9464940571ed14603159a26d07033d271e08d9d0c1059b32b1c96df22fc4a
-
SHA512
71d94fba3abf0397692c0c4c15cd805cbad38509b26771c85fa67f23d988cd89552d4aab2e24860ec0a1bc6c2ac8ab2b232bb56da6cd7720ccb1f55228d00603
-
SSDEEP
49152:Qc36Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQP:53FjEI4iZaUzYH99yIM
Malware Config
Extracted
octo
https://94.156.167.73:7117/gate/
https://94.156.167.73:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://94.156.167.73:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD58366a0c265f60ca7238d2850e54874a0
SHA1e2251379d37fea0379137fed59f5448bda40b267
SHA256e0df6a0426d97eb4733bdf327396a22815f02597a348a29052c5bd58150f5380
SHA51231d7db78948a6c4d59ceb645d16d75fef01ce236a007157663d59f140d2660862098af79a9de7a8f81861aec772e2b5d4b23b500ce56a27e1dfbb91042983e2b
-
Filesize
68B
MD56fe42872c0273b5af7e1f5f468bbb035
SHA143fdbedd6e73d07bef4dcceefe55d9100e957afe
SHA256903e35efa65e4c7f467a838018b647368d1cb2f9474f7b84e1674148ae702476
SHA5127629cf507c8c7b1ef466dbc1a2f12a3fef307159b841b2f6c21e38af4e50308c71bc35ef47bbc3d429e3747971b58e8177ca241407fa4b1da4c844053adeb37f
-
Filesize
214B
MD54714a7ddfc7d28d9ed04b9f9b6f61fef
SHA130a693f04f6eeaa7bdb68b180dacff953a659a57
SHA256ebf308f1555f20f928d32457c983f936a392836fc6f4e860cc29f9744332a479
SHA512a8c45153107d637cea21974af52545b3f5f020e76967558b86c7a1229e2fed428b0a70e6ffd47d18f07800d58f5bd0afc5ff803dceda31fd468877c493498ed2
-
Filesize
54B
MD51c935afb0172503c46a22ecc0785960d
SHA18e2e14581ecd592224e2c7a1796447be59f8d709
SHA25611d3c506b74f04dcea677e37829c71ce4a7e58812a420d5d1f89ed249a90d8c7
SHA512a29331c1450c1d1eb8dfac44cfa37739604fb07530fee41f5022460cb194ec2b84d044e8ad03602a77fb0c9d8f1b5082888846f768dc69c93fbcc67f6d5f50d6
-
Filesize
68B
MD565dcc17f157cc31503e3af7f32fef804
SHA1d7cff871071be9d8c69a1403423899ce206f76f4
SHA256fd5422e15315d52e15b6a74dc5a60d831715d4bd4edaa90e546ca1bb8f462264
SHA512456def9550fd87dc19fbe5a9638034188a9ba7d5829efe9be502cf5dbc843e01b2636075254b48473e380d06ec84c11ec8176f0eafe098e1fa357fdd1017a7d4
-
Filesize
60B
MD508db7179c2c87c4b119c48459c27a89b
SHA19ef2a96782b1e32e3ce5173a6cfa0c0d1ee06448
SHA256fc0df85ddf223533675386ff006fbf325fb945b0f699326d4eaab078018f8680
SHA5128d2fec4b1116b0d7d4bb659cec248e591ecdc948a055376559cd1c44a48b6f8582d891af4a9da5f7ab465f81700b1a11beb6711ea37b2fea5f0e0783f7e4d418
-
Filesize
490B
MD51e0aec01e2c34b412ecbcd65dd0ee8c9
SHA12b1ea2dd366b6e92e6c5b0aff158a0173335927a
SHA2569861e57eb3d457261a490e11c48f5703c7e06e8899bb7419461452ae944ce3a1
SHA5123e8123cf681ed5dd1c9a212d61db209f25d0d080a302e958dfe21058ed77c43590df711fc6919d577f9f45535fc0358e536506bed1064ccbe3a1825feb6a03fc
-
Filesize
60B
MD5abb063e736708034677097c33984d176
SHA1576224f17777651127de37630fe43f2c7d8a89b8
SHA25694e902bf8d7d1d71b727ef311c1cde1fe4a3558612cfb8fafacd28e0134fc722
SHA5120f7d1ea90039159d0d1ce80a933eba11ef46a11604d5eae0ac301af1fbf4fd441cd9f39ffd4b0cb42606f02040b03c029999d29c6bef97631f98d4c2839e1853
-
Filesize
52B
MD5c84fe93944b92db8b019c2633432ab06
SHA1cc85ddc4d8235e776f5aab6c00b7e8e08b22fa53
SHA256b81ecf34296506f45f0db4f49b60cc2394c14d37004b5c45371a2e8ddf752ba9
SHA51232aebb2fe5659642258f2787acf5d8582ec9f567336ac2a36e3f5c3d13c761caf605c56554d89063d986c10f8d882ab79846da55f1c5380ec31faf9ab48e89d5
-
Filesize
66B
MD54df42f42ae91e7ac636bd54394a90789
SHA10cc2ccb012632b06d64754fb224ae4fbf89d0bf8
SHA2561e179ed2a712fe71de443c545dd70eaa9cfb09b8cb8a71a2f6d58ee5658ab74a
SHA5121f0699a17a32cf2abb249cf47e61caf85510cd9dbfba9f177cb2d054cc225f1df8aeefa71b8efbd5f7a4562669d52e80b7c3e9e10cbc27fbbe48e499299b8a80