Analysis
-
max time kernel
148s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
03-01-2025 22:01
General
-
Target
7e1cbc2d86a67027dcf4803eb72da17a106a91c38e7f2b43685d3ffa764d9c18.apk
-
Size
2.7MB
-
MD5
6e7267423fb80575774fd1ea6b46f398
-
SHA1
2f16445d8ad9ebe4fd25bfb5aebe528112f9eb8d
-
SHA256
7e1cbc2d86a67027dcf4803eb72da17a106a91c38e7f2b43685d3ffa764d9c18
-
SHA512
a1d93ac2920389dbe534ed12ff24fb1aa6f7486b638534b0fd1e0ece02b8a0379067a17dba1a3cfb6a3a4953b254e343345acbe6bfe039a5321bf1873c87e270
-
SSDEEP
49152:I//6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQW:InFjEI4iZaUzYH99yIz
Malware Config
Extracted
octo
https://85.31.47.238:7117/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD559f3fa9a97d65f3f805efa3982691d70
SHA16dbda903f81aa899f300fb108ea3db32d18e6e16
SHA256a7fc9605453902aee59d91cdffe9195c4c0c072492487ac4c4412136353024c8
SHA512c62039f1dc50948b7d06ed8c01ebdfcf8f983b01211160e715faa568df873195b11b1395d4c0ce7a8d8b1141c87e034932d00cd4a56b7ef0a5bc940093468ca8
-
Filesize
490B
MD51da596d889da20fd8660a180572449e0
SHA1a1c2afe2dc220eeb0ad31f06b5ad4e7e51805912
SHA2566df0b73c91947f7712c037471bdc7d7d0ff81eec0d5fd41bd3ceff32dbab78a5
SHA512992863bad36a86fb1fbbe43c6fa1e74f56d1b7706241c92890574c73560a42418546d64674565aeb53163fae162332f13559d26c013523a1af9e2391b1c43827
-
Filesize
70B
MD5018c923f2bf264867bb51d3af06b926a
SHA17a55cece1ed1681451470ffcb1f1c52a447838bb
SHA256cefbac27508468bf1c91cf1b6ed576d1948b3d133f6a29df1b5ec3011c31670c
SHA5123faebd99424c9393fe1a84a31b16396926a3d102f0d36640767c942fa98e9d9f5f7de3d10727f2b49ddfae4c5f79ddf219d40ec4b177f355a24cd1917ad42a32
-
Filesize
70B
MD5365e7c2d349182c559aae68a3056f238
SHA13481e25436146e6c601db0ecd6679bdbbc4cbb7f
SHA25632e32166363968c11c25b5063e458ed5da69479e4d8d77efaa1522e123fb4f0b
SHA51222fd5503411aabaaadb56e2b32845c7d03f42748c7d5586dc23a63b4237ac76a9e9f69f4ab10008849c614981e6d0aa10c24a7973250269cd18a6de83d616e58
-
Filesize
68B
MD5b8e1ac348980868570cfffb93a70fbc6
SHA18ea3947c75dcbdb11b4a1c512eb283f75c470fc8
SHA256bc26f1d63f0928a035789c40a1a88dccb3013bba7da8da93e96f329d0c5e33f3
SHA512274194f25439adcca2c718869132f05b9aeec9d57dd0580c1f7753653d0e13172798285d849dc02a3a3b3933de518375a91ebf2c0deca599d9c4df645284be99
-
Filesize
84B
MD5b453ff023c5bb6db73d22a3a3db7d6fd
SHA1cc0b5b2947d224ef281ed0a805defc8c800a57af
SHA256d1716a11629556ddd7eeab0bfec49df6c2463e58ac6ca96fec476a032c4fa8b7
SHA5127bca21601668895f97caa9fbaa012f7bf1ee86d65cdd8da7fd50f860e2f4aad5d496b8040d690665a41a0a755a2c9224a0f25b3f98e6fd0070ab61cf50d776f2
-
Filesize
54B
MD58619c9a88db620cd5a5addd58c4a7618
SHA15b0e622363f7ae18e0e5c42f79f9eeea4c6e9cea
SHA2569e739a736d473777507deafce17520fdccd581229c4965d9570b29ffd9bf6fd8
SHA5129299f19e694226af422faa172463e0fbc9ba717c40eab2cd30c6aacff727357920ad4de268d52f24290241fa2705869df24f81420c45facf0c926e7fcca3d2a4
-
Filesize
68B
MD5d7c07692fb01c26bd4d863bed7b91d68
SHA11e4823171ed81f098cd9bc202752ab4c7d88410b
SHA2569295d68b9e874ee3dfc70034d220dad124bb29cbfbb17431a79269086e48ead7
SHA51230586b20c4a3dd754bdb5b0e7eff41d8d66e64a2b3744c70ce978b193b783d6489de307c9ce76829b31c6fb472c034078ca10e190d1782ea3d06d3997473d83f
-
Filesize
60B
MD59ad20022a36a23a8403a311c877f1519
SHA15848c8d26ca7a4684c8655ef2a0b3400233cae02
SHA256dc32d17d43812686419fc68f9221a8f0f0f88fb9a80f08f766c5b6044166e39a
SHA512826fd45f3f1e5a3375bf0592c4778dd0d223a2059e7ead1b06a5607b477b6d56de76cdf7917be55a52c34e9202f7c000073d901e47cdf306e2746ecccd20935d
-
Filesize
52B
MD5d24bc7ee0daa553995e0be84304fd804
SHA1ea6a0bccb4e5856cab7449ba9e10ec618f031b5c
SHA2568120b73c881e5ca473a5d9015faf71170ee2f8ff1444940b97597fbaf02cb0b7
SHA5120dcbd73761dd3908ebefecccbd49203630340cc73a0fc5b11da74b91dfa2a9cddc68fd86e62c5322461b7733de9eb6206d556630aec9555b08c6795d99d7b504
-
Filesize
70B
MD5215f0cc1605da2ee849f2eac3d4d6b80
SHA11a08d9d6dbc9742fe29efa68466a05a183f5727a
SHA256be80a521f83e7f1d580993ca9d94c67364addbc26b01876c5549a1c04dcbe595
SHA512e70a0a9f956ffc50061b970822a8c46f5c372f2ebc6a3ae94f6e0220eed50815ac8b421339126f6ec9cd958bb70313ed1d5a84f18bf409430696caf3d637dab0
-
Filesize
55B
MD5f90c4ce7dbf3fa2e03cb1c33e0472d6b
SHA14c9faac94cb614afa13a76bf1cf633571d5688e5
SHA2561e9d140295eb7ab6230aa98a23dfe8a6087a29948e0d8b5db837b10fd28477bf
SHA51223dff4b487acdf54dec3addf9348cb4d4f6eda427b088da30cfef630dd0569523e6ca6ee8d22bb03fbb2ef1a5b9f3e88cbbb9c191768a9ad895a0b6ec49654f1
-
Filesize
45B
MD53497ee7e255e0f208c657881f72d8e3f
SHA16d6147d87cf46eac70f374a54ee35b3dafea5d78
SHA256e43fc37c0e55cb463a1ddea951bfbf02debab65abe5b91e6e871a08b7cd61c79
SHA51200ab7fee7d5982c8765dd95c06eb589e0a807e7476d685417f6c10048a49b80fa4e5bfe3894134fbc39d6d6b16eaa550f4c743d6aa17d2a63cfffa141621b62b
-
Filesize
70B
MD5e6770bb7cd2008e7a4f076d3c0c84e9f
SHA19acb738a814b704d1fa105d03738d31492d558ec
SHA256ad3d5745da92c510a88ed30fb59242e6a3b8ed203c11574f2857c6bce60d081f
SHA5127d15e932aeda64b9154b5dc1fe4e72d77d43bdc97da101213372c68bb54cd2df82c87f53740c1be770a5f66433a9e2925a0ffdd6ddda366ca770ab8e74426822