Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
21-12-2024 22:09
General
-
Target
6f8c5db7351b9fddbbdfea6b16e49267e08e6d073740605b98a8c4948f890771.apk
-
Size
2.7MB
-
MD5
5e79bc920d2ef3104bca97d8c13dd321
-
SHA1
219b5888137bdb7cca199f1c4a6f519a03bfa62b
-
SHA256
6f8c5db7351b9fddbbdfea6b16e49267e08e6d073740605b98a8c4948f890771
-
SHA512
25fa246890c5969ac0a5cf096058010d431ea67ceb5abe22f3ef86ad95e716fa1cb58c9c6b62d43d77f6a0d375a1edf5bfd3cfcc8c5161b365cda6096a54dbfb
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQX:6oQrwFjEI4iZaUzYH99yIs
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD5e215dc2ed87f553588f8adcc55f14527
SHA153467fdba0a2317542df75526c143d375bdc94a1
SHA256f9392ea2b2c469932b3cfc064d823c31fd99bd2a0edd9e4c20b97deed57c939a
SHA512808d1d6a71bc10fb190ab66982040428f4d6f5ff0ecb2e75a50f90ab68c88f5d7b35e191294fa6f078491719e3946be847c8745a95a25846d9f4227df77a041c
-
Filesize
68B
MD5663fd2359d25804d53de3feeb44916cf
SHA1ca4f6a69dfcc772f8353615783ec9369b9ee97d2
SHA256763227611193e70eedac3f0a658955e43068e9d232ee039e4b0d8205181bee1f
SHA5123a252321c1df0b06765e4e11d1bd1d87e440fee51dde99baaeb7f6b205ba5904cbe260ddbd821732dae8cb5b33165f360c31caae7e45562f48f9df7e4bf05a28
-
Filesize
214B
MD53d4e6aa7f8c53756afcd61422c3d8dd0
SHA19eb113bcfe596e6e06a69408bcbb09f1efdb4089
SHA25653269daaccdd07c899c3f07e17c734cecb37c41e3638132e6e4e101ebe4d8b4f
SHA51273888270127cea6d6133ba4fbe1f029d7777199d67e25cb97048b32e41a38729598c6c51ba55802f9a1947b249ce0c32d1f452bcbfef5372c11d4caa2803aca6
-
Filesize
54B
MD57710b94f64fac7fde09087001ed373b7
SHA12d189d289f58b173cdef9571f5ac153f836395a6
SHA2563d1307649db285262e028959091b72132dd706f41ab4676f51065848ba9cebc5
SHA5122a73a027c7a57ae22e152994807b6071b1ae3ea6092c0e5336c4709dab0efb9a1271f64250ae9aef58cc3f265a0e29ba958cd2e179c057f381ff356000edfd53
-
Filesize
68B
MD5b6006ab859631de6a62c27205e2a9b4e
SHA1c5a728c4540a02234657955e05e3d446948c42e7
SHA256ed8b9aae907a41ba73698f9b6974445f47e78a1a6c417cdb28eeb25bc0543122
SHA51296637af76be1a40804bc1713ca3d05be217018afe44cdb8bcdf7c67ec8cf02cde529b9f922a6017b3816ba5a4822e69a5cd5ff929702f881f35108ee48209a63
-
Filesize
60B
MD51fe7e9c904b4c8e034ba5dd782fa5d3a
SHA1ec2ace6cb407d125f75d7ba0faf1fb683bd2ffd8
SHA256b3561ac116709c3229904e3f53eaafaef6e58e474c5cb256cc3d8fc2a3fa75aa
SHA51208cea4ca00f1850f5bc6dcc7036cd7260d6a1933b3781264e39c27dcffa43647e7bd99e53f5f5d83def58e0a7b7e6e635a344bfb3f71914baa68a18dc866fc95
-
Filesize
490B
MD56035048f187795b7aadee057161d9ce8
SHA15a1ed4104a91b0838fc7ec8ae80a2e11256f8e4b
SHA256e50560a16072d185c73a061528bf431951c67131706da43421eff6f5c908c7a4
SHA512375ac811c28800593702a90f21a5f188674de690d097e13f5974085c4888c0c1f57e18506f986d7dcee13a74ae859a5470600f16910d9f0c3ab7c183ee1578e8
-
Filesize
60B
MD54fbf2bc238889b34376fba0aaa0db3d3
SHA18e2d9898d38496be8ce9c51e115752d75e1e8af3
SHA256507991f74a3c8027b3d15829fc9683f0cf9435f7c1779432b25c7311e6d8c513
SHA5122b46907f5c843ec1d02bd47b4ecbad979d22b5a1648be8fe593778013e78af335a3fe8812d18143362410b96512a57bdca931647232ba743988d72806ecee2ac
-
Filesize
52B
MD5e978d522826c4edd17820564d63e8cd0
SHA17289646291b468b17462559613a6baa9da6f6b83
SHA256538c534a743dde76f88afba8e7f9e2fe6a9650885780b365fef486c141fe533d
SHA512409d2fc2c36f83ba2e0d575a95bcbd6e451e0c471835f7cfa2d88f5073e0be623d082c082fd32e8128334a10298e330787a05df756ed58ae8d5ce96967983dfa
-
Filesize
66B
MD5ae8536fc90c4fe631adb949a9a10427f
SHA1a37851c69ebe3b699921caca868a2ac08619728e
SHA256e9f0dc76d8f2b25fa316b5235b04f38aa033cb19d87082f405f68754e845865a
SHA51214f7da96b6ed14e906a1ff893a23bd98501cc861c27405b4cecf2dd33c665caaf40a249bce5b7ece9243441e9f32ee7c414e5380357fc88f566e1c1a5b38544b