Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
07-01-2025 22:02
General
-
Target
4d46745d5b664f370b895a0dca2fb28ddc3bce12585acba0fd266a13340cfd38.apk
-
Size
2.7MB
-
MD5
fcee7ba8ec41eb3c0a0eb050fd2863da
-
SHA1
7cac3dee9f26fb235343b061eca90c8d3b1e7aeb
-
SHA256
4d46745d5b664f370b895a0dca2fb28ddc3bce12585acba0fd266a13340cfd38
-
SHA512
ff39303ea170ebc97083c3c13558cac1b2ef94e495b298ba8e8a96ba0144784377a82ea38e1b8d512bb922d7861c38b334e5e2a3135a0eb29ceb5c86f64e937d
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQ0:vhyb0FjEI4iZaUzYH99yID
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
66B
MD503e13bffa93b07d638a6eb6bff095451
SHA15b9d281bc473d08930a3592131628816c2044f5d
SHA25611459bd96d5e18bd517cb8bfce28ce371e883dc2559c308cddc83e6edcf0a98d
SHA512b12175b3fdcb7fe3a8520ff333134fa8a42c6db0075ce86857734c79d61c4e412028fb2c222cf78117bcf044c36db3dc5e20e7c258d40d8a55c35b8e330b076d
-
Filesize
45B
MD51277b9c7aec4983ebaeedb93e8c7947b
SHA1421a5c7d31100a89ac66b8e3efc28df026f70971
SHA256ad045822abcf442f8614392b4bcbd6f535130d0e5476d1e92280ca3410402b0e
SHA5122be12a4fb587837b4e0c498e5d10726cdeb844846e0c075195600a6212aec37f2c5936619df5e9d082c69e0a771edcc3dfaf23539ffd0900c805f60f0b3e695f
-
Filesize
84B
MD51e36402b203c5c888f43b267ad2e6db2
SHA130f7cea8496579867b8d783ffbaa72229c67aafc
SHA256390a190596e2522d87e90a8cd280d3921cf17a82bbec782b427f07a76d34fc16
SHA51290d7596af577cf84cb002f9ec776fdc7905828f18bc266004868e7ec7c58ea45c1109b284702a78fd19d3b3e23e4e893e9a982ebfcc86b46779904a5571d2174
-
Filesize
68B
MD5c79942a94e887dc1d890f4fa8e3534bc
SHA198520b7d1cc4672ab0ced5502c05a7b698c1969b
SHA25601f69c361758c1ac1168bf57de0b16687f1573e8a08398f83ba8430b51351746
SHA51272a622b4a10a2c07a36872052140430207abe3618366c42758f0633c193ed76a62397ca766acc3410fafdc81e328bb656b899927e3bea820e7dc944ebf3e1dff
-
Filesize
68B
MD5a18cd6e0e3edf7c8868e10a612c9fdcb
SHA13ae082fcb8aaf71c21b98a18062f3e5003853ada
SHA2563bb6c0a8172be7880562d20e101895b62345bb152fe08356e0cebed4385b17fb
SHA512e704af09ef3a694b95bc7a65b3f4bfa4db0e80e9b81c4d5383cb04022321207286022f0ee640e717df550111519f423a0024f904c43b1a4a492d363f504b07f4
-
Filesize
230B
MD5793de96b2a052d26bd612d64d72cc9ee
SHA10e50944d0dbe2aba727501f380d25dcb454d3882
SHA256467f0c002679d8ea20ea0ee5c04c1fbd59cd42b16f1270d29ea664ae8cbf78e5
SHA512deba45d684f095cbd47f7c8aac643110792e01fb725ec8db5e7cba0a6dcba717c0a7f864a34fef4e477cf2faae0b3eab402efd4262c9bb43cedc28ce95f8701c
-
Filesize
54B
MD53d2a233ec7a67b0985e264db06e1a03a
SHA15f26c4c883d43739828268b8588a2bdf93a7fff7
SHA25666f343be5f27fe35520d4617a4c1d61c5c0f0040625e4592e3ebf725b3f425b0
SHA512dee8a9da06eb6cc587ecce8254d5356bd97b7bceec787346ab2ff7cf262d1c1e1eef3d18e1456347e9802d7eb46686f8db229d063bd9128f1b4cd4e570926b51
-
Filesize
63B
MD54ad8d0838d2bcd1c15a3a17a84218a64
SHA1e7bbf322e1ea244a029979c8fee93d5e472435aa
SHA256530d6750ec69d2f1e652b6a2ff063ff516fdf006a3d2abea3d97323890780bb6
SHA512b45b5b5a1059ab607763ff37f83254102d75198466bd9a3fc19c67eca894645addf8f3c40ec76e57f4ce5b46cc14e536741a75b12e9662b50946b2972e32cf6e
-
Filesize
45B
MD5c31200af20148b04117f656a42497dda
SHA11d3315c5605c39a47ee001393162c66bfa7107cb
SHA2562261a16c8d44c59998edcaa2e8e952b6db907cdeb5afe7b13e3fa0a36dce8b7e
SHA512adcc810e161923cae75d71b06849399c7d005f35fc889c83e6590bdd0bcbb7be7d24a1dadfcf90926d30a27f64937a52c1dbacf2fde4bd78ba2a59598465c97f
-
Filesize
63B
MD59e1e626af3ff665ff6943ed331256a44
SHA1be1e7405261bb64fceebb09ebbdc08068b8dccb1
SHA256dad3da2ba9a32315d0b6f1b6b4c123fae1d31152567e76de7eb8fee2e866d84f
SHA51236074794315d7157b8bb04220e1ee94928ef61a20e67482a7ea73c1f39d9c3665506add6bf524c35e30212a87b2a094a3373d1d98a78b2283c5324ff1ea003c0
-
Filesize
466B
MD5b625a912daa418b98fd26da06fd1d448
SHA1607afa01287983405713cb436a19a1ce65d872e7
SHA256a297e04e306f713b50d6fc1a4048634f54e14967095b58375ffa4199f4cdb27d
SHA5122aa9453b018d144a746ed53f1edb378ad2501e0824ebc647424f60e057449c5571d9e07e8ba03608f8441038401c2c7cf699ff3a68249c54ac0a5ad112a73a2a
-
Filesize
45B
MD57c29ba395b9e78b2d9fd7df1d8a40de3
SHA131d8f3a5acf8a4f725ee7eebadc02ac0cc2672b0
SHA256ca88fa8c31bb2b5df544d35294b83b73fcce9d530025c06f60031ebe16c33c9b
SHA512e52111742108a71908d2f94cb37aa1ea54605ced3cb1a1b6a57b515323b36d9aab141a0b41f3eb045bd6fd9a29c35080dfbe34033239aa8d8995cdd3aa0e6b2d