Analysis
-
max time kernel
149s -
max time network
145s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
13-01-2025 22:00
General
-
Target
db91232d967998f25478c123e5154590a8f0819584e03c2daaa13625de3de9bc.apk
-
Size
2.7MB
-
MD5
69b73090a46538c1f9a123ea144636b4
-
SHA1
67de524a7aa9136915dabfa5dc4ed08f92a051ea
-
SHA256
db91232d967998f25478c123e5154590a8f0819584e03c2daaa13625de3de9bc
-
SHA512
b872cf09ae00c5a7b98d64207550213277ffbe344f37cd7249c8b8b848db1928e2b4f5892de2abd51925dfd622eba93edfe06a9edb26695868a148c2b358be22
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQy:vhyb0FjEI4iZaUzYH99yIt
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
45B
MD506872fd6ac0f357b4a4e85a90051d70f
SHA142b65a191f9fdebb968435837af986bdbd3004f8
SHA256f0f502d38abba0a9984edd1396ea41e05ffe00e38f34d58058f6bc39bfa61980
SHA512ce9139f6773c987fdf2d031ca4e76c422968b4b95780d6ff2d91c4aac38271bd8d524bc73c81feefd33911cf12d78d0b641a82ee43aabae395b2a5cf2b02aa36
-
Filesize
66B
MD5407500cb5c6f47d1a6a4f1637e2d22de
SHA133565f44202313cf5891fcf1c0f0ec7210f37bc4
SHA2567b9ca14bf9e4577ac8c5963ff0fd1adf55225702e7467f8296e3214304b737c4
SHA5122c8dd7ed68b85754cd9398253c2ecfdd41c65d9beed0aa0544320753537a97e95de3576d1e9203f8df513b1b87d112fc699cd93f52dcd4d27cc4b4b63134e42e
-
Filesize
84B
MD5ca528c1ec7ddbd7f9a042471f7c3ddbf
SHA1aa599efe9dee77634b1abeb7fc0e57ac683491fd
SHA25670a83e5eac474f286ca80d44366f1312fa15cfec19348e6facd53297ddaa2fef
SHA51263679db66072d68f406c6d2e7708b6c12a69e974f878135711de031a5c278e6a3d7aaebdc96c91bcb3c9978b2568bce3ad5dfd4ef61400579da4ee355aa53da4
-
Filesize
63B
MD5019e81e0acada810f5409cc409aa343f
SHA1839341ed9d8c4f0954e2d06e4cef002a182bfcdc
SHA256194de9b555e8dae968c63f992581c2048764f78acc0956ca9fbf7a6127d44ee1
SHA51271ac8e68a2a08331fc351f84a670661e6987d440dc586b7a00d58313326b84d9ae2504ab1603c20dd0521f8f9c733726b9e50a12dcc4594bb39f82c22ebb48af
-
Filesize
58B
MD5044437575afd8721aec4db85916a0f06
SHA1f7eb8b61d081a1a654b98aa8ab256cf18bc12d9c
SHA2565038f88dac3b99c75de867e5184914fa9925125d25f310a47b7052525c044d3e
SHA51213f727ebcc55d930940e0f6237ecfac2b870927ad8bc8ef128ee7253d087b38c784a2cc56417f9d8a0461f72041189cc181a2c580900b53ee64579a4b75f2494
-
Filesize
63B
MD57c5653c7b082919ea25d0f727346d5ad
SHA1dd7a14a56d78d298727ff488a3732799c19247b8
SHA256b2288660f89e5656b7dae5b8bfc10395516eb2170a6f63dc6d9279be606cd873
SHA5125f47fbf7b7d50539b658c8887e9631cfe1e01340053b087129a49cb1fc96ce4e664e87b16ae933604e5b3c3ff1a9f2b5849819dc83c7d107aef8824aed93447a
-
Filesize
230B
MD5799d35977d5849f87809bbe0e78ad716
SHA1789bf958c68bb777b17bd9fc1b7ef32b71feb11b
SHA256a477001ec34d135c68dd1b7b72f55a6ef66e152ebca406e12522af6bd0fe53d0
SHA51205dacef21f1b62865fc9891c8d26819c04e4a3a4bbad5976ffe33664a09aeef27e4032ed0521db35e2cd228e67e7698b1454efd2cd24596854d7baf6badd8170
-
Filesize
63B
MD5afef761e6f8d56fd11b988300a410a72
SHA1c784d3d4e2698c9cb553f94674671c09f93cacbc
SHA2567bb81f296e254c86d0f5ad6397a8e69d99f584bb8ed1f52b70fbaf55b49c5b04
SHA5129e61fe6249002868403dce3b6276eda25fb19192421ca5b484382988b1dbe0f5a9ceff18cce636a7bbd1ff40dc336083f216747fb3d59c5406cad438764423de
-
Filesize
68B
MD57a058b7c72c220f2472606e069d1563e
SHA1cf0afee2debb80d3b60f6e7f790b6b1e46daa020
SHA2568b592e787fc808b69c1d4a4ed26f422ce0e4ba50f0eb891cfac717eb26c43351
SHA512bc8a23ac79a7b5233470557b4f6e483b74eeea9ba34ea88752fbd2e9ea7a5041dce77447de0626be2658d0c3a32591741d2947ff2d8b679d2a4265971ca81810
-
Filesize
45B
MD5c92f91b67b98f48d55da5fcf21361719
SHA11dba8b4083fd4fb2df50a9d95b9fbf8fe054a59e
SHA256559c71016a99c2fc1f4f134d0e9e75f4eae2deec4062609f7494881488d4126a
SHA512695cd07e24aeff3caf53bc795ca856fe73e78e2721d5ff47e71a0fdabb75b4db7e004899b6ebebe59d9e99cc94dbe7866d0cd7cd202203c7b6b3f8b7774d8a0d
-
Filesize
466B
MD5b48e883bfce258630a1f33bde3643b56
SHA1aa748f1fb348c721d910396b79ea38ac188619c7
SHA256b90e570136c1e51978d1d2f79247708a46ca1751dde6f98599a5d1cc0cb7a804
SHA51229309136578c1dee3b1a689eca084cdac4c96f77c517e92c1a8529a03c4b7559ad604351b7dee26e830efac6373c8dab106e515aa917302e8946b33eb25f0140
-
Filesize
63B
MD5ce275eb73c096704eb0c2c8aaa54cd72
SHA133f9c84a10ec70cc477b1fd93fafd8fd92c106a3
SHA2560a1428c0c7f76cf9cd6fdc753ec16bf1de38438631bde9037f6dc339f85d15d9
SHA5129a2a74f15b3a5731b19e4b3e3e88c1e2ebc668f6f21f597fb05bda688f2e85d9f7c87646688efd13908b726f4f34e6078336c057c8994913a7ba4d2b6a519b22
-
Filesize
58B
MD55ec24239032abb06151f240b8597532e
SHA1bce66a61c108c920c03d50059dd3503fa184cd70
SHA25639339a816f5b1441cb16d1b5d1b5169b641941fdafeb00010aa043b3f5895fc6
SHA512f516148c0983e7e26a4d0b09271462c15dd807da40f8f21c288aede71a9a71bd9e8c8966fe03aee452f94922db39def069f1240fda78bfe2cdb97270719c2743