Analysis
-
max time kernel
148s -
max time network
165s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
11-01-2025 22:02
General
-
Target
ad82b65938df5d254d917545d1fe3460b12105db470b840bf76843241fcee30e.apk
-
Size
2.7MB
-
MD5
6c3112a1fa9c0c96a5bd1f5011b5544a
-
SHA1
976dccaaf15f3d3fd92bfc61c1c0587aeb55550a
-
SHA256
ad82b65938df5d254d917545d1fe3460b12105db470b840bf76843241fcee30e
-
SHA512
5b2ad541bcb3a5f5c8d5b555a68600cd130bfe616df7587b7a46df03cbe8d7a6d09655394a214d7372c6c12ea63473049737b0e2da6b124dfca82483286b98ac
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQH:vhyb0FjEI4iZaUzYH99yIA
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD57716068626ed4aff4f10d93b9e742fc8
SHA183d5309acbdc7b297aa4853cf5bdfdc1ef03c171
SHA2563bbad2c2a3a7c9eb055d34fd45583e2e6d5f0f8179ce821c6fffea89b2998822
SHA5126ba5060f7875dd2ea217b42579897f3745c1aa6c79a7a1b1fc5187e7c973a799887251d50417561c2406c597ef43dff14a08c59a116ff5f1872b7725104972ca
-
Filesize
68B
MD51b32f8351e8e1b50744c4bdd3c9c7a8c
SHA18d3b687fe1226545ef8992ecba8766fe8d80b1a5
SHA256bd78718dd3edeb24428afd749dc58cc23b72e2809b289f7890d9af84bd3dd3e2
SHA512591945756ed2e409484cb709a2af150bd7e8b4721e795c8370a13a069c12cb1fcddbe1b75a9496a83d638e10e559dd38d4295c8c3e13fa5cfbaaa991c04cb0ab
-
Filesize
230B
MD5686848ab6433c91b5975dfc600bd3ed3
SHA1443877e4b4659f40287564a930314dc3e79b31b0
SHA256265e52aa696949045aac5b4aeea156c2aac4840ae384493c5889a5428ee99df9
SHA5122f100e6712244f637b192cdc2d8c53c53bbb6381b3499be84bbe917587bea0b9e11b4cd205c51a8608f4a4351945998deaa035107503f59741799ae629c0eb8d
-
Filesize
54B
MD5b219d476fca885a041136e23f174a2b7
SHA15b2dc1220402e525edd79724b8685d6e72eca2b4
SHA25654310f5beb74e2d5095040f525056b2bfdd752cf4a0940a3cb06ff58e80aab62
SHA5125cd1e2e51a116f4d6a64fc35ffd61fae943bc7b6948928d6d0874d00bf4567b26293b20035e98dd78f49dc2b192b7d2dcf80ca14c0a69ff20c8c78f384c8995f
-
Filesize
63B
MD51d3e7eb4e992f6a9b024ed6164677163
SHA1cd50b3a1ac7b1bccff230bfdc771469071bba963
SHA2566211186b031eb6b7100dd158b6f3149d55a3bdb5b602589d2109bb64d8692c04
SHA5127bc9829570407a3fe5edc3755a79600093a1a0746e85329b711e36d0c13912a8c58f8815c8bf7e7e824f34d9f2bdde85e38b5377d74474656668ebdb2b9e65ac
-
Filesize
45B
MD53ae67e757c584c4708c09e176223fff3
SHA16e2f08f5623df386f197d5bc78e78940cea2da04
SHA25659d713262464ac1d8bfbbacfd10fcb83040dc38d3fe9b4833dc51f2536f4d663
SHA5121c2609a62c1cac368850ba339efe29d97c928953a1e2c00500c6f3479986c5034d171e7ee0149340937d600e5251c578a69ac0c8c7bf81a232dcdba332b79037
-
Filesize
466B
MD5ca1ff8ace1b6f89902d5282987420683
SHA183e04684a66700d1c152496fbc43fc15f4c6ca8b
SHA25615ed9dbaec321c9463d3dfdfad50698c7476a1d466673770fa4dcb0ed715c26b
SHA5129dba8a9a62cb6bfc32106e384a492dc5cd5bca10218a38cd656f766e4e625ba0d20a57cae5f549e257a892bbdf39b59b602f352b66abbfa45956f476eb09aeb5
-
Filesize
45B
MD52b8aa39ad0bd8b21713fbdd924456971
SHA1145a8f55f287142af237863f099bff04870433ee
SHA256ca8080ec5e96f6771bc91797e70551ae38517275ee32bb9d4eee833af44aded4
SHA5124121f955b53f63e89bd360f72bf9b89bc39cbc3573fe2e7f9089f50d9b2967a626c256f9f0ae5ac65d87a342f4fe2f9c0ee75e568e18bf89a2c965d1c1f56037
-
Filesize
66B
MD5f1db13ae4115527e876c1e576dbcccea
SHA13917287e100b6207a0180e72c56c07c9c11620a8
SHA25657e5dd3624b25bbcceea9b295654e9504959c490f01c9b3998d0d5bf455dae44
SHA51239f002cf5d535987366b31087d9f664e4ae46938ffb32e931fe09b68136c24d63aee61c8370c276ee163249d7a2b7d1548d5f894529ad7c0d1ad65ee549f88d8