Analysis
-
max time kernel
149s -
max time network
133s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
21-12-2024 22:04
General
-
Target
001b47aa4cc4f401e25887c26f7394a51ace233ac1d1a911de38ff26a33052bd.apk
-
Size
2.7MB
-
MD5
1d95540ec540c8817ac460b15a2e656b
-
SHA1
7b99cb7e0807703b8c3bffb334e3605c5620af56
-
SHA256
001b47aa4cc4f401e25887c26f7394a51ace233ac1d1a911de38ff26a33052bd
-
SHA512
d673f02caca94e290616ee5a9d9b69296b297e037847298e7f543ec31dc0fb4ec7b9f6bf4f5b5bfa3363d2c319a86a2283715e7a4ec2566858ddd77f0f14796d
-
SSDEEP
49152:Rkdz6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ2:RWzFjEI4iZaUzYH99yIx
Malware Config
Extracted
octo
https://87.120.116.233:7117/gate/
https://87.120.116.233:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://87.120.116.233:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5d23091b154a9663720058ce147bcab3c
SHA19f87dc1ac78d6139b3295c2fb936318f022c77d6
SHA2565af88580e5ff889e89af2567ed3ee39e980e43e66c9889d19a0db4a38d7f7b0f
SHA51229cc2fcf390866819d033a318c8c364f839299a6f0d4597bed8f944b842c5828b3159ec37e9e52d4c1ac00c0e34b7579912c769c2d73698084efe7dd4dd16ec8
-
Filesize
70B
MD5cbd50b850a851a8dc10aa1b1f98263ff
SHA1f12c9943cc2eb92c13d955aabd69b51e6d914566
SHA256e6a388c3221245d005fe5b06746035fe8981678f6fc78c328f980890c7d81262
SHA5125cf4e5937cec2d5a765844a3b75b699986fa5b4e0e8c6c7f50da01d53fb03b041a40c8a44395e1cbee0332971d63633563ecacfc9e15e3b4705a940adb26616d
-
Filesize
70B
MD5de92f72601849a42ced1201bfff046b5
SHA1fde411f616fcb19f11c7b1c63b72200d0f331b59
SHA2567be8daf4a077c4c82e927635343ba04438bed096d0604534d77315aaa25a3fac
SHA512d6138127f8e58280007d43aca024dcfff95b041fe902b366f330d5cd8cb8bf8f2708e4a8b92236a11cf6682abc20cc3f02e059a9fa261fe1f749ab4ba60711c1
-
Filesize
68B
MD500b065de5087a8f4448ea3aae3168ff4
SHA170336ab08dc8ddbd3205f5dfe0e72a254404c9b2
SHA2562d326d8ed302d7b3b3a9765166bc22f5b141d3596599b079f015761b259fd90f
SHA51290e071babe4322d37d5f2d3264d574c24dbe6f98df9f6140f637f144be37f052c03deee7d2f526626b60f3d4f57feede99185eb5a536e08a1096ec4f9e06d377
-
Filesize
84B
MD5758535e55639d283f957654a46450df9
SHA1d11fa3f7b22c7cccd0a46f729fccae47012702ad
SHA2566502801932f38fe1f468f5f54cfe67a56c09e4c738d222956ea31f41045a763f
SHA512941a55140dc6492d52c51ad878c3ede19654ca28e1d31f0189d3d2de51f57191fe0aba806c433a9681eaf80acc460909bd5f51ecc6ccbf06a17ac15e7c8049ae
-
Filesize
68B
MD58062eaae73e64fb51166a114d8b75abf
SHA1b9977aacf48a6436fe81ebcb39b710970dd80957
SHA25640441633259092015827e91ef324fb2b99a749342e65e1c3041314f5b466663f
SHA51280d72de440d8d657d070e077d10401a7e38e2f4027edba2dadc7b94e151858fb6cd62780e13858f8ebcf11e88b18e0227c427faae16affc7fbf613d21765778f
-
Filesize
68B
MD5db0e2cf630e4fcd4b7dab214868cb129
SHA12a2e22fcd4d87a5528bfe9f57fbf6e1a45d5de1c
SHA256ed4390269e3824fb29c073094cecd73a1f17a7c30932bc422ac54d85c8321211
SHA5127f0f26aa90bea303a2b08eb852bbfdd35c63cf99d36a9da7187ecfe599fce1e4fddb77f69d74370e40fb574f0fc640e82a16cce11c6d9e5dfb2dcfed72be28ea
-
Filesize
214B
MD52c7b70ed8179cd7c7fa52e1c75c69505
SHA19ff92e55556c74887343f48ee187b1cd13a8e167
SHA256a0d650d45bc14f11611ff825ec022279dbe2b75fcab2307243f9ad1ebfece07f
SHA51214d7005541f3abd10726d9f5531e85b4898dc1fcb65522bbbacd8ba63a65bfd02ebfdc6fc7a3ab44ba26ef2a68de7ab867ea8bd3a634e417f979014bcbda92b4
-
Filesize
214B
MD5893fbf395983a2304da8d301d1664e0a
SHA1e8d8a2856329d3f3655edabbcf9f0ff96f63bf60
SHA256e81f57e1a2430c2bda9347fbb698f3a6eb5b871e18b27d71456780babb3dbf61
SHA51201e0677ef458ff31f70e17b5bffac0f9a05575ac1f1650f953a3a9f281b1d1e073b20a5dbfbd73d0430ae9a0401c4661d0abda2e627ecad1e93f677642769f68
-
Filesize
54B
MD5483c224b84509caaf30824b7fb132152
SHA118aae7beb0e0c15a71d2ac6ac622a3cff7181e20
SHA2562869b387a9198317a680122a1c9f37696e9f52f1e284a3f4492d6e4caec5411c
SHA51247432a905abaf619629bbd7f28eb14433899e7ade883df155cdaf9f506d9ec8c71fba2399429c5b7edf8a621588afd5805e74e179d4eec0e1fb7815beeff2ccb
-
Filesize
68B
MD58fed10dcd81c4c1108f8fa40dd7ee574
SHA1c5cdce07201a1a81b4268dca0281454a4b22bc28
SHA2568b4bae8f8b4c871a2bf78203aa22ff446e029016c9028c428718517ef5c438cd
SHA512d1ebcb58fc05969266d5cd86c8ac00daa8e898b1e449e7a0ec2f8e3ead7b4ecff8a7582ca73f6d4e72954534ff5693db251e46d741f4ee22103b22e178767df1
-
Filesize
52B
MD5b51fc1443cedcf586b4bebd48f3a7e3d
SHA1e1acd410eb0217e659ea53c430e50236a45c3580
SHA256d730bad7eaec25ed0086e7fc6e8509f54490dadc6db477a0dc2abc6dcd4e5b46
SHA5122d749e516591fb684b21ef577d7c27804f07cb653071f8977e0f3e8aa354568ce75704cf25cd12409c06eea3e8795b34a02e3015bad839b7615f8e36e8d0a20a
-
Filesize
70B
MD5cfade37e03f7358a540ca7f76af7ba00
SHA1c4305e16336b954b85e9cb0029fb24a950610149
SHA25655e44b7034d91e26d9bffc4916c4ae13c6b4dd7670dba1202eac261f95f78b84
SHA51245ece37c00a59a0f46d5e88d1ac227cf74eccee584e83799af9474dd96df2f203806dc2aba83952cf8635333596247cf2ffe3225129a27d81d6708e78942d16b
-
Filesize
55B
MD54e30ef81d77d710d3eff3f9b9c8cb61e
SHA15f6207cb2942bb5668fa90019d7683faf582b4f1
SHA2561902d47063b56a39e5dc0b1330172eb7b49a6b6831c9720a156d28488a394de8
SHA5126941f50bf7cda8509c268bee15897c7e8484c66d41317f4a8074f29ee37eb83b206e190800fef8627435d7141b5475835f1a51a56a265164739d28e0a6255b80
-
Filesize
45B
MD526d208e2c76b3057a704b8c2487aa29e
SHA13f4707ad8f07e2d9a6b23e29c8784b36362e66fa
SHA256fa65d3fc35ffe1d2e350ff64fe2860accce95938d8ad25db696106d21c9659da
SHA5121f60a2f605f4e4753697051d223114513d2d509c3131d6becf08c2a1ee8a2c5393c14fc68a04b286c9b640cb21e6146b1b25b6379a37dd8922c4dba7955112cb
-
Filesize
70B
MD5c2531f2f3e67bbc3ad6b2ee48e8b9c3c
SHA1b5f12f7afcea1b073daf6bb8d315852ff704aefa
SHA256478fb09ac88ab1ffeeb304ce5cd35da619a7c00966e303e5e30e09f46f53df30
SHA512aa693da52a60286021b9df17dc4c6e89195d3c7ea3ac700e0982c9af781421adcf3ced897d5154d592023b0883f448890580392fae767cac32bf70b2ed8544e5
-
Filesize
490B
MD592b148fa19029eba7d7ada26c7f29196
SHA113e3bc24dc66a461451eff2f054490e7daef0e32
SHA256dee59272a850e8e61113f0ec5abc4b62cb49fdba8b6f5c82c1ee64fbf8ce5fbd
SHA51238f34aa35ea9d2d8d519fb77e0f33f42a307239ff8f4b9c51a8b71611a2746dd0abca32243d18b04bae29011892545e3b09b998ac7355d6fd1777fd1d679f4ae