Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
05-01-2025 22:04
General
-
Target
5604e4d9956184aab24fdfa68ba09c271a26585dcecc5b56e39972ba703e5abc.apk
-
Size
2.7MB
-
MD5
f36d93a78091aecf4e79253b48e3b462
-
SHA1
231176a83db0fc0c3721333f08be0bfdaebdecc7
-
SHA256
5604e4d9956184aab24fdfa68ba09c271a26585dcecc5b56e39972ba703e5abc
-
SHA512
88b136d6feb11e46aca4ad2d8143f6231d50b3c4da4f1216094bcce98f49f9d769dd88b1c0694021c5838bdbc095daadbeb316cc4e42e92e6d95c2b61bc353cc
-
SSDEEP
49152:KFmU6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQT:KFmUFjEI4iZaUzYH99yIu
Malware Config
Extracted
octo
https://87.121.86.196:7117/gate/
https://87.121.86.196:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://87.121.86.196:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
55B
MD5fe6b3c98e6071b88b832ec7584124a21
SHA1a1b33de4d0d45b051a60f264a66c95f1d9f2f8a7
SHA2565f16033514a22bdbcc4574b4eb636dd4148d8255fad402c2ff5d3a1bb8edf7dc
SHA5123447106e782e96ce89cbd9e3cd3eff506be1de9bb18b43f9cdcf1b37c6c42c70724f0549a2a2ca77c7469d2e0465ec0928b3240d1d63330361c599b5f8453e8f
-
Filesize
45B
MD5284fcaff40b9b01f486352cf7798c825
SHA1d26642e82915d68c66ae39acd3a06ea5dad9634e
SHA256888a62909360f244d4bfc030bc9a3b980df4565a9c7cfec80fb0c31229580262
SHA512ffc90b5421bf7137022ca419cf078a676fbdadbc436c220eac4039cdc06e66de6a759db57e4d7ab3a6ac21f5dc84fc4d3da3dd9bd0e955203e3d08a863700129
-
Filesize
490B
MD5e4363cecbb49562f005d0c68e377b1fc
SHA1b9b7708cd6b9a960b14bf36b0a0756f8bd4344aa
SHA2564c88f142a8f74a66b291f9b4e0ce936ccad7d6a6bd5350527eda560394dcc899
SHA5124d38a26390e38ad1d034b84a5332083c7b72b38b8d23b7cff88281ba3fbaa7fc9eeeffcb8cc534e0602fd2ce47d39ccd7ad682624fcb6ca92b9f1d490a08999e
-
Filesize
214B
MD513b2a4e0098cf908b149f0f0f65c3835
SHA1fd0fed3535a5a94fe129f5d5e54578ade3436914
SHA2569d5fb4ba7ec864147136cf51232b61df51e1090209424f870ddd56a50c30a55a
SHA5126f3715e6d292100b69b4bdb9f61eb270416259456a4c5fab4df7d9c128cded93db9755e6fc3cb8afa0af45ce270e678188683620631303d80ae984862b944fb8
-
Filesize
54B
MD5bed0505a453c04dd4757648409b5902b
SHA119a8ab403a71990fa86bc7403d579faf14e5fef4
SHA25643049a07b4ae38bf97d5e68b49f94a4d1955358b2e984674feef4f5648b20358
SHA5124779fb2ec4255fc4d6140e2d671d89f88901c6c22568c0073ef746b1b0fcc30e4a75aa9ee4e8fdfeb43544a42dd53d679719b15a81051f7103e4542c854afa79
-
Filesize
68B
MD54c6c81878e53a97726bcdeece86aff41
SHA15bf6b1dffc9e6eb3ac80ed5114b3c00768aea0cd
SHA256bdc981d6ca6f14419b13be72bec516ebdc6cd5358c806d0afc5242379ad79c54
SHA512c9de45731204037e914236422f374fa168257ece6329b552d3a4ff4ceb13c3bcc85a7c5824b54366980bcea1e7b984b48ab9d0ca9b8b6e5e32e31bf04913696f
-
Filesize
60B
MD516b2a9baf026707a8f28ff8e11013284
SHA19d4dadc9118fc9cd1e7f3b250a5473e9dea020a2
SHA256b7bf25d0ff620350fc5968054517cd134908b339f5d0f51f7127fb966b75f259
SHA512ba310870d8a30ed00b9559cbf34e6f81772874df05e561b9154360069403af0a1e8428222caab95a8785dabb32b823e3f25a395d8dcf58df1823418eb44148b6
-
Filesize
84B
MD50afdd9a925fc44a63c3c1d54e9ef4f02
SHA10025deef4e8b8696dc1500bcd94445ce9b66b26f
SHA256982b59e57fd5d0687c93a41e66fcd4f16466609826ae6895736ec604aa3e7598
SHA512f9b528806f320d33127f2cc17f179ddba86553c0659e9f18d7626becc2683a1ba432adf70a26d6b07ad0ee44fdc289e3e64a523f316eb77823a0b91dd801e1b1
-
Filesize
60B
MD553f0ccd2710b66fec8f6187ca86acb8f
SHA19ea67b1c4e4498162ef7b5557a874187a589b165
SHA2560eb0647f90354a9f58679d1d6f78e9f59f9143ed66c09bbbce84b5605ef11c79
SHA512714611dcb88c2e66cb07a13248cdb916fe87c839146f1998009e21fc23eecdba3bde3888d08b05ab4dc24a28b37dac4a4abc6897179171eca7a808b7386d568e
-
Filesize
52B
MD5e2f7be1f108e13062ee1a31f0bd5c603
SHA10f3df3198de354def08b560e96b0e61e68ee06db
SHA256f3a17189afb35bb5990b503577c22e958d4959fcddfa89960953e63398756d51
SHA5127ef2af606bff96c59fe5b1ff6d581fdb4e76388dc0a1a93f3883a58b6c9323677bce5a48bceb5351f2238dd22596f46150ea65fa8a4850767fcdf0468f597d29
-
Filesize
70B
MD53dcd464042ea0402f7f47295ab76dba0
SHA1f03a8fbce4049907906b4286622f6905422f0e2d
SHA25643e5b27d0ed82152d8501205da91dceefd558ac38792854f70ae4779d81e29d9
SHA512c6485ca401076efd7e1e418669cca67fa0e48daf29f603647dc6ec29872f2a48d3defd93a4aebba267ccbb79f3ce49f5aa865c252d55f9337773bc6cc77a52a5