Analysis
-
max time kernel
147s -
max time network
137s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
11-01-2025 22:00
General
-
Target
7b9e8b44f20c8bcac573b214b166df68a0fdf5a388621b1469191d0639c2ae75.apk
-
Size
2.7MB
-
MD5
b792e52dd048b86eda54c6306e83090e
-
SHA1
c9e615a50915e4fb522ce1595aef7d5e574e0d4f
-
SHA256
7b9e8b44f20c8bcac573b214b166df68a0fdf5a388621b1469191d0639c2ae75
-
SHA512
67a45b69842f739007c8991540107f2bf53eb991d9b8a939da35162d023bbb1354abed55528089b3e1bcc112feb53d182cde6ac04d449f2f8b0df21e7e142517
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQh:vhyb0FjEI4iZaUzYH99yIy
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
70B
MD5fc7965c7a832bde64d596f96be2cabf2
SHA14bb83b1eb54f98a9a52cec753a6cc4e088a95824
SHA2562914536108237b4f2cf106369cf1f5534aa0106ce1e099a5fd5ef168ef1ee391
SHA5128f95d2286edfbebc07c091661cd60a2b5d1961fe82a91266875d748fd9103d4be04a23471a30f767df7bae715ed37740bd266c35d533509a1c68cbfde0feeeed
-
Filesize
490B
MD54ae71f7d2fc37e6f1a3e1697aa5e7537
SHA106443adff90a6292b248bb10ede7d693a1e3098f
SHA256172381f2d013cbbd3f0cd73b935e255751321d78eb9a7f205e40b96336666526
SHA51249b44bef17db29c8323bcd26fbd7c2267ce702ad00de2afe26722be7c19109603c69b0dff9e00fc3c8ba798888ea7b33b122ac54f8544f80e76ef982ca0ddb40
-
Filesize
68B
MD52845af7ac072dd79fef0f530aa34176f
SHA137e7649675795b69d313f9df944e0992704ac6ce
SHA25672d9c06830c06bfb44ea2b8a5e648fb8f339bb48fb1c137a8417dfd5a8aea4c2
SHA5121b90aff3b9472b38f79aa000913a706aadf20b0edca716079146cf69dcbfb15f31e922c392e82566efca5e953778e8727a6bdae65f49bcc84ab737e420c58041
-
Filesize
52B
MD54e6db58f47d5fe6e42f5076dbaabb0a7
SHA199040e78392673a5cf3616165e03d928f73595a2
SHA256197b1028e1896199e7006e3570ed12beca838fb9ea4a059b149edd8d181999a6
SHA51208c6d24662c93a025f9083b412dc7a71f5823214bd77c1d433934907acc5d5f12a3fe228725b640f0318d6339cb1fbe0f68f1faab552491ad009483efbd96db2
-
Filesize
66B
MD53eaba8731aeeef47802945d051e7ddc6
SHA1662ee5b0a86b1fea5e6407cbae92f323491cc4f6
SHA256c77155097a50bb58d72713376b02dd3bf23ee0eb01360c19654930fb83d2fd6b
SHA512dd8ede08cad6aeca8b410f0a782178ee3935f14b81109b162b7138e4448286943d46bc279aac6dd3928064c3358ff3d53c5419974b8a3160fe65153724a9f035
-
Filesize
60B
MD56cf8b3e74a283994a77cdbb6af741021
SHA15c5875c32badb78d5047bad8d1d94fa7b72d0002
SHA256c1992577143b25fd56ff8ab76a0804ae5993e06691824bd9eaeeee3e58611b99
SHA512f7bea3d9f1d04c207fc05da1fead11303815184b68a0b998414dffa4a8568f75a40f65ee99bec1e992df843f84c581d021005d3b7089d4dc8f42c58950e644ab
-
Filesize
84B
MD50b12fd34a9bd648322e2cfecf63a3ba7
SHA1f52e91e84ca872315f46158a561629105ba8966b
SHA2563d9e7c7e6a9fc9d85bbd9ba727368af8a5181a0e428eb155184b17419b209204
SHA512aa856bb62d013ad57bcccbe471b058c747aecdd3e15be63f29eceac6e7c21947d6f51a855553ac16a02010a4dc73207e79c87e9325127d533724ef0a9d6f8181
-
Filesize
68B
MD527ffc61c6c291ea5314a1544337f258c
SHA121366e66d439fc810308183d936d1740be9d7cb1
SHA256d34e9dafde1a96a60f62f37848d6a75e9a9234ba590ce00b93102dea5624042a
SHA512c327fa0dd85fe15d93ce695f617913502aef7c39fcad1403fd4159116d3b305277f046635c12a118fc595d35e724ac6d24613ea465d8403f658005a09db55e22
-
Filesize
214B
MD58d3bbc3be1422a6102f77a32ec683a1e
SHA1d5fc538324f4cdd80c43412396b5f3937a95f98c
SHA2568346e5e427229bb76f4a4b2187d1be23d2e2fd7a09fd1803cdd709c780a7c053
SHA5121a57e112d3c3bc93b4d14308dbe1bcb6a4f61b3d790b6c4816c88f210d290ac8b9fb77448fd08b4bd1f8c49e115c04e397cc35bd33127c3ba0e3ff4418564871
-
Filesize
61B
MD5f383a38c54e9d2f3e5ed79d1221a9992
SHA14479d2eaeea3dfcd63e837d1e1e35eff7f88672d
SHA2567dcea845a81e831503dad3ade026c64b0ae4646f717b86c7b4a61e2785f0f309
SHA512bb8a2b7432e42945200aadff80275380b2018e2548f45e9c144310cd91393891c9be4381673f70e29b5aa07ede0d20e7c17e6b7e7718c7b717bbe186460ac9a4
-
Filesize
68B
MD5e752f24d571e97a117a9fd125f0f3c1b
SHA1bad9e02827d2097f77df1781bf0d7303bc6d6492
SHA256edca14453d1e741f0d64c4839527a5e1a4b22e08445befa770eab8e8dc411795
SHA512575bf917199a6794b3f5efbb06d1f32492411a63e700e39a2ab60a8a76bacbd37b69234f0dabba49d0d05d15ed1c25f6e4273d03ae80fe18bbea20a192df5a75
-
Filesize
60B
MD5eeaf0e05bad428b0ba0199cc4b86d567
SHA115375f825e42013847effb32eb22a48d60cfe85f
SHA2566058c25dcdb51cc1f34b047c503d225321e54029ee48088f5c208c5968709487
SHA5122cad1e11e32aa5bd382e0703109a979aeadd417f6ca36048bcbb4c8903efd1971e495a0ba2b0072697d13f359e167c088e1dd765846026d013271cc80f815e52
-
Filesize
52B
MD5d47d23f4b1ad39d54eea7a610d6703d9
SHA1ae44dced3e01ea0b97ecbdf3701e907afd965190
SHA256b7edb0c21b934aafc2d40dcaa946ed846f069cd0aacfb5c8281fa8c1874ba1ee
SHA5121488ce329e9a1d2eb8726d508b0b1e9e1d33fef6c5c1c93c80ee23b39df0c4f350e2a13104f3623554bba336d4a5d9db44307f8b8dd8376be2b749ea75e3bda7
-
Filesize
70B
MD59f735cbd9dc450d79bda90bb3d72d08d
SHA17fa426a26cf9f71d54121135cc494ef7ef7d9032
SHA25659617f61d61f402658c4363d1dc087b0857c3e0b526015af2b09f4f6ae8eb703
SHA512bc07444c42444ef72d1be5a41d7a88923e998c2507d26856f4a2f5f2bf3015742c2183c2f941ab106f58060f1f1a270fbb37589f2199cb07fdfd9e0a77fd86cc
-
Filesize
55B
MD5b367ec4b1be1fe2cead670e6a3a0ca86
SHA18f95bd8727679233d5c37672b040e8ca5c310926
SHA2565db9603a05e84dfb874a61b278d7aeaf33dd05c5eab2f26b1a613bed7e7189cb
SHA5129daca9ab880eb16b529efcc9a6f0a2698c6bda02fb204e3c924f560f7cef30775dea3273401f804cecc793d59601768919327aea8a8c4adec4b09e391285b31b
-
Filesize
45B
MD551d932472d019b2c8dd6ed5a66e30139
SHA1555f0a28fd8e625e8f6b45113f67def0cae27fbb
SHA256112799959db55387060eca138bb44cd02f1072229d824f10a5818d1d5b1c0978
SHA512a9e86d9fdac777c0c0ccf82a83faa6200d5b6779aed18f06a413b5fbbe98299c25d1caf9d568e150d0c5952745e73907a6edd5765f9b16b5da199a35183e1292