Analysis
-
max time kernel
147s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
23-12-2024 22:00
General
-
Target
b16dede1d4eabeada5073cff50381cf470b6aba1308d02ff87595f87a544f314.apk
-
Size
2.7MB
-
MD5
63e16770c5da78790f74210819396665
-
SHA1
cc44de8cfa382e615766e08356a9386f88e986c2
-
SHA256
b16dede1d4eabeada5073cff50381cf470b6aba1308d02ff87595f87a544f314
-
SHA512
8ff42caa20171f54d22e140b2bd8315a68cf62cd4e628045d8c1855d8e434f6dea7733786ddedc2bdfa7004014c5f7c72a8663ed28e16c0103ddb00d4f948417
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ2:InFjEI4iZaUzYH99yIn
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5e3aec51e65c0e3554abdcfcd331156b1
SHA16e44ceba9af7f1f0022b2bf41759605719b45d52
SHA256df3c3789609b28a1e3b76e029223b973c4b0fe24180c09a57314b180c9f53c6f
SHA512f30279d64a5d39e94172050e89899fda77e63c66edd42b48df31b51c0921b25b3ba4ec02e4d5a03a5981c88e088007486e56dfd126f60abc0cce61295a861925
-
Filesize
79B
MD5194f73a49d14c02cbd88216de42b6809
SHA13446b24ffa7d55c582df0d73a0d58d1ca6be0929
SHA256e2f0c9d2364f97fb502e842157a572cbb7bad30cb09db7c697b867ecf6fd7c21
SHA51265c6ee89e76ac777218cd65ee960320289991a238f4032ee5ce8030dec214039694a735aaf559d042c65aadb9868731edb078b07df525e109e3d0dfed22485d1
-
Filesize
490B
MD59483502711ae513f827d8374fd212c34
SHA10c3c4447a6ac9c6fbef2eab51ae9adae9971c567
SHA256f721581309d8176ee20042975ebdf7634031978ebb8d3cc8c98ef5ef55cc915d
SHA5126ca0fb935f28a70de88618d048e454b8c1f1cf78668bce74b8df174fd3e30c9b49044ca17fb3c06f17df7f92990a228c23eb235ba46bd94260a3be94781640d1
-
Filesize
68B
MD5e0f646d321e85b41e8e1e8d89055a7eb
SHA1b6bfe1b53fd8b749d7f98b81385a4420ca7888bd
SHA256d21368b541a6108a2dfc99dd47417236c249697cd267e67c1ed5ab8637a16cb9
SHA512728fcc34a4e8085391b2019bc43c1b3883ef2b921d07d30b814a391346a81ec4f969e68e9a87361a946f50ce2a4a713af7ed059a0dbe6bf44f9bffb13abf995d
-
Filesize
60B
MD50bad0c07f8e886e58361a75d557e38c1
SHA1b527e799007d3588ed614585145ff628d0b40265
SHA256f17da47dd799f2ddb20df7afc658343bf1fdca31fe35e04407b2bf57eb7ce24c
SHA5128fc3bb6be54b2a482d5a740f6ba084c58ad0c35076334f09edea1bf1bfcd1f76f4d1879b7ad61fecbc6a9a773880b7727905c2bec569d62e979c5cbce35311d3
-
Filesize
52B
MD59e61bfdeba7465f7f86e0bb75579a1a5
SHA1673f1e88f5a246564e9469980932586eaa89adf2
SHA25637075b0900a6198ff59022858d55fad13c5da7b3d6af8120a19c745fff2fc8e8
SHA5128483b076925346883476dc6d436f8eeb5b2336f1f33543134f5b902a4539f7d45c9a9b28b3e2b7cb36670d83290589a6503ec0855e3f5c2ddcd2b10498c6770b
-
Filesize
66B
MD58f073672610cbf30dc149a54397cdf80
SHA1f73dbde2bd66b96e571e18b4467d289f48646711
SHA256fca7b77c12442c783a8b2dc15eb20b8b780e775bddb75dd7e1e58caf58493b44
SHA512b7c74546bb59fa0307fcc84e27e551179727258909829e333826642ed88a3ad1c77b4785aec53b72909ef02ab0cf478af8d2206fa06044fc5c5b47de9f6a5ee3
-
Filesize
84B
MD5e923868d1df37b42abdc37743bad634f
SHA1a7bd87ba9cb7a4d3a9e80b0b96cac377a3968af5
SHA256ef27aa00d1a285f11311bc4ed1b349f8c7651a23eb78d5b180762037cdb00bd5
SHA5127d5d71a22b73009a56cac6a97f9a0295925e32cad6e7ca3c4ec702186e78769f9d2315bb7960c1685a0d82cd8ce43f73eb2d4cdc876d581395fd4976456cd4ba
-
Filesize
68B
MD576d3d0aeac0b533c71217510ed19b265
SHA17e03ef1420fa113635c2bbea577824627c9bf025
SHA256b3c78b7fb2bbd14af383100269fbf5da9890e2fb6eacbfeeb20445f46969b073
SHA5126642aa4be7a6e92c0c5eef11d507ac6886b830915f93a9655dfaf6037d26ca29e5a46683e1273ece8a80ae5ee5e27f1075140ccd6186b5848219d05675c02b58
-
Filesize
54B
MD51e58acbb46ce5e1144c55c3853a36456
SHA184d8ae7131991236488e6b5cb0010933dd6adf6e
SHA256b8dc2922c06f8e2d5e6885bad616b243f0f8f17c05fed7f778d6ed2ef9b811b1
SHA5123ce9083fd0d880280f27e9ec3ed86946add4fe948e1c3f4177ac56c3af88e9db82f51e302646ecd7ce4fa84564af54bf0da9588318a7fd98b5e9ec4779feb6e7
-
Filesize
68B
MD5f146c853bb0a4c795199143d0626e07e
SHA134eb2471552e86051b932bb8e6e835b41463fc82
SHA25675887eddad8c6fec7a6866a549e0e113d13d3ff2003240c2dd18d0c64a0e3ccd
SHA512827619e78d6b51aa0b448c15d50a5d276838e84cb4f58d503e7842db7fe0613d7304e50289549c3249824fefd5e80387db3f1840ea45aba17d0023623287a850
-
Filesize
60B
MD5be3661aafe86d6b3ea25928d284e76fe
SHA1c9c34befc6bd713e98177a2a3ba78021aadcb4c5
SHA256ccf44012bc07589cbeb8ee9f25f35653b0ca9982f6204ab58563ec7cf53b8ac4
SHA512ce86e7b42e0d282fbe372f2496e1ef77ab0ccba516f3abe6c61c6c7790fb53a65802cb8f6e18f03dacfb557ffb9eb583fb8d634b7ef3db69917b7322c7f8b96f
-
Filesize
52B
MD55ea2af19a91cb230b9784a72ff92aad3
SHA14d759fa2343cd4ecd4ba054f199f05a9196006de
SHA256e3b6bc56d3590165847d89d6c0b95e23231fdb603c46fbd57c2b1d5cc2f63c75
SHA51255d23418020966bb2da4a92f9f5f937863aff14d86f501adda499f6a45f4d81fe9063ff32a8696687a08d2fddc09cef9d28046d5e3bbfd454bb00bfd3a2f9771
-
Filesize
70B
MD52e5d6a8bdd4485742481920c82f352b7
SHA131a08d4b0301a50aa7a4f97d7cc1a9fe95b9cc89
SHA2561c8fe9968e886d76d5f4274db05a17df80dabe2deb8dedcedf9fa52efef96d77
SHA5127582a9657439be9378ec9c5e7439cbc01dad5719434053728ff54de365a5157e7871b93e774a495d44b735f72505d99aedb1e27ec5155dc77211e91288d2db75
-
Filesize
55B
MD57c4ad3f7405db1db8f768c6c72b4b3a0
SHA1abb0fa35109f2cb892e365c05d0184d6cda10a40
SHA256dd5f6e7b8409bdcc1c0f9130d73b6e339416f02124f4186ceee3a8785eced457
SHA512275280e3cac7e5bcbfb8ddde9d6b4d2412d6ab1b42fdc89b83de1eb509b34838713dced31577fcead06bc8dc3fd3fdfa822e0620d3fec8d6927611bfb858a1d9
-
Filesize
45B
MD54af118171dee9559f28ce501701723e0
SHA1bb2fa645df2a7adc45ba71f478a94a98be478aaf
SHA256df8b6cc2c7703f741f0debe229c56e3423c0cab47c397106ab1af6d1be9e5aec
SHA512f33f207faf635d6199edd8201eafe491d689779e6596e5e81a57fadd3f7a83f2900d4b10c6f56a49ed0e30f8ef242b9de14941b01c6f914c98bfd1ba1c2dbeea
-
Filesize
70B
MD5a353304c8df7756fd95e991f0e469168
SHA1acedb776e72aa550117b646c9c3dffa8602abc7f
SHA2561791287c623750f3655a15206dbee9945792904e208ab8e29a1fcc7867592fbf
SHA5127e8b45760e6bb09ca996c09ae447ede90211fc2382587fe4280c7a3663e11094c6a7d9f063b02e188fd136cc75c9b2e64dfa364719b40d2f3dc52e59122809cd