Analysis
-
max time kernel
148s -
max time network
138s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
11-01-2025 22:05
General
-
Target
1f5323170d4e5c07f8652ec49f81f557241a752c722abe78f5123ed2eed75cfa.apk
-
Size
2.7MB
-
MD5
0fa9ca7f88e9304702092d2e27a97f94
-
SHA1
9ad16a581a9f1953c10410bd56e1128899babcae
-
SHA256
1f5323170d4e5c07f8652ec49f81f557241a752c722abe78f5123ed2eed75cfa
-
SHA512
1d6bc1a1b4d196fcb58a991affc3e0a5393c4aeb9d4033a2789c686a4f5bf85c2822bb28c414bcd1577955e87189e4738f10307251ccd690ecf2b2e7fc8ef0a6
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQL:vhyb0FjEI4iZaUzYH99yIQ
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD5185df843b7d17fc344450ef3f8363cd6
SHA19420d8277f26490cb992a948dc56222bba87fa77
SHA2566060e005b3d3df16d08c5d3ce989636eb098c00d261a09b40c07f6f486d7d9a0
SHA51231abc4b78e86b095c397476cb12d416c07c972f4d293474df23dd65591913665b40d49ee78dce2e4ed3010eca03155769dd1e2067448cbd08edff81aae5048e7
-
Filesize
79B
MD52f51761f1d3300a5c35134a0225d54ec
SHA1e9d248f9eeecc4bcb37b1b61a0cdc0360c09a9cd
SHA25679e24f3ca1e0efb51192f780d5589c9f01bc2904181ed1a3025b94dde0426927
SHA512f595b2f62443011600ba199109c6907bf09582c75d76e7bd690f50b3bdcac8fdd81a3c142c72d435e8fc691c0adc47f906ee3e985b2bf9348bfdd03e24aca083
-
Filesize
490B
MD52a68367bf675459b63db12b083add151
SHA1318fd7c33ac8f969e44da0a2ea17baa73b9984cf
SHA256a369f9acd41e904ee857578a7f0193f0a1aa197ce462fe176431b365c3be6248
SHA51224deab5fc28aeb5e826dc1f40625cdaed9cf3bfbf0c4db372f5a1bbf94ea03945953f2b94675a6967651525dc281fc1e1ef8b762d1caa501b0924ac98710d0f0
-
Filesize
70B
MD5bf2ce17ba7795cd8725f8e103fa2f3ac
SHA185a698124547bbab24093e6f18dabc35e334bbff
SHA256a9c6bad3de1604830b3ed33f5def8c287288bca3e6763c53b7b6cf992563695a
SHA512e890dd2dcca1444de8998230722999298ce26b20c9e2501ac1baa09f686ac6f41dcd9fadeb4477024a960932b9b98986e17cf227561c1d51c7ffe73b12a6849d
-
Filesize
70B
MD506b05a5bda6bf0206dc1f1d5ec556e49
SHA12e7368c5e25638dfa6b4fe6e4971761a003a4e1d
SHA256fcc9f0a76044ecbd1d7d089235f7c761358076087d44f3c343dfe435145fe17e
SHA512f8ed6b9ad589d5f5b13e100547e0b087b3c33d327e925c4f6e63dfc23fbf3c57d2098212b26403bea001406ddb6c024d94477da89fea69f7d980fa34cfc41f2a
-
Filesize
68B
MD5a6694395e678f627515567890ff2caaf
SHA1c37f5e9e2ee8dc7b95f4cfd341d37d7e43ffd1fe
SHA256e166da1355f84569c2646afdd6554f64c47ac03694c9dddf86efcaba56fbb8b6
SHA51234ec5baf451a19ad0af036a81419a210623cf5be00f0da34ddb8ab5957b8483e983a67dba24359feec1a3e64f503e1812ba6b1ec11bbc395457d8243445adb3c
-
Filesize
68B
MD59b3aa54547f52599eaa51d8478e46c33
SHA1795aa7e269e89bba39b1bb0a65e1560af1ad5980
SHA256c4fc33873b4705b5cd0138b70e4aa617a770b8c800e4861adfd139b86bc8a677
SHA512472edc4ddad11bb246e61eea8445e724729406812fef3484612a08dcd52117bb9939d3509cd62ae4ed5e7687ffdeced93a8102f6c1cc6f3fee2878c996a7bbc0
-
Filesize
60B
MD521cf3cda786afd4c8d3e0f34e8ddd949
SHA101ded3406e9b5908a31ff7910d1c45a046bf6c00
SHA25680fa4ec555e5130b6f4ab920a26b96606225699172269662d4ad8d938cdb039a
SHA51292a0fe3e0ac02e3efdbeb28a64781a72dba59a3652d33fcf3585e4d298a68f094ddb8a5529de7bc28d6180e3e03eaf60c1bb5cb2f092925307517cb090bb982a
-
Filesize
84B
MD542caf16847111d355fe0d30b8289cc59
SHA1885219ab5b501e254d39d4d57149a40627affd6e
SHA256be97ccefa55a43e8627da6320fa38855d0c13987e0c883287b49a79d8c2cd2b7
SHA51234a03f309d4ca3ba5c9da85d8c453483e296d56920ea3e8ad712c725d173d9f70b14073fe358fd42f03f84682d9f9b3e3afdf22101105ff2afd8e94e8cde5dd0
-
Filesize
214B
MD557e1e7d15bd9e59379c8dcf87b15a128
SHA168071a33c55c89a484bb34d34f66a40a66c4c996
SHA2560f632193e6c5e6fbd8ca6495aff30871e2ab924ab030ba33ad1ae8405ab77a2d
SHA512e63e146f31ca9f522073a2781e097b3e360dc2babe13a19f5991397e0018d58cc19bc01894161376928c365361524f53df518b875bad614450c46e293482136f
-
Filesize
54B
MD5626c123ed7fb469e5a960ce4780f6b6b
SHA1ff4da6a70d2d72311f8c5cc578f6f2cb2f9b0665
SHA256412cb18fc57e5ec27109cec928b8611e21e518eea6ba355fa3afc612d57c2c3a
SHA512a3bd5b5f341590b705795a760081ab475bad37f3c4d8fa84ed949a4394d0e4cbcec43586e61fa3a958886c7004ea17751c591a2699dc344fe3eeae124b09ba24
-
Filesize
68B
MD5879000c47442ad5de4d724ec16934081
SHA14367e6069b06bcfa58191db656c3223339c315a6
SHA256ea85043a3bd3c8c04032f5355dd82f4e04116b42004a94dcadb2181196b22349
SHA5123dc6556cbad22bde3f5d26d7fe79928065ca28cdbdc9eb87ac6f30882867387ac3501668b501c06af3b5bd30720b9ad72737614726060cf857985581b2b32516
-
Filesize
60B
MD5fbb2ef95ce2fde16f27cb84518cb9a5b
SHA133e6fab84c1fc1d9a6290c8a075e7f1ff8f738cf
SHA2560dd37784006cebea24546cf8dbc5dcc0c032170a4c2d1a908141fcbb808e82db
SHA512762f7d96ff90f6d77ab4b930e3980f70d0998f9c916f91fd8b50bb09b10841fc205f77f59925c20dcbe814042dc5ea87ee74302134f61d9a806687cf6ac577cb
-
Filesize
70B
MD51841f3d922d36a31c4889dd01013f5a2
SHA1d8315a082577d1f5498e69e3d164438d9081cb59
SHA25619c5c3791c891a67a7e1fb8081cc7f0360e2a6fc5fb644c2b1355162f293a593
SHA512687218d0b49214673c96be758cb12360ad7768e2c86fef81dcc32e85f329fa9ade9e33a642fe6609eb49ba93b4884f91733ce39145cdf86304916f86436ff1ba
-
Filesize
55B
MD554126267dc041d07b265db0185741c43
SHA1f637432b1d27838fe4e6b6902cf18d7743928fa4
SHA2563d480b5a126103359dff1c4ad7821b1ad1cfc44ae44fd38933aaede2dcc67ee4
SHA512fdfff780bcd8a7e22ebabe1ca5dd338f78c2cb0fc73411f2a022495dde77dafd73be6dd0bcdbed552c1207d979fd58436b5abd3612c5c044e633382366a7b5d1
-
Filesize
45B
MD5db2ec022fa8152ba2d095c0582538e07
SHA10e753a8acceabcc2b28c2e655679c64743107b50
SHA25660fdbe55d16c6971e381258b42f4e80afeaaaf5c8a1a370d4911ab99ee5cb0d9
SHA5128f653fd9e8bfd46526551fe13cbe4ea587b7de5eb68d4d3a42dc5d7fdbf857a7367c8926574d45cb1e7fe8b28a7fb0a54ed0848ccbb84122d936ef9fafe014f2
-
Filesize
70B
MD580405508fc15cd211fd1b96d590a7a85
SHA120ce80fea89e87c6e706cf11df57bd0a4600b4fa
SHA256760ece674d4bb693e4bc976bc8471b869d81eb35bc920996b0d846c1a339d409
SHA5125186bb814351d616fcbe0468887019cee8b3092842698215e7efefd18cef94df35cde26a183a265ca09c610afc0d78b62dded26bfee19894c299771c87ec156e