Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21-12-2024 22:12
General
-
Target
d36841e717726a132e875dae7a46e642d2fc4b69fea829c427a80dbd6b1873fe.apk
-
Size
2.7MB
-
MD5
b96ab38f27ebf36161d93fff96c7a699
-
SHA1
eae3063e3fe0b8148b0da190c3abcea0a65c0387
-
SHA256
d36841e717726a132e875dae7a46e642d2fc4b69fea829c427a80dbd6b1873fe
-
SHA512
f0d1ff836f7429389303484e39383e61a361f060cd83ef828a0b3e1d2ac6d15060aa8d35dc584d783ed2ca00f2a133c45d42f0b5ebb244cbaeda0a32fae24683
-
SSDEEP
49152:Rkdz6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQd:RWzFjEI4iZaUzYH99yIu
Malware Config
Extracted
octo
https://87.120.116.233:7117/gate/
https://87.120.116.233:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://87.120.116.233:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD531b39840737d91080c3eec2b0f390683
SHA11d331568503033a4355702b2a167bb02577da6bb
SHA25652a81da1e356820b89d4733fe1ce72985d82e7724dd3eb3e32721ae7cb62d67e
SHA512955e193e3c241bce32435bf8522c6691f825dbe8c6dd85485c7ef82be60f8a70c3a2cfe66e9734189ceb7e26691242a8ed6f534e8ed7f5fd49d2305eb1bd16c6
-
Filesize
63B
MD52ffdb509c2ab21db386fcb96d622f4da
SHA112a7373149f2505a8b13afa9da44650903050bca
SHA2566d31c3ddd34c540fa147dae88f38273ff347b88fd210d62288cfc7ac871aa326
SHA5123ed4911e276f6c564738fce0d70f386251a9607d973b5c52bb92007be70be9c754daf8d8dd67f601ea84aad1369c3ef03a842705258848348a267f7db66b22d7
-
Filesize
68B
MD56b45735f34d56c1f2a6ce12da4b78d57
SHA16e9b88aa760c1b64e9faa4247b26df0a23ba6cef
SHA2565df0979c4be27c60dcc6e23bd4b8809c4b8b216abd12894bf8533a6dbbad577c
SHA51262e359f8876f6edce0f7ea8fde70d8770b2c90b4fae0a827ecc912ff860916f0dbd387cfe742c089474c3cb4659ed7f54e4abcd2c9f6be5a360404fc76b019df
-
Filesize
230B
MD54d9be1f002f43821c02a53b70f942c88
SHA1e11a15058e2ace6154cfce0b2d76e370178f662f
SHA256ef2c820e73c0be2c6a55d6f5bd7bf1141e0b4d2073fec8087567dc9f6619fb62
SHA512f9b378375a9661128e7ae71cc4266cef709428e58c4a8a40e272a6dd3d12fd92ffcb8b0df3748fb277e1eb9a10abafb28bb184a424d0ae473dbe6de89d1c7b21
-
Filesize
54B
MD5794352e8d38496c48be5db2165ac2eb7
SHA1af7f8b5afe4bc9545d8e156d9bfd84fdc0a5c6a3
SHA2560ed23f1bb6dc7633e67fdbf2307816da08988b805dfc6548bccf57ec40acf21d
SHA51255442911e63562601a6d857af349dc5c3035f0795b4ff9c0e2e7735005546dc83428641e2e78955d0f2c872123a6844ee45f8cc1bac9a96e5320b4765815edd7
-
Filesize
63B
MD519715f5875234217289dd00f429143a6
SHA1168c5014a9b271415a38caf9fbec34e0ad91d52a
SHA256e4363704e5f7ac9335ca8538d42f9e02e7c1310e42b109a54e5695012c93d48b
SHA512b1d1f1a1df8538380dc81b56af579977042bfda535e9d184daf34e9de7225074bf80201913426697a9b3f74bc389aa2d43f340642c9153fadb290ff2d79ae57c
-
Filesize
45B
MD5dcba729bace7a9c8bafd0274d832fde5
SHA1362ca9ee3a40d3ad5ece905d470e01b43de9c62b
SHA2560c31a30f468262fe93dda7d8256656eb994dee5b4ccd22aac74ea65bb2161f91
SHA512fa1dd140a139548b842ab9d1f93a0baf40ac9772bee4ba8bf5f6aabcf94e209a0ee091839b9d8adcc14d2315001a7f0fc021ccea2234b4b3e3bb6bda0fab6683
-
Filesize
466B
MD557d5c861321cb4f86cf540914b8fd9ed
SHA12e7877b7d6003f7714aa6900b5c2b1a1a1b49b56
SHA25676b8ca9d28c15a9158d9340a04222a4a544ab4c19a21d40e07298531364cdf40
SHA512d9fa0991c308c778d0fd499aeeb9f8b7664002357c42ff69db748639309bbf1865830c84a0efe9e9745194e45a1cbc9f1df4e68d83219c5bc8b963b9a605a97d
-
Filesize
45B
MD55fc4f0f802b17dabf9e1c24fa3dbe02e
SHA14efa16621fa1683e387b48c54704bfc00f1869b2
SHA256c57dc3025f2060d0d8be45d360388bc46785fb8a0105dda11a5db89990848991
SHA512d987e4f742b8c81497ddfefcd78f7822f9ccf4620b42bde1b9163d0b7e5de5773b9beb939b5685c62315ee2fa05a589ff47fda59d481b01adb977c2ba4408cfb
-
Filesize
66B
MD5855ac7fcc52bfc5cf8e96c339c04426e
SHA1806508ee19d60f4f53e2de3ab586c0d4d1b29497
SHA2561fb61da575b5dee1484e9b7b0bb3a272ce0e28cab79bd14810e34fc6dc8b327d
SHA5124bc69da2d66aca7b2ed90afc10fd5c28e2240b51cac3514f497470724a344dd8eb6257cc58af60c01f5bab3d40f45c5723d4e26480405bec4490f5f9ab94478e
-
Filesize
45B
MD59758e9941d3fc95dfc3932ca59633e68
SHA11ed202cc1dab26c38d94e3c0c040a1c7b2afc333
SHA2560e54a96696a1944b9c8c2b31935830dacaf953fe915b01ba94d9909d391ede42
SHA512b4fa841b0f0bb34ca7ced38236cfd31a22d595b9e3c236c8b6fc713ecf73e56815024958f0c653d66f6900f2ca257025f89803f0870468d99f60b5129ea66da5