Analysis
-
max time kernel
149s -
max time network
157s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
09-01-2025 22:00
General
-
Target
76a95fc2013e4cb52f88b740085a49efbb3804caf9af274c297750c210516b3a.apk
-
Size
2.7MB
-
MD5
860e0953ecafb9f2a3403855a613d6da
-
SHA1
b3aa0336a8e23ad59326cc264cc3651377e91f75
-
SHA256
76a95fc2013e4cb52f88b740085a49efbb3804caf9af274c297750c210516b3a
-
SHA512
b5252728bcb0cc3b47d154321128cc0267027f3ae1deed34b7696b168e8e411ac8807f7f88259ac9b4e05d9cf89200186ef4c79728c075b8a6101538fa64e2d1
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQm:vhyb0FjEI4iZaUzYH99yIZ
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
66B
MD5fba4ae1f9cbc3d4275facdf64fcba32d
SHA1b59beb4b289163e180f62e6e4eb6b53033eebf53
SHA256e8cfdd9d10edecb612cc38319ee35bdc1f818f426f0cd959f121c41bb49d21c7
SHA512c14c92f388390d4ce29fa0e1a291dde743faea4ec4e969e5567c1f8677a81afadc6d261624af43a42f5f8818c7951873b349ce60821ff1170a148a94e82749f2
-
Filesize
84B
MD51c704a3b8abe141c0723d591c34faee4
SHA14857375166ded64797476a99449c9360312aae90
SHA256f4e2da9323d8736c0a5bd8f0ba90bc7f0a91cd8ec174df11d7eb4168df856512
SHA512b343e2a3d51bf850b08fa4f37d64cebffd05dd3db12b0bee548b3cfb39ffe550b10d55e44110032190573c54d9b3a01e81ae60bf02c9666251381bd9b4a5cd76
-
Filesize
68B
MD53416b195dc112c699b683f128698f519
SHA1b2b68a6a7956341559c00bcce2470ec15bbcb4d0
SHA25685d619c153774ccc8b4da6a8742f16d410867258d9956fd4b5f0430a5201b124
SHA512d1f8c56a835d66fbe93f86784bf7c93869c5811151aa858135238210f5a07fada5db94497cfe065dd7bd404dc8e23ed605c658d913c670cccc9f6617dde50d54
-
Filesize
214B
MD5bd8d1fbd446717c6ea0b7c61498c7617
SHA16f34833a872f13bbbb36bb841e86197705e8eab0
SHA256b975a509c37cd29378350824935a4fb9d8c616d51ae589da9e5368a6dc3a0d26
SHA512bce022bc5c71859e67fa45a802e4102c855c2022c60d6e84bb56a76a31240de1a9fb11691b4cc52c5ac779ce36a1c172b9c6bf0d41395bafbedd9ed321371a24
-
Filesize
54B
MD5be7aa9a906e71a2febf69f8757ee4bdf
SHA1c72f0e31970c7ce08772fb89216285f7a38d84a7
SHA2561ba986a122b8e5ea8a68384e5a514682f798a25342ae753dc87f4eb73bfe0b59
SHA512d5ee03613b823001180ec9cf4ab05f1049a991bde67eb06b6712db0d5469fb6dffe746019e125861e0c99b9cedc525a1a18ff86c22dc08d24ffce52727c597a0
-
Filesize
68B
MD50d30761d5d9c21b87ba17cc06636725a
SHA1a49279b23d2568cfb91580a3fb1505d375cc9576
SHA2562abe06f0130a7583362cf580c6c13d14ff91ddf3f27a0909f7a7c9633effb2e5
SHA5127b51c84d486aae11d1d0eed9fd2e270dc17390ff3f65fe508d81f0a5b12fb75afd3720079ecc152fd7496f3d3acd14a48dc754995ee75587912111054e225c41
-
Filesize
52B
MD5e10cf08506a35ffeba388b124bc27f7f
SHA124b9e7a709833f7afd4c515ac7ae5090eba7e6bc
SHA256e494bd941b3cdc30f11e23b2c3c1e447072f1effc28b8d48ca0ab41603182887
SHA512563abf5e0c76017930660e21d4c46e24acc241a28ef766bc35c3f938b68b945d5346cd3684fe840d0d4fe1561d9a539516697cf06347eb1fb1201429de444362
-
Filesize
490B
MD551c839edd5aedbc0d3ce84c2bd613cd8
SHA1e06e4413725fc6af3cc8e5863bed734450868137
SHA256fc9767ddd1c8323742f6d7a5b28e5d0c2774b63782e4fb1135903fc6a86c2ee7
SHA512404b2283e47709a01caec5eaec1ed2ae78f40ac105d1445b4ba8709731538e3ac2784ee9dea1f0a37b6eae75ad78211c53818e6a069d4b549bb08323be95adf9
-
Filesize
68B
MD53f68afcb358017f29a2eccf7e2131d8e
SHA1a0d9a9586aa2baea67b3c7213ffd928cb7168244
SHA256f42478632bf8fd0918b6f040f376254dc061b37c42bcc8060dfbfef17a4f3226
SHA5122e1097489c8e2e75e18fe0623d260a26d83e598855a1b3ac4aa915ee7e46d78e61138c976a019b108f7f0659f8762d38d7cb3671f3fd1ac54f89b328239569b0
-
Filesize
60B
MD59653a2aeea53b458feb6ff152f123b6b
SHA1fc1b6a78684c00d5ed9798ecb896282db815bc4d
SHA256fe2b6557be5a147cc42f109b677ff83567942a249813253e216e5247e6d40f72
SHA512c60295ed87b5d6f7773f4ef1642d2ea924e5b4cf9676b545bf84b0d4f67cac4bd32c7a37df480cfd5acc535e0aaa7df36545277ba9b5bb41d7111790a3a28f26
-
Filesize
52B
MD58381ea3b82c57675f099d4677b0e5b47
SHA14cca6a3a0f08fec9ad3a245ae4ffea1182c482d9
SHA256554826aeeaa227b2836a461c7f34c408133ff30cbb5010e6e0e639289729b004
SHA5126615f99ba555e11f657875b677a6c481985f8985abfc877af7128228614ca87607dc8178ebd0fc4b0003766ae50ae5f8e861d61aca6f72bbcba2cd38273467f4