Analysis
-
max time kernel
148s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
25-12-2024 22:01
General
-
Target
3c180377297fad3c977f9abfdad38ed4618c63e6b03447c9dd0c32a9529c9c24.apk
-
Size
2.7MB
-
MD5
1a53555a07adc8c243b53c54ab583b26
-
SHA1
fc2be55c61c41c2145d54f05ef3b2b9d4bcd506b
-
SHA256
3c180377297fad3c977f9abfdad38ed4618c63e6b03447c9dd0c32a9529c9c24
-
SHA512
ab0c6f06a41560ffde1ec5f68fdfb5c46d440da3aff123c018f556e98ac6af17c38b74762bd7df4ed652b8b398b1a69b18b9df41a64316201d4d66b8d6d72213
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQK:InFjEI4iZaUzYH99yID
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
https://85.31.47.238:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.238:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD56a7946b8ab14f86f52eecc0baf47953b
SHA10a090558810ee524f736a64d8bea7a63c654880f
SHA2563eae36a3b98d08108fa9aca8d060620c6e26107c80680fad561154c1fc1e8203
SHA512012c078bdca80d80cabb2512a6d0ae7683fec83948643c2f9573025db36f8d2b21eafa816f3bebec7ee0ecfbfed9d8b660a3c335b07e64abeeb6cfeb65fe0c69
-
Filesize
45B
MD5acb9f2bb09654134dc8599095b7755af
SHA1921c6c247c8c177e2522694087911418db5715d7
SHA256f71265059ad67ed030a18404934fc6f89bdecde4d5d287cc049031155e801593
SHA5124037eff02600685c72c10d9d58c3d230bfeb947390bd50231de3516e380f7f475106b3e6737065aaaa1b29cb9854402c9705049ab9e70ccd8c28a8caa32107e4
-
Filesize
490B
MD576157b3aed1457667136be6bf55f6f96
SHA131b3a7b7f2704bc422d3dcbe267b2561460ad7e1
SHA256a6db0f56478cb53c5b8c914b4925c90c9153fc915d094b1da47b4f57da2c20c7
SHA5122bb3c451087aa6c4bf06ec5aa8f498c568963274966eead6873e97938cf2d292c72848fa2e06f261bee479a05df699b88d93ff0b9c94433077aa7f2628fc05d5
-
Filesize
68B
MD52f6d9f12802cda83c682e37b4aa57192
SHA1d7b346e17715203fe6173b31dcffe43b69b59800
SHA256e0833a58ec3f796087a06863b25c5a2c1dbaad8deaa9cad73d8a7267a42c819b
SHA5128fff95b032d4c4b2b38e6f5ae492d6d518d7f7eef811ab0fb3ddb9fb624113fde32fa4fdd59d1628aaa0aabdb86d8f5f4de55f69f44d7d0a98a955b5b7cd534a
-
Filesize
52B
MD5b5c67560f37637729946daa02a4524cd
SHA16c5879a480c3e4add8eb6361db7f287fbed7bc9d
SHA256a45c6ecff55a42c383f8a84b62dea30231291fd8f45c0d0ef3c369fd3128b90a
SHA5125f0254b7399f91197fb4eeeb463aa5193da03e99bc81381fec8cd001b0dfdd4e056d2608699e9f8a13c6d433a78e4928ae450433d8efa308653cbd7c1a47c27a
-
Filesize
66B
MD59d6f6c6bcf15ebf8d6c9a1b4e25c63e4
SHA1f87c29720d93e3b31e8db23280e32930b7d8d3df
SHA256242e8e5d69f6f009878db23ce892e2aae5eb5d9346dc3e8a1c3e3b6b0cabde36
SHA51220db69afd851e93ef93614a8030f6e845e640cd0448e3de304bb41e09ad3b4e8e9dcc5e0fe0c1ac9e5b6981fca418c80901d710879781c3d90ca019bd52f990c
-
Filesize
84B
MD5724758dda97de903b98f5214f4cd6dd6
SHA15125a61d56024dd7c83463e62d5bfe83e83a67c4
SHA256e47161d67ca948a5747a70034df66f21f995c456a975739cfcf3548d8845015a
SHA5128c687184d41eadfefe17d0c00a07e84950120c222cf0d26cc197aff9f6308c33d758368a3c85372de86c784d0c0c7ca73f5d6ccf444573abdc9770633c3e75e1
-
Filesize
68B
MD54233a1d97eeb39317dd6784b09a0051b
SHA118198faafa1a57d8c0e77884002f9408a93544c2
SHA25698e9d320499073c842f15f28a9d2b3db22e2a26bd30194fea717419916f5d0c8
SHA5124a8e0639abdbb674fc1aca2242ab35c5a049f4634f8a77b3f9c7e0fa7b44e81576514366ab17656536dbf532c5c630d4fb3ac3ff423976d59f3bde57d0ac51f2
-
Filesize
214B
MD51f69499c2a323f68f99d889b6fba3fa0
SHA1646090e62b494d2b6b464e472bca947071635f45
SHA256a65dd7ca091d67e9882ee635505cbe77362fb1fbb02f7ede43f7a44d4abee4eb
SHA5124008472cfbd6a85d542033ab3789894af1a70ef510bd33071127d75be0d321792327bf59bfe77e421695edd15c909f48514926c4e95aef4d9115fa4464f9ab30
-
Filesize
61B
MD581541845b6f707b87a2e31c6468199a6
SHA1fcfc0ac733bc0ea33e86644d5fd1380de57160f9
SHA2567c19e9c205c39d03426b36c1bd4fdab1f6e58b871a71833c4b35a6c21868ea04
SHA512e2786bd09d98990be9a54ba12356a3fea09bc62b54b0e35039f1a481404995ac29340596b22045ef652b3d81276bbb87a6c78c00822c8edcc66390bd61834b2d
-
Filesize
68B
MD52a352078de15ebb3dd09f2e4ee233047
SHA16a97e159a2633560521f74a2d8cfb081cbda7cc8
SHA256855ea91c9ea65091e94819445c29a5d256a6504a5f9ded779e1cec87a0564baa
SHA51267f8e85b7c9bb83b021af605b902955e6950492e475082ee5e1c4e766600337639738e1d06e1d977ac1dd6749dcc28ee616d7dec8615f8a23aacd3873a5f67b8
-
Filesize
60B
MD51db2fc702df8acd76031c2fe7e63e6a0
SHA15ce8351b533804ef4a83611fcc1b4f8e02bc1f41
SHA256452c36826403f222a608e0403e5aa1db30378592aac37d83ad60563d7282809c
SHA512514204016bd93368abd1172e2650f6d02acf6df0e7100e4781cf36526ab0ab44e607129bb939d9d01e98a472ae59068dda98bbed8d9f48684a65654890341eff
-
Filesize
52B
MD54744d19d7db0c0c9d3ea8de14ae13148
SHA149a889a7a8b79f8b2c4a46333a70b8ad0e40e946
SHA2563fc62e725070754d7efc18d5c966b8b0cd3a3820641d873a5e061ce25230782d
SHA512fa971e015f390b04d8054507ce62dec44508dea7ec24d18713402de7aa18f63ff2594dda3b35dcf1f8d5cfe4ba26881775f2887b7f6146cfa86dec2d043e5398
-
Filesize
70B
MD59d1f18a751a2554252ab4b0a4bc39205
SHA15b3d94fc06ce120b6a566ae8066401dcba4d59b3
SHA256af578400b6e3e27afc2891d9c338ece481aea397a09f92a718fc04c01838c24e
SHA5127efcad2314f223a7b1820920db507111f4707b03867d83ac90e9f5c4f0738a6afb566b989742b5bc6bb2b130aa31ec1fc70defb9fde3085f3b244cbd1c7aefc0
-
Filesize
55B
MD50efd8a48c2f5e7f4162c3d05d32d3565
SHA18320b57ba8f17854ba1c61e019b098028ca40dc8
SHA25680f250ab89f3da28c17865ef058a0dd380509511e8e2952767c3e52d600a5be4
SHA512110afc19bd20dce4b7bac7a2d4d20d9e49bfd407457bdff5de49785e3a0c8895c692e7eb0447249104ce68dcfa2b8d6ea07136741a08a1cd550c3a458be4b74f
-
Filesize
45B
MD5331525a145c3bef91fba02a434a468a2
SHA12d525fd71b3b09fa1504b2fadc65bbb25b6822de
SHA256a89c0b92508e742dac03b306cd7d0ca3b12e10018de5c9a37d1a9bc4e123d71c
SHA512afd1ae4989e80099f303460e003cfe8e83fdd335029aa5d6ade9574c7a4886623a210233b9978a67b564263ec8a3aee36631aca7ce652864f09dbebcab83f863