Analysis
-
max time kernel
149s -
max time network
145s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
26-12-2024 22:08
General
-
Target
ac6025f59e0c6ed6759b6a35a637dbe985c6c4bd8d9ee8c0416580a9d0acbd11.apk
-
Size
2.7MB
-
MD5
28f575297994b2a79d60b29515a8a36b
-
SHA1
a38d3566bc0f42a3afab069510360e20d882e9b3
-
SHA256
ac6025f59e0c6ed6759b6a35a637dbe985c6c4bd8d9ee8c0416580a9d0acbd11
-
SHA512
93d0b0d6e0916adf2824e54e201b7d0399f308e4c4e1cdc8349cf13a51f96893e5beb681c399c4985ec9c7066b5226aa0e8e48f78935b3d0f9135704deff6200
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQv:6oQrwFjEI4iZaUzYH99yIA
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5a425f9f3bf4134ac6bf11431763c2c98
SHA18aeb2e97377be4c8f3d0397b4e3e4bb9e3b9a192
SHA2565dfe00f6480c2e486b6bb33e291ed83199149bad52bffe2e9e3000ce3c15de2f
SHA51203a23dcdeb6285fc4885913caed066317c38c2ec64411bd6c7bc4fb56c15484a565aca7be92a9a0ad3e3a3d279495287236eaee082cc98a352715c501f7cc0bd
-
Filesize
66B
MD50742af71fc804427b86a9e8aeecc63f0
SHA144615aef10a34cd161ea9ed31766729f2db130c0
SHA25655cf8d32ef03c4eec4c2c515c16e0a1cef392f0fa72db20a222c43dfb95d8b1d
SHA512bbdc9acbcd90397d549c997c30e50068613e2db68dc88ffd83095086908c527930256ec9217cceea141d5b4236f55f9ee80f0887565db66bb14ab7d28ea6a629
-
Filesize
84B
MD5dd1df73626c71c0a9fb3b5dc42aeb6d0
SHA11e11a3fe59554d0033468ae701c19042fa4cc70d
SHA256196b1045c4e3cd08abcfbed57d0e83da283a0b7e98b7acf3ed6a2ba99c232f76
SHA512d29d534d4848f4d0d0772c92d9c7cf71994baa84ba45d6c993ec853ce337c23c13ce90d7112de94db5cc56bba49afc0e78bd5517b97f4cb57adf9a14a903a69a
-
Filesize
63B
MD5c23cb191cef793147ea3a1d57cd27268
SHA1c1bcda8258365e30d5ae3ab40b0ec224e4c16238
SHA256041cae7f301e6d5fcdeeff00cfb3a869cecd5d9afbdf0107b85912d67ef8f2e4
SHA512e466e6efc34f641a59b6c4280aa24855a4abab1a393ae721124080307bb0872f62ab881fd67f29432a3d39dbb97edb2b7dbbcb9e62cd2ae07704e49de56f9050
-
Filesize
58B
MD5f832af7cabcf940088836e80cbca13b1
SHA1d99177f4fef42ba22ab57f1b548d4053c0d4b5af
SHA256d11324ef3627765e249d466c3d10f4315c2970bd9d494d3c1f5e2cdbb09bad9c
SHA512b9cc6b61e035277fad61a4d8697e69003f7b282354d17472e9d4357133b5a17e0ab86fd26abb76017abf826c31e43a1d7a5e636b9e61e385d03233e31f650aff
-
Filesize
230B
MD5e2c70c34a8c835f6b573ee434777c916
SHA1e9c50be29c4df5f0350dbf28ec6a9cb214551349
SHA256aa6f0e9c40f642adbb4038fa83944c11b920b222efe417c47b7125b8c9210ea5
SHA5122a7a7138a67bcfff88f08cd5f234bf3046916284e2b68edcc00e314645473a9a4d853a5cdbbfb0cee0e4806f696e7537a908e5e12f994d9798b4f4361c285bda
-
Filesize
45B
MD51ea284670fc0d48b3d65bae5f63a44f5
SHA1f10c706ca4124b781ebba6bf82d8ae90381612e2
SHA256b1b93b79831182e0d4d4b6e85e44f7cef4cf3b7e505ba2420bc095dfbdce4a32
SHA5127d5ab7b30badfeb991a2de8a6bdb8e40c8ba0601a67af2f7916e2f4e281f0ff092f2b49a53f4a84d84fe08232bc359e1a441240c827b4191922e202745e8446a
-
Filesize
63B
MD566c9c6e854ee49b8527eb09fb96ff84e
SHA1160fe3fba8710110f59ce696906ce8582c1b832b
SHA256960f4a9a1522f3538d0119b33603789f1603012fb852eb20a198a8567dd40597
SHA512f102e7b59523204bfe7acfc9fbbb87d0dc139dec3a88ef1046c919d801dd9a7982a40586e47f58bdccaf5d73484d76525f9c5188a480b229f90c90a80a43383e
-
Filesize
45B
MD54a459f09cb7226abe4cd7bce62861b4f
SHA14e2bdfb4e96491caa18433d4238033e4ea0a495f
SHA2564eca9a57ca10b3bf5f4d268a6aa4fa9d65d587377d027d5e4679c4cdb5f4f159
SHA512d0e1bb6118c2373f788a373d0ab4e7e65f0e88519c16b691a34d40d03a203016c024df5a05a975fb4d0d991aa37e5af2ba85b917f69be5f37836d43629df29a7
-
Filesize
466B
MD5890bb5c1104f294144e3d0ccddb30bc5
SHA1e2eb3fa48b87d2ff809f47e76b3da13dce772b8e
SHA256b2bd6f70eb0864ce3dd24d7ee6c5b9c1bf13595be218b030ef401fbb522f1232
SHA51270fb670deaf3e68da284af23cd0aa7ccdaedf1c78c5ddf51cadc9a44fd84feacd59b2ac08cbccf2999d7c0024e0eb75d12e2367ff8f3e99229a8ea72cf728ee6
-
Filesize
63B
MD5dd7e0238a3063287d78b9f69ad398b72
SHA10970457a2f16fcd10a0c35da981f35714d46ca70
SHA256ad49fb29da36be3b3d85991e0f1397ea9d1f4ffd329cd15f1abcf0842806edc5
SHA512b861f4423df01a5aa39a5c53946f5e6e0fe80094ac6ddadceca0aa059ce0fe887929a1b552f873028dfdd9eda3a0e5c44b57516ab94555ba2137f78f936063dc
-
Filesize
58B
MD5d1376a3a0597ffabcc7d0f17a01fe108
SHA1b99fac7f00b684f68836e6e1681f84c25dcdef67
SHA256f89af65162d9c0d3d19f127595e61c95cd06683c5efe3d4f1891c4da14d32b95
SHA512c064bdef38e383d57422685f05396d0a7ecd199e2b7abbb54979024473c2fdb87c2b6520827dfd3f8728ce5d32f4bd9ccba9d895704eb245594ef9550de0ce14
-
Filesize
63B
MD5f7d100db442a60f37b2a3e3eb90479c1
SHA1d286fb40b1ace9bbd00152053547f4ddeba54c7a
SHA2569bf8f1326af3d01f7dca6e4c2c3804f247f3d0c19fe2a8fbd996f687281d0536
SHA512aaf90febb16c32efe7f8de653b6ec878a5f29835804277eb9a46c00d228777acdbf8d297b05471a70843a87fdd9bc2d14dae886eb7b85853a9f99dd6d75873ef