Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
18-12-2024 22:00
General
-
Target
d4dd7c0535edc433e58185655f3649ec6c7066c29e7922793cc963752b85521b.apk
-
Size
2.7MB
-
MD5
a2eab7db08ff1134c0ce936698bbe540
-
SHA1
61f9a1ecbc40c44c502a8b6cc64175677aedde94
-
SHA256
d4dd7c0535edc433e58185655f3649ec6c7066c29e7922793cc963752b85521b
-
SHA512
2e37f0a00ce1ab753f2618d16c9141dea296d3dd4f278cc561072b2387e303b906524767583357cb8e8d3c0e729864ed54016b9b368c8b9143c7cb2596fa8c83
-
SSDEEP
49152:Yflb6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ+:Y5FjEI4iZaUzYH99yI/
Malware Config
Extracted
octo
https://80.76.51.206:7117/gate/
https://80.76.51.206:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://80.76.51.206:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5c0af9523fbafda808ee8bf664fd889bb
SHA12e94f021f5664fc30ffdf7d0344de731af0202a6
SHA256828a09725271ee594410ad0f630696c753e96b7d7ed1ea183a79c225a5ea340f
SHA512e67008917096ee7f5695c410e552409b10245d37a1ced29804314de6c5af15e2e6122e6c558a307f1b94b6d793f1827ff0e2a5eb2f6610a3463073428d90cb82
-
Filesize
68B
MD549d0d73fb2083f075dfc9c95c7974429
SHA1b821aa1e94f05aa46c5462c31868e09cdfedb5c0
SHA25642030f6b82c02b84acb8900d88acad365f20f3287f247d6ab1b95733354fe030
SHA512b9b31866ce16721175c1a4757e52953673540ab21d4f5c042dc5b8c38f7f7729bea0be5025a86f19fbe32e458f5b12254e7fe26f558afedb06cd8d1e15eeafac
-
Filesize
214B
MD5524b53d2c54a3b9ca5893fd34993fb4a
SHA1c40baa944f57e1a69e3bcf2857b834edce2956fd
SHA256866506aeaf5b32473a1ad3d98377b633bd2aa83b8d35b45fc6b03de47dc6a94b
SHA512a4617f00b1c56c69af7d4db2a5ec50549934f5431c57b68f631a4a268cf2c7ddc7437746815e0a08efae5daaae38c4ddde021b0b9aaaaa60664c6d3acb8269b3
-
Filesize
54B
MD57a124ca3d31e42642488110fed8990e8
SHA14e7bf8405ed540a39f68a7804d9f6d911fceca44
SHA256962c785d9758e5c6287521ed41e1f727a552c7879bf0c624b2f7cf9d4f0bbd5e
SHA512db4004301107ac533935325ecb511b78f0fdafab97e61b48cd02ef21d2a641f52bd2ea231f4b99a218a0574ad04fd49a6f4e63c2d6a38ebc8d67e45b07c490f7
-
Filesize
68B
MD575486b8a51ebb85dd7ad8f14e49778bd
SHA147ddcd017e38acf73f8c4e71df0630f3b8b58a27
SHA2562bd365f0c5baeeceb4219ea7c81a77182950171ce7a27bf89389cd1581694a5a
SHA5129ab6214a6206872310722052d4dc25f2b91e46ad2709677b7790c280e8a4f85cab58b1886cf26d6e3b6a7e0cef81d04223226a616b7b9e6aeef1bb9743269b99
-
Filesize
60B
MD522b8147ae17b6f44fd1cc739ea3f8c7c
SHA1281b8bd8ebd1faf9fc08cd1921c4da617891dea0
SHA256b18cc80bcb835b2efe13d9e74590856f32f48f18146ede548ba983bb50785db1
SHA5125a5e783641645a855bdcefb8b0ba645f9ddd4c7d2f69e1d44bb5d9373ab678e37eb87cee122e159c92d404017ecab19bf10a21e3f1c89ca1af39fcb4c9773c83
-
Filesize
490B
MD5f70ae63c041b419d23bbd4ebda88d418
SHA19ed5f072f7922313625c7f7612ced96cf816d81a
SHA2568330e19264467fec7788112bdfca4d5ab0cf4658a8dbc6bed7c8c0615c47966f
SHA512e94a65b322251d94d69eacaa0369e2d2abfb52d271251eeeea1c9c34ee65f7def2fdfa504874adfd785005c306521afbe3768171329db6a1ce03565e49fbd74a
-
Filesize
60B
MD5e1644af2f0474aaa09ba1afc5e1fd674
SHA186e007f3ffd020d16d2fd8f67f58042525df7276
SHA25637e84b78b8b45bb3526f786b3d72f11f736f1b2b8c986e007e2a5bb418bab6e4
SHA51207c2be09dfff44f15012cb837dcaf5107b697013536812a16e963205159e2c9c6cac60ee7ba3d9182b707545a2eb212dd7a70cf6de389dcb648bdca1c36167f5
-
Filesize
52B
MD5f39895f75c574f9d6d9ac313de877789
SHA16e9348daa27c2321f35b93b8019cfcf56bf2f48a
SHA256838f27a6503fca37f27bc1f99442b9941808f2f2a9060501cd7e841127d96aeb
SHA51277ab2b655e710af9025c29285eb4057f567cbac09ea4999ded7643e0922afe7c5774a3eedbdbd475aa81653a136e6be6370ded8f3bcbdddbff11949e70b8524e
-
Filesize
66B
MD5663903175de04872070df960559c870e
SHA1a30fbc90b3c6d24ed50c29222b913d07a0cd3a16
SHA2562a7392a0d948ef5e3696ca29ef808cf6c0fbce128ad095ada79e59a4421e0736
SHA512ee5910c7e30dd409c34da753e835802c8a113022a1cf112ad4634ba80d1e6abbe68c10911bc9c3275256a874bfc0648742cbf6a12e8ab890e6084628c3798abd