Analysis
-
max time kernel
148s -
max time network
146s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
26-12-2024 22:04
General
-
Target
1b6e0ecfd44151ce606126426fb6d6df463d9e349a2fd460f0ffa06928314052.apk
-
Size
2.7MB
-
MD5
2109f509e93c5e70344d3774ad9ebc60
-
SHA1
317009ab2037165d670cc4cf7869d821c4d3fe26
-
SHA256
1b6e0ecfd44151ce606126426fb6d6df463d9e349a2fd460f0ffa06928314052
-
SHA512
b21359dcd60f5f0bc7d6896efcd379c5d98aaa39da76a4d4db3f47731a7b520220dca8f7d44a40ae39089f807cb7643be9a643597a3e4ecd0574be8f9526e5f8
-
SSDEEP
49152:ZYoQrw6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ/:6oQrwFjEI4iZaUzYH99yIo
Malware Config
Extracted
octo
https://93.123.109.166:7117/gate/
https://93.123.109.166:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://93.123.109.166:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD5029fae9924b4a7e9549e96f62b587781
SHA10420acec61caaf98663cd83f4ee61c983735b262
SHA256d47c5b6deb5e476cff06a7c96e4ffea03881fbfa0ca17629227b61d5149ebf2b
SHA512b127b9bf45a1be2a7dc5960a2a6f52bed7ee4fbb141abba5607e023349230ab9b476a2648172262aeac32548feac47b8faf50ed7d19bc5e90c8fc7bc044daa84
-
Filesize
68B
MD539c272eb5ebdce49fc04962cd44db9a5
SHA123ceed1e3b576a8efe93236c61637100f23410d8
SHA2569ad4e1e5236a2fe85a73e4dde5fc6a4ffea1c5ae60d207a440201c56970918aa
SHA512d92f52e3bfa5cc09e7c11d3662abea999c0397d4758f13b79084a315a38b924990b003fb989a25cb54ab47fa4460be4dcb1660cd9b673f72a9e83948b6b03694
-
Filesize
60B
MD5cdfb2f3955060dc42a98cc0c7bb44059
SHA126b2c8ef6a519e3a7dbed50ddecbb614e9e50dd0
SHA2569d488250ec20538970345a3a8ca35ecef9a935054d3d10d95a219d3f4e8d766e
SHA512017961442552771aee59b45e86b52aa78485b644d2bc600750847f758dde0e9e034b35a5679dd6be81bacf1eff835f53169981f97504297c30ddd5200178876d
-
Filesize
70B
MD53927ef96da932f45e8aef607aae4a015
SHA16f5c067b8dd1402b4996fbc80ecdf87289cdb255
SHA25681e68071505392721de034d13c1b749ea3b552f3b2b1968de2761734c9b4b079
SHA5126bad755f31fb6309067922f49f985a818ae5baaf35b73c2645cd980b960d90bb11a0c5f726ea9e662d89dc56032dedffffda0cde3b02b72932ffb1e3a8f537df
-
Filesize
214B
MD59e513d279e5bd5e61dbd9225dd01a9c4
SHA160c7066c12a3a8a9ec486e98a473ecd92aa5e6db
SHA256a497f99d2f3c0933f0d25922aefdbadfb7d45a3c373d07ae2c518e373dbf7b2b
SHA5128eaca85928a1cf0d20ec05a2f3e336325ddf214dcae08cbe8e15e982ed5cd106a1a4cdfec95246fd8c7618839a4c9ae10dd225cc834b705ee4937b0eb50b6567
-
Filesize
214B
MD512b3c824f0f7bc527fadeb4672881b82
SHA16ab99c3585be01f41725316527a3b246e3f7b074
SHA256f6b5631e3de213f67d84cbd80e7fe0b9c92952fb6502d88b066808b438199398
SHA512ac375f5b54bdb836e85e3a6fde3fa6ec0e8f0d599456b2dee470ba831b400b9547035a411e4928082dd10802a758315113df6064d4c33075e2a464356386d35f
-
Filesize
52B
MD56af062cc3955aaae2851fe62a7b9f9b4
SHA1fe41338259bac3faa9842a873fe3392913b56404
SHA25618d766fbb5d979686d0fca01beda8d9f1ff78a819ffaacbf44cac82f7c310685
SHA5124c2914d26c7742722c991c9b682582941b4109b60890d84d56dc0f801f5d8f77941c305908516a3d47beb1f753d0ebe3b149a5df21c4c09985dd25276c81f1a1
-
Filesize
70B
MD5bd75f2ad22f0ebd7ec39730099a0dc01
SHA1c35f098c793fcb500bb1ab9f3a8019afcfbf13de
SHA2565f83789c2722d6d3dbadb970539e6dd41e17ed1de04a14d0d9272e2561b7f188
SHA5128c84ddd2ca5f74218ca223174703ca10fb2930f68463a318a458424291042d9617eb36de7b1bff3c5930de993e11cbd62b4eb7f9910c89520ae21c4a27e5cb2a
-
Filesize
55B
MD534f6ff773b8683a91e03ac5d72295c6c
SHA1d1c7de09816c5bf180329696f71c870ecabf9732
SHA256179788620990c1932e20eda4edcf04ec078ea2985cf37f9a35d9ef1f98ba7388
SHA5124eef6f3ec57ec903753a5badc2ebf45c8ec252ca4047de6be26b20ecde2a3c7e337a5d98e6cf0784ee2fc3abbd6ba9857b6c3d6ba7732462217a9632a5dbf0b7
-
Filesize
70B
MD59a2ec7e498fdbd57f6334b8f2e392cac
SHA14f456a667ad7c3326e0ea33681f468b21a8fe24a
SHA2568a168ce6a8787db678837ebaf8fd3bbbfe501ff0687e8ee2ecdd08c6e056cd34
SHA51268a2c418e957800fa964cf9d99356b867e60f2110464784ec96851d2e49bdbfc712088e7918bb35dbfad3ad0eaa76bf13a244dd64567d5aaa2356479369842d6
-
Filesize
79B
MD5be00982b74bbaff2c179276a7cb004f6
SHA14270d82f4300670c6d102d93b254f6b187812b3f
SHA256c57169618d62b7fb1a06849d195a85ad6372965fdaedf7f741277bfe8e9b5cd7
SHA5124365b2c98431b939f7f400e20cad849a7de5147b4d3d5a09af51feae9898ba5f67a3abe147f43414f528d801d3f98fc45896adde85acab95c6100dcc851eec39
-
Filesize
490B
MD52ca231ae99d3d0cd6a0933f1f1e75641
SHA1da38a4bc2c8a07509b853ce4b344f5ae7659d7fc
SHA256fb737e6a693f7543abb96dc66c07fd50f84361b179b80ecbb1c58669bf538bab
SHA512fa2a35bd1475678fad436c822973895169a5d972617e74f973d1374b2a2508196fcdddeae595bbb9637099950040896547db93e801374cf22325c73d430299dd
-
Filesize
70B
MD5738c81ed9e59cf0eb0714b7159d3f19a
SHA195a855e9277e731a1c92b2390705aaa0c1b0c564
SHA256089c64857a6a924c65586eac971699c3e16f3cae5569daa9e9ad1d5f95413af9
SHA5128f29bf82a2727b5fbad67525225cfca72b050c6b3c3c8057fd2fb813aa6cf51b6f027f040f3be2dc21a290279d8a6e69f3de1da2990e62e785339546e7bb79e0