Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
17-12-2024 22:14
General
-
Target
ab3fbad59a1aa6ed5a93587d9fc42a1cb254d3975eeb7387b005cbaeda7be5a7.apk
-
Size
2.7MB
-
MD5
fe75f3f37a8b2c40319218648a2b7930
-
SHA1
72829f41c1122a418e1b5a7379af8f3a1ca77622
-
SHA256
ab3fbad59a1aa6ed5a93587d9fc42a1cb254d3975eeb7387b005cbaeda7be5a7
-
SHA512
c9c6870e62cc3d684e3ecb48aa385c80214bf0ec5e565f525efd06433d031022c0084748886aaef0cb6015a32c7235ce0baacae6bfd1f4931315df8199f2bd20
-
SSDEEP
49152:Qc36Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:53FjEI4iZaUzYH99yIt
Malware Config
Extracted
octo
https://94.156.167.73:7117/gate/
https://94.156.167.73:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://94.156.167.73:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5e4c9f784f73ef45855d6444ef89779c4
SHA175cbcf92ef9ae17c291fe83200025e90dcf06105
SHA25601356a01b5aebd4b1940c66d40988d07fb99dbb7c304d6def6d2ea068370dd83
SHA512865dd11e011e2d68aed3253ab417a74a725350c17c8425f09f177ca637dca468700678b2031db664713151a41bb70002c9b40b65362c026ca4b7fc1063c94a96
-
Filesize
68B
MD56cd034f612346e6ca84288156ee5d652
SHA1db6a89f99520593b9c6a52b93f68697ab3f2ecde
SHA256f4311ee013ceab53948f342bab05d05389089dbc2d4b903b141ea524a3a203e6
SHA512d0338baf340be51a48b6f2be569f0308f4a4bb2b40743e79114a8a688ce4f36f1a8a53a27b20d593ab31d633e87a9be62973b671ca145c19ab03ec14f9820e79
-
Filesize
230B
MD513b519b4adfd22806ff057f5942a0e68
SHA1eaab8114eaf6805a3ea69d765b99b4f32c6cefe0
SHA256639e7d946857bf5ce86677fef36d7394aa208bf3a23bef8257375c52e39a3010
SHA5122125a624658c86bd515120007739ef9f0a917380cf615532f0cd3e033c52b9b3ff8187fd9774ae8f2519249b88b81539a12a5e282c733ef5823fbf0461ce21ca
-
Filesize
54B
MD59addbeea467ecf241585d7537215ac88
SHA1ab255f8e2845eb37dac60aab0ef8145fc909f02b
SHA2569c802071ccb0d9dd68e937ccefefb13a84dde0afc77c50b7c781325c93dd6a9a
SHA51205d3a8ad13fe62aba6b0cf77a2d081e1ba275b7213b942a384959038188a4ab18aec6394e82e8c81ae2700600721624699eb8d51640c6e543d51ce712ad94323
-
Filesize
63B
MD513a909f23c6e356ab186186085bb27d7
SHA1639ab2810928670b23e757497652b73b62dd8158
SHA256ec0b6b2b683c452bccb4ccd86f0669e949ab09a3f354e774039149ab229366b9
SHA51235b9bd2c97c14e46f1dfc903f93adf0035cfc98fa95276d30cfcf48552fe7e667ec152d58ab116486b1e1018705ba155063b8fedc2419919de991ea130be8823
-
Filesize
45B
MD5fdb42690c167409ce525ba36054843ff
SHA1e4155ccdac988ed27db8d9f63d1ade9678cdd227
SHA2569a415de95eb6ef6f4cbb52b9db787ad1b903fd18c8a2746dea34f4adc68c3da6
SHA512d3860ee575fccdb5a7c8209ace9c62f3097d36f83742fdedfa00b65d50761fe4c1f1d32395c3337c9e5c716e314a8c4644af2f278c7930d1e867c563b210e0ac
-
Filesize
466B
MD514d5da277c4bf6d434e83dafaad1d689
SHA15646d7cbf8eed0c4c296ac10a251e69e8924776b
SHA256cba665f16af22d8deb8d5434ae22099233e40a99e934183372f42263a97bf567
SHA512cb310de8e7f72fc9640b6ecc576d11599fe07a71b9f08321b7860a16f3631feedc99c570fefbf630e558b95ece20910aaa81d66976f4b1a2618e94bd4cb25fe7
-
Filesize
45B
MD59aa7cbda85e44745c1a7f6fa51195a42
SHA172be26c9eb3dbda595c53df31b6392d25720ee65
SHA2566dddadc26d1ee3e519ff161306bf439acebc0be23c13dc52ea310936b559e43f
SHA5124fdbe0486b1242122cfc554882b4771fbc2e923d6708f57d14158059a63b1e106d4da755241b91d12c7972c2b6d04841bf6a3bcf65ecec7c3f525bb68e894657
-
Filesize
66B
MD569a606e6e2227610f76c1fcd5ec92f27
SHA1ab90b78deeb151ebcdb70a05c444e01ff9ab4001
SHA256f9d0e7cb90cf3e02035ee03519cbfe3a7de258e97e1a97db4302d1c62407234e
SHA512d7564fd0193d131dfc038f194e4d490b4043e6fcc0cab65ef70e3595ab0b39f8aa1081640c1f0afe6bcf761e579e1c0f556ecdec95c11d19a89261f404eac3c7