Analysis
-
max time kernel
148s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
22-12-2024 22:02
General
-
Target
85d7b340d5b51386e5b45833fb03dfa0a6f85e8f3ddc5f09b968ba5175c32d35.apk
-
Size
2.7MB
-
MD5
c2ab01c444c894355cc4e280b73b5427
-
SHA1
ec7c298bae2a8b9096c97e229d7bff7e3f2f6c30
-
SHA256
85d7b340d5b51386e5b45833fb03dfa0a6f85e8f3ddc5f09b968ba5175c32d35
-
SHA512
9aa90cb85bd41d511a3af4c2dd21c060b7d457f2c07bba9dd75a6cff67e03f86370a0b570e2ee281a3b0546a3bb1ab5826c589bdac1645ba21d2074f7c48bf46
-
SSDEEP
49152:CcoOO6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQc:rgFjEI4iZaUzYH99yI9
Malware Config
Extracted
octo
https://45.149.241.195:7117/gate/
https://45.149.241.195:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://45.149.241.195:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5f4c46550e18fbeda31e88487a900d3d6
SHA18bf9d5d509855441ce0f15b82372af357b98d926
SHA256352dd2364e89201f91d7cea087a5e7291f44ccf4f974718be3c811c0754b4819
SHA5123b1abcdaecb14a5208baf37a060c7bb5105b2272e8ccd60454ee6ccfdb9f4bae1a94ebd40ac51a8d01c1c187d8a74b59966e2e28562ef0acf6dea92b7c54713c
-
Filesize
79B
MD5bdc537aa79590135ace01b4260aaf0a1
SHA14a44ced94a01c5f58736c2d04299be8f5526302c
SHA25680f82e8c94836cfdccc0001af3fb528c610affad917a09e1a8c835e5fb51039b
SHA512245129c4b192793f44695c25e8b4814fefeff2322f3f557e83cdb387ccfa55227e3c3475c8e37653e6771b77547d1b9d259df6fb8ef191e19c504ba80d2f2afa
-
Filesize
490B
MD527eae0a94898fc6876f62e3f36d005dc
SHA13a179381141f9f905993e9a4a9730cfff9851ea5
SHA256224af5ed28380ffd86309476e2dc5e947ce07bae4044ff5b6ca1497502bc3ed4
SHA512c9b72921079ba3c4cff20cb6f662d79ff069a22f7b81840a0d94ce79f9e900e73d76e79850a9a139f35d00b13b42540f9d99915cfb19823a7f8c30a0415ff4d8
-
Filesize
68B
MD5ca476952c459534b5bb74fc201864140
SHA11b60ea2a4235192373b045d6afc7301257e6caea
SHA25620943658c6c11d7c289a15b651732dae7ee0372567d600a729f1819d52c83a1c
SHA512fb085f8faaf7de92f37c86fde458d430b5a47b26d170926f5c0eccbec52ca98a06f7b7d61b19e48b3b88e95c2ecae4ae970f0c1ac9468aa7dc7386f7d5c68a0c
-
Filesize
60B
MD5eaf3da56eef8b636fb98c436998d3a72
SHA17ec2ec49e6b8e351989624bbad0bd3bf1f3bb45c
SHA2562d099a959a309419472e158658d7ffc386e48d6bb3c700a1d9912a4194f10357
SHA512bbfb65eb61fea84341d9e061e9e708d9252a0f68ab342f95847aae93e87daeac02a6f26d14d55aa2c6b7202b008e94e774f8530ffbc6fb2c965d04e5e7fb923c
-
Filesize
52B
MD5dfb4a752eb06df18c58e801476bcd47e
SHA190fa60d2ed6ca0dc04105f751379f91bfda45b9c
SHA2564e8c778fde7d0aa93895a3e7c4e00a380e1b6a47909bba290f2280b209ddddac
SHA5127608901e94bb5177842d65526dd6517e22a94d07a8332d32be9883a0222dc3a1c1a915010a61fffd35d982b2bb4da63214eb6c3de1c55cfb138268b1c15ea67e
-
Filesize
66B
MD5d51bcb5620354cf90e75a52c81f52e97
SHA18dafc9b8351ed87e6bc3bc2d1a7721a81ce32b25
SHA256c90090d37d4598957d3d5fce28f886022954ecaf4e1b86514c6e218620bb27c2
SHA512e2d16f2f604df75bb8515c9239ab8c17c25fec909572f86f336c7eeb08422d29dace5d925ff1422bab38ecc06cea669a44185f830379cb920e0c27dace9618a8
-
Filesize
84B
MD5f3f66c0e914b3ae343a760daed33085a
SHA1135fd147270b73a777143d8311caefdccecc7494
SHA256b4b8488b8d95fc5c81f2093b6abd71b6ec7fb1b8ff2155f5f9905d93d507e244
SHA512c2910dc83a5d24643e515cae21f3174e6bb1c989ae798eaeb40e4b6f1aa64ad15e55be27c3de5b479ae3add28e799ad999f7a0d857baf4fa4144884c3e1df909
-
Filesize
68B
MD563dbff130b488e1b68cf829d286cccc1
SHA1cc7788dea6b83b9ada2038adb4c6b89700bcacb2
SHA256b212123ba9beb3c4a46e7f56f3135c0ec78bb6ed7ae9def0905850f7fe567977
SHA5126ce701a2179b5cef24aae9a92e7eed0dcebf23332e0324a4b9d2eaddea24a7e91c19bce1e97e6a6bbe02affade64989b4b228f4f7f1155a13d9ac35674ee667e
-
Filesize
54B
MD5ec7cd1c391f625bfc039a673bf3f9177
SHA1f1dc5cb71b754d5eb48967aae5fe5163150a1c71
SHA2566fa4ddc9e2e855a762989da11bac57c014b8d1c042e69ef4838496699b5c078e
SHA512a00205fb34b75a3725ac6e6113a2830d819c9f2bd4a96720b31606de01e74e72773be9c92f37a6a5f26a31bfff26f0a33f1a98cc4a26c1eb4ab27f1a34cffbd8
-
Filesize
68B
MD5802c83b739c191eb5f27b0fec5a29168
SHA1d395997250daf5b36e49036aa69fda1f8acd1e1a
SHA256b0596a9d1628497813fa8ea7d7e670c959d9e11948bad1914e66ac7317193391
SHA512b78301c45e33a96943f2782c495e32383251780cd0046dc2603f3d9171be4b25f37f5bf96f56d5b0545c787a4a2413672cac30c443b4b1a55d33609e1f8dc440
-
Filesize
60B
MD52779f32295b2a2c61ce29d834fd30aef
SHA1178531aff608fb779cb3dd88f8f645e4950a1d66
SHA256e90cb0e37c24d4ab6a82f84fb6d815fbe4e60cb15cee998c58dfb4d5228c4b50
SHA51269dd21833f3a11330e52fa0935ad0d9853676a8a5dd42fbea0d749705569625b9136d56beea98beca798c98a31fe099d6720c18c5a17b272272ad8513b183d1b
-
Filesize
52B
MD534f01e83bcdd1e1ea9580b4aa17c8048
SHA18a1c1de388829092872a9482e61a648439b2028b
SHA25618483f9b45f5bc712d9b2840ad5c4c8689210722ddee34bffa7933606c40e2ec
SHA512e8086db2f862ce480eb0a13c535fdca1172363937defbb504ae3027b55c24ab510b1f9bd7c95ec06fbd14b5d85082b6986edf0d15a03020a395e84c548ab4d5a
-
Filesize
70B
MD5e1830d4c2940383136eac1c77bd07375
SHA12bb20c3f011ac4936c8129057209ff32af133a0a
SHA256a46b4e0dc54013791124d277857f5d9976797c5301a85bbfffd9cc0be8e0632d
SHA512d7bf53c228527d469785705790602d722cf8bcd00f685b06167f12ccfe94bb1b3e0f94186157cb91a7fa5732ce731270a2c819fcdb92a3b080b7e0b8bf2e932a
-
Filesize
55B
MD52189978ffff6ed197239316907a1b9b7
SHA18c5876d41f5a5a3517bdcf101b54fc984fe6c560
SHA256f5149407b833e5ce0bacd4b3ed9ca4c46aaa49c5ced3f1b9cc065fbd4496c70c
SHA51228ffe6da235c6388855a1377ef3f5507130f5e76c225d581d23c3a4b74d562412f5b22a30f3157de7048eb205333a06a4a87350f529de140e564e5e8893367a8
-
Filesize
45B
MD55ad84592c280cb34c57a6379c53037d9
SHA172600c1833d12aa016ab371e1ad764c5c851bafc
SHA25676b10a3d14d86d14948beb13ee08a814e35d7b524b01d279f1c2ce4ef6a1ec9e
SHA512bef147b52899f2e05684679ff25e185bdb35810d469d5ffd1cefcc1a3830df7668f03fbdacac70691eaf607e76a72c92f7ebf54a631aef3bc2eda7c49c178fec
-
Filesize
70B
MD57598fe8363fff7a0bf9b32a247f558d3
SHA13588610b2b9d20fcc386d633393699334c5ceece
SHA256833c9d959df6c4d31ee082d72b0d87a6afa31abaf0a7f8f9cc2d557f4ac0b790
SHA512c8af47e11df86736d6e6d1ec6dbc518b8258e874052c35cc7824b422e6011ca9411bb3125a8e5adc1ae01871c2791a4200075621783297e0140bfee1b7ccd9fe