Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21-12-2024 22:03
General
-
Target
db482967c05d07146d6e7b418850a2e8fc906892432919524edb06da77a19526.apk
-
Size
2.7MB
-
MD5
33b6fc4ca5dd7fdcc5edc1bd170802c9
-
SHA1
2baa03b5213c27e90d703ca39048be7e56a825ac
-
SHA256
db482967c05d07146d6e7b418850a2e8fc906892432919524edb06da77a19526
-
SHA512
8acc7b0fa2b762382d05b19fe7f4e478b698d77054febe5a494f5168b65c49f02bedfce6c1e37f2351d9991a779ff9aec658dc5ec43f532651b3d4e22fa6e96e
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQj:InFjEI4iZaUzYH99yIK
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD558720ffb35509373493d165cae5ab786
SHA16c5f58cacbe61fc1162abf62f84fe4d7c74e9b49
SHA256e28b487734196a36a098950155ecd507aa4fb9c7df27c88b64468efa84174011
SHA512f906ba30b05eb48fa021ee6f5bb37018b7899153470a9ca7731e078b0688ca8af337c8e39abf447366a38d40498734ee600fe8d67a20e7cbad07d4f27c177676
-
Filesize
68B
MD598bc4f631467e5c159cc691d39bb854d
SHA1659c9a5bbc683c93701a95bc3c878d91637bca9d
SHA2560cb018d8a7799d30a311aa2d1212f6c91ea5f4389437b2fec7d9e56e64c64877
SHA5128d09b58ea9f3b579d4a82b03234091808184a37c779afdd815488bdebac3fd9b988918764b86e5703b370203fb01d1947f6c107ed89bb279652f40e75356b2db
-
Filesize
230B
MD5ce99a4affd43bf5a99f62242f06133f4
SHA154a4d5e97571de5f456b0b27175405a633ebc7f5
SHA25608c86504a518324fea1c8d6890bd75ac4d525f54fac32faebd3db22fd7d8e4a0
SHA512479d90b987bc220e25761d170b8858b917104dc308472f8f927e6a88ba05709e888fc52662a1cb7b7f086edf42b4fd8c8ec7a22f0c56519e425184b1490c710c
-
Filesize
54B
MD51ad4cd7ab852f08a71af26d5d3e25058
SHA1c8547b1074ff51a95a6f30ab3bda74576fd48452
SHA256f739c3b5b2beb2e612e5b31346894ff23ae89399a0f8e4cc225e55c460873bda
SHA512aec025c267a456634d5851c0475a8acf517d0b0bd5351f2d059486d98d2f11c70f155f1bdc1eb4e00a9ed06fe2f2b3e88e9888bd014eba8d210e1dc8d3d924d3
-
Filesize
63B
MD52be52dd1b291086ea3e2e3b183b13231
SHA17e56a6c2b68392d5ac3b8da8f2fefbac5c2cf22a
SHA256bdba2d557622eb209be604b566052c62ad61b0fa45ab66415fe962a37baa94ff
SHA512b0429a58a5d723da09e63867483e6f399036af07c70d7d23f1a8405272a307caef41ee066d93fc0c2cd3456ba8b814afa00efab0d6bbbf006717dd3792ecb934
-
Filesize
45B
MD56f0b91f7fdf279f67683e190039efa62
SHA17f5a1a562c899d86f2e556b62cbd9c9ea8450600
SHA256c02f6f026c1b8f06f9a4328f69dd36c5c99f48719c9de15cc5fa1dc88102a39d
SHA51284105c38988762f36d41ea907070d2f12b80a0aab2c7f597fa222f80f037fa652c5818943d6adcd2baa5bb81b98710607851aa3e42be38d8a15d04dbc297117f
-
Filesize
466B
MD5541f3ca70e541971e2cf6dc27807c071
SHA1724fef941a96bb1104037fd7ce4a88166ac80fcb
SHA25616b5288b017a2c511f71461a8adb4f0dbc363c95774885e9104ed45fde9ff300
SHA512486db0b99b51546f69bcfd91c94c303190b496b72220fa13f55f4c3d43f03bb166a1692c9d8de5ffad14384b6f9bb1f3e70a4e5cffd315247ca880c69680f38c
-
Filesize
45B
MD5d0fa4e22bbe20c84346acc46fd474c6b
SHA104d634c44d2e9a867a0208293c98a51222015108
SHA256f5a705030806d8d50efbaedcd660b2db11ffceeac55bed1a397e379de025f2e6
SHA5129719b87625e11030b7bc4fd07363e202da0bd01333de16c7a26767e72572ef94a801e086f6b9d512ba64423eadbe46d0d2a3b33fcf5358c8b71963f43ccfdbff
-
Filesize
66B
MD5d702d53cad37f5c98c6cfd62f92417cb
SHA1f9e3fc9b4e899b3e495effde232338795b368758
SHA25664a07522a9b17d2bf4d85577a7ec96c0f00768e28958e0964d46cc5dfb380df5
SHA5126f7a7480f9a29a3b0cd9f7bbb316d797c155cfa1e489c25d6a4ef44378a3d25efd97a964c85e6716e2651b1e48bd18ac7b2d36a6e61cee8ebed7259f93ec03b1
-
Filesize
45B
MD5a23d4d51e203a4aab2a706c57a09f9a7
SHA1b0f0ff5519a8a6a3fd4406ff37f9d75a342ac4da
SHA25697ee9d06c1357d78960b5f04f96d497bbca8f02751baa1adfe62acf6bf690a6e
SHA512c07eeeffb406984cf5cdef74ef2e9fc1a7c349950f0101f2653346015a9930bffb16cbe4ebd78042349ecdf8d442f3acbdd6f9a1b5283400e3a4ca2d3b4007c1