Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
23-12-2024 22:00
General
-
Target
f5465488b8497ceb356e98b16004f6b689ed8729d0a6077f4da99272cabab1df.apk
-
Size
2.7MB
-
MD5
9ce02575336f8166c7ac7e47c8ffdd2e
-
SHA1
1e0c13336c357367570f2f9788972d39c45bad79
-
SHA256
f5465488b8497ceb356e98b16004f6b689ed8729d0a6077f4da99272cabab1df
-
SHA512
e5f6e4cfea58c32fe2caf284c93b87070a4dbb842e1d8a82c387433047a6e2d20a0cb65751575f3e42970ceb6b968afbe2e211f6ea931d09c350fb4fe32cfd8b
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQa:6oQrwFjEI4iZaUzYH99yI5
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5bf45363d1d615b69f85fec5bbb1637b7
SHA1a32f26c64af9b35e9329ca748be60e32c9b1b815
SHA256172c7898a8a3dcfaba62dd11515183447307f6730a43c4ec9125274d4599e20e
SHA51272a50c9ef0f8ee665fdf5b13af2e840b6bf8b9f9120ba05ab3101f5c21b7ac50d66f0621bb6b8f205d5e887890ec018e792ba1ea66983904527826c6632d4cd6
-
Filesize
79B
MD55796577597adbec8f148aa261b2cdf2b
SHA1c8509861872c64e68a71c44af5d88fe5a0335bdd
SHA25668254c466b3e41df32cc14d2a65db8ebe5c76e9cda7a30ce31c5b8807de68bd0
SHA51279a598d9a695891cf77f0f7a40e25be29a051ca9538277aeead056c37f8fd933c5e783521c89aef6d09f9a036cf34b584f68a54acfd5e21cb2743c1a6cba0dbb
-
Filesize
490B
MD5bfb23e7fef36b513a88a5c9112ffdfae
SHA1be5ce26451776f5aea7aa17aa697d0e0388cf9fa
SHA256cc68e356a1504820e9132e8326210c4e02186dc2008d964525e97f354f2e8226
SHA51224f67573cb26bb35cf6a4050c055d5332805785e29e5c11bc755eef030506beea744e88edac4b5262f39a8b6d2ed0f625c3141d929faaeb8bc509c8e66d89169
-
Filesize
52B
MD52b19bc81492eac5b97247a9db75bfb6d
SHA1aaea0cbbbe4d6e29873a409edbaf0f4126b5dd57
SHA256f866b8effcaae2983b2fe7462bbb8cd614fabec9444fd78b936aca8515c27068
SHA51246082e9b8ddab7ffed9d9d236e850bbc8cc21f0e7c5b1657a5eabb1af28ac5283cd9600a29d94631bdf7b43401f9d370c614f5b34c8bd4a080eef1ea5f2d2986
-
Filesize
60B
MD551ee09cd806234804c94717e3ebbcf10
SHA1899278566cd63b6d1a405b82e6685590741640f1
SHA256a39a911af3a43c99b0b883dd080c6e34f20e3b738510475cc2bc36fd4c4e4d0a
SHA512307c6c9b92c9751f193b57da07f4a8df2ec39f4b82bfd834ccadb08b8273ed4981986570c5f3c846d8bb99e2823be0250dbb402fdbbba05c6c20a5db4f73f3c4
-
Filesize
66B
MD5e235a37aa4d078cfc37dedb5476da2ba
SHA1df0dfc53645d06fce790e2ed333033bf022cf634
SHA256577069eff7f1fd8b1ea3e6f7f7f322fb7b1802a8e5ff3dfc419ca39ecae2ea01
SHA5122c61163e93cee03cdb8babe653b413f7bef739fcc4de08679bfac537ebf9358dcfed882ebeaf54232553c2e3fe43508373391cd6cd68dd3d7a98d611f20ef645
-
Filesize
84B
MD56c00633e5dbf2d2ac169005cd9669c59
SHA1609b5e069ef157007c67294e0d80e6f63dba069a
SHA256335f80be415dd70e77f6fb83c39ea3393358ea09665c3280551e8563efa259d4
SHA512341e0fc78dd60376d98931cb6adfff55fe409e0bb7e0f38fb8f7374108162e19db401f6393920635b39ba2b530f561f822f2547674820c01a7909a5847763ba9
-
Filesize
68B
MD5050ecc9f11a4050b26794d287815535d
SHA1551041a1600fedd2fca066dfd4267cef3af62f83
SHA256f4ff60863c0a7360d9808f1e86dabf59701957a8df0c12010a2282bee92f65c1
SHA5128d79a0037339e60d80750ab1cd0c579ae94b7cf5c4e427107a843a6e4997042e7e554c7f08d2834c117110aa8eccdd54ff446821eccf0ed408d0f0868c8b4160
-
Filesize
214B
MD57824d11d76253182a4c8968aa0141e34
SHA1bc5884556c6b169f40743c5ab00a7fc2338fe484
SHA256703fa33d6e673eca8cba8e7d79bfef316c34b65297bef281f154c9e46b1355e3
SHA51273cd30e57d1b3332cc55b12bebcd87d0fd1247d14cecc10dc452bb568b72ec4ad7bae185ea7107b759754004bc257c1642a1d0a6689fb5d4aca69470b7f84c0f
-
Filesize
54B
MD5bb955112c1cef2460b0913123b9476d5
SHA1c4a97000f64bf0b0e1a83570f80265b652a74d2e
SHA256d363e60b1d2cf72992274ade593de225017bd9cceda3f39c158a82862a2fd55e
SHA5123026bfabc66e9c0a6f69b8103627b964c27ae2ecf28f98494c1d48520cd43c44d3e36c53ab06dc998f1aa0216395bb14a0d6916899ccaa778c9bd0ef526fa486
-
Filesize
68B
MD58852d043b473affe59f4e3bb9d44a8c6
SHA139e910020b3d1f0b1463bd79f2c0766ddbcc3340
SHA256566837b77c06c7b64d0ae9e8125c47db92e7247798345676b620e7155b496efd
SHA512839c8568968bbc1bc86fcf9de4373bfd498a268d6701ff0d2ffd91500f6d70aa03eb515f2d7531e46ea120b54149d76e744c3bcea16c537939feea6396a370dc
-
Filesize
60B
MD5a5c533e0786090915b28712ec6b9a747
SHA13885629b12330d10448610aeb7584ebd96a81377
SHA2569db3278f0001182c5f01215b42245f22d145225113ea2db5aebc99f95161c8d8
SHA512c30b8c65bc58250b1c93be7a12107d38443cb62dce25c6e5caf6b9ce1cbcbfcac578ecfc2d4d3d1a3bfdf203cde03e6da784a897d5c0cd8b7fcbece2941686b7
-
Filesize
70B
MD56880b7663b7fd9edd620609aca9d48bb
SHA1e1adaa591b44ae12fdac8729177daf75ca27d7fe
SHA256c9b8622876549c1c32f9b9295af0535e23158bfbaa1758924d2632446021a821
SHA5120e431ec29f464e93aa216a80759f07dcb94a2a65e20e8b1633fa8ae429ea3faf27f4966a01fb539463df35560c2be98617fcf65f7f7916f2e170a6846fd884b9
-
Filesize
55B
MD5c62a4e4d1e7410eeb98af65f270b0902
SHA136b56f7b02b082297530d0405c66414cb9b24127
SHA2560eed2b0069852101e1bec30502375b54943ad585d6aecc83fe8bba6dddfdfc65
SHA5126af6a26132fdd6bd902818f7ae4eb87912c20b921d22924e11705488a9b2a8bb6be5a95e563a0cb117ec31f714a039d5ca988d8913ba3790b05937fa50432d56
-
Filesize
45B
MD55799e24eb1cb05e4e3fdf08bcc672272
SHA1b794af25901dad6702e3357bfe0be8a32709d8c5
SHA2565166a98141fd2f64439173da01aec07b35a0c1f5af4fe1add70eec9bf42263aa
SHA51274bebe7fef402d3622c85544a1ef46c569c2e02a461197368d8bf1eb21d9bc7a25ef594cca7a4b41bda9b8afc840f5280d78d00e927de62f6f6525dac2c4986d
-
Filesize
70B
MD5d8ba82a7a9ba4a340007089b9a9c18ef
SHA19fb46c2c940dc9e9dd327a51e4fd99af9853aed0
SHA256f9d4eabd9e3e4a994c4546d4397fb17034c2d4e8186d2969effd14d9c0a6fc55
SHA5121cefb277f0c27ee4e7b613e397bd83f600a1f420dcab412aa0f1c79f76434b6ecdeab25a35a96d869bfdf1c301211a0ddcb9fd92714bbbfc5bc963728899fc57