Analysis
-
max time kernel
149s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-01-2025 22:01
General
-
Target
a5ff5a2219b48af8f58bb8606382df8586f4288b33d67ebc2baf49bfbc485610.apk
-
Size
2.7MB
-
MD5
573c9f2c3739d4dbf3af8ec651f23814
-
SHA1
d4a48b94f1995072709b140029275a5f57810a5c
-
SHA256
a5ff5a2219b48af8f58bb8606382df8586f4288b33d67ebc2baf49bfbc485610
-
SHA512
80d7fc3134c3e0b4b62a96c134010c344d8fe303274c66dab072e7f9a3ebafda265471122bffc01248f589f486ec04b722061f99ddf29b7a76930c963a1b63fc
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQG:vhyb0FjEI4iZaUzYH99yIJ
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD533775de4433e2c0b719fb00bc6fa0302
SHA142084f12836d560f25d1473472240ebffb93c4b8
SHA256e90353f9dc225c8a8d0406cb1412493a49187f95152e21e5c3bde6666088bbf0
SHA512ae097037105568e78e9016dec8261eeffa6a9fc2d6965a9b17f362a463707208b5dd1e94872edf68a4269501145f58591a4d7fcb96df44b6bbcf321276e44667
-
Filesize
66B
MD53bddab3a9252ecad6823d4d21351768e
SHA10a10a8529002eaaad493053da8b8c2990e7ce265
SHA25659412cc343a817344de8927e2de3190ffe9b5ed8faf73dbfac5364df91b7c32b
SHA5120e174e8ca3f870c9ba13f298917e374920c2394a10cc6ba1d652c93e489e128b59353caa8196685b48bf379ade3f6e27219e14c355d0e5cb346773c36efee19a
-
Filesize
84B
MD55f3ee9e5fddd8e683c98f0853a8b74e8
SHA1dd9f1f817e7408ea75a1a689f5947e9a03d6b104
SHA256de5be084df57dac06294d14ee0bce33363e90fb1db3df2716651abbf495e1455
SHA5126f12048b11cf44f75a473ec98ae4c4dae19f8c1e497e705209d3ad785e92e913b0a5da6e3cad619e96884ff2f3ac639fe1c4d7b245870a26085ae5e134887f07
-
Filesize
63B
MD504b08af719cbd49e37e901d5092e6022
SHA1254ed515fba2393062e11f06ff90b5c595b16c3b
SHA256053657373ce56eb26315ab4c3fb3352783a4511ddf3d3ebee1d3bf4335971735
SHA512d71d5baff9fbc9d0bf180d52c58865e7bf668927e2c0e1c45d9f38684baca10e52c72628d86edddd3c055835f4ea942981da8dc8e658bcd5153896a51c104665
-
Filesize
58B
MD55446f5e3fa3564f883e39369caf96dfd
SHA16917d31c5b24bc1d0e11cea868647087c193500d
SHA256c101032ac4f982960ae27d91209e0f78e5dc510148d90d05de7988d0a6e0d280
SHA512d4ffa864f8a556297bb300ea300b809af590d71de0a54b2cc96181d8c2c665386af52be081144ec9ecbd4d35888ddc55d2cf74287121451f12ccb9662c5b518b
-
Filesize
230B
MD50f92d19f528ab42212110531f6d171c1
SHA1b1e2b50daf8e317fd9af0acaa6be74e7bbf4a7d4
SHA256b6683812975d4862ff61902ba7cc8f150f5aab42a28fd54b418a7214abef339e
SHA512ba7c2a80403467ec917d9528152164a3b4ac2b4e22ec5fa24b8aa599a9cee76fbc0b8f4042d12da79f02f88f2ff55aced4af87edf48c4143c317b0af71d1afbd
-
Filesize
63B
MD518f8071f7d0a86023530e9ed8e42e0db
SHA1dc49a65ac72fb3d0cdc39a25f85472ce65c462f9
SHA2565c2f986933faec284bdaa028933ebc2fdbfa9de7e263997036342571e1d7d749
SHA512d2d6426822023565e3ef9fbf8a95d9dcd63f5655d1ca5894c25b3b7ebae43812159bab6305c3ae2d33cf6034fd78579252c412cda723b3ed499fed13d11c94a0
-
Filesize
68B
MD5613f1558239efc746f7614b47ae541b5
SHA19d2f00486ef157f6caf9e221438b2c4a0981d94a
SHA25682cd0e685385195a8cebb2e7d9dc6f9a1ae74593b9e75bcdf04310138c67a522
SHA512abb05aeac4e66361b106954f7a2715642274fcc3a55886ec07a1df3e1f431fe4fa9843b463eead1231f3a82dab339e00319e52df6ecaba1e65b4b8869ebff61c
-
Filesize
45B
MD539c400feaed1c24a887e07ae02b10439
SHA1156fc3a5bddc37f9c8b10e9f8d6ed433df818e25
SHA2560d61e1c3be8017eae68dc721bebba51e62f5a0bcd6ca9293f707f11ca3f8eadf
SHA5122a930953a0e0e74bfc18f87db1c5ea82d2b18c7e64d4e33fb228c966d9a33b8f9fa10cbf84302418ad16081a66096891ed9ad9bdf30b3b487aa13f5f8c58d87c
-
Filesize
466B
MD5d1ada498b99908070e1484090ed4b6fe
SHA1ea6ea67e6ee298cf27d94619d177c892fc750ece
SHA2569a6849488d8cc3766d8cfab7c96f9e751b31c35b9ea6f760b50c050c9d0dfbcf
SHA5126d645b36e107b37a736cc2f57565c12eb92dfe8e91569da43c4cc2fa5a168af9e3607f3776168177302d5a35c3beb6aad395e7ce8c6f22836885f4f89d470a4a
-
Filesize
63B
MD57bfa766419c2c975b40e23383d06d95e
SHA11c80778489e8830f1aecc8bea821d7337bf0bf4e
SHA2565be9ff7cb543e07ffc3ef379bdc42079cec2d3dd98e8ec78d6effbed8eb8cfe1
SHA51287787f3feda1a2658ef73e7601525fdb5385ec8cb550b9811018a2efdf16732f00015af0562bffe0232d66d46947c20cb05ac1cb851f770cdc6b6b018870354c
-
Filesize
58B
MD5ec4ccb9a524db4bcf02be20469d47e46
SHA1cb3ee9efc995e83e4a12f6f4a9a8a5ccf9861f24
SHA256c4b041ad7b48848afd96cb22b614a70be3200386d7cc212241f1677d737ee5eb
SHA51266e452f3957a7caed3684c564ffed6a6f7283d51014b432ce79cd99fe98e465169c0ace3609e923eefb9f63d84a6621102a38fb423691b70623327b35692e3fa