Analysis
-
max time kernel
57s -
max time network
65s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
13-01-2025 22:52
General
-
Target
db91232d967998f25478c123e5154590a8f0819584e03c2daaa13625de3de9bc.apk
-
Size
2.7MB
-
MD5
69b73090a46538c1f9a123ea144636b4
-
SHA1
67de524a7aa9136915dabfa5dc4ed08f92a051ea
-
SHA256
db91232d967998f25478c123e5154590a8f0819584e03c2daaa13625de3de9bc
-
SHA512
b872cf09ae00c5a7b98d64207550213277ffbe344f37cd7249c8b8b848db1928e2b4f5892de2abd51925dfd622eba93edfe06a9edb26695868a148c2b358be22
-
SSDEEP
49152:OChygC06Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQy:vhyb0FjEI4iZaUzYH99yIt
Malware Config
Extracted
octo
https://85.31.47.102:7117/gate/
https://85.31.47.102:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://85.31.47.102:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD508c1525c591413ce882283397e7b8570
SHA15d2e639d69cd975506ec96f9c4318a869ba3d0fc
SHA256bfce46c477c4fc574a16fc42b7f5dbcb88098d8440ca06ce89f3eb99d621b0f8
SHA51273825af584d4969462718f58eb40c78eab8765a3a540528dd90d62ba0a53b4ea49fb8cdefbf5c8ebb51b72180d018ffd9bb07cef13d0402830701d584ed31acb
-
Filesize
45B
MD545a1a6708839d713de43019eced5201e
SHA1974db601585ba9404dd13dc608706589c445b4cf
SHA2566282ec0df0447c29ebd821c5dce51091ef34ed8819d151ab06cc97d2371cb8db
SHA5124314de9049dd4355010f0946c9200daafe217633cecd186f82364f6153bc5ec4518e17d57294cc761f7f879095ea0a430425167b8ccb1f64ff55bdb51d67fc75
-
Filesize
84B
MD5a57fd696a45e1fc42dbc598902f7b166
SHA1d2f63ea76d5367e94501d80f5aaff4b4ddeed0d5
SHA256f7df1c3166371dcad16838d95127bdda95ac16554bd9de4c843005680a52617f
SHA5122cf54416854597879c7dc5633798a3e1e0e88283bbbf13dcec62ab52d277f8aabc8131cc7a74a92c3f3af58b2c2d541be7f861c4685cead710c4230a92c39ca7
-
Filesize
48B
MD52fb5d8e71c41f35ebebaec21590201e7
SHA11776683f8df1c3bddf8d7bef4fa94672863a50d5
SHA2566da73390b9b8b57185e6abec0cbbda4bb12961ca08f4527b0077a978fe7fa864
SHA51213b7b309f8c90c612e8b642a977b2fed1dccea373b0b7bc7a932f516c0d9898e74a5c473f5802bee5b4eec67504ab320fb079e7fd203faf0b7e22166b54a82fc
-
Filesize
318B
MD539ae596ba84fd0bf4d9c633138d246cd
SHA14b9eb0b14a5ca60f00b609456b5b1d1df5aba813
SHA2567baf44e0c0b1de17ddcc49081d0cd9e106373312b0a803651cd03f29e1d173fe
SHA5129c3396711d12f953e7848512773be53b6da54e55db93eda3f3a6e1801631beae4cefbe68801a3390e844885c0f0228064405757e79f1d5867726f4023e8cf9c7
-
Filesize
230B
MD5cdf79ffd5df0a825da40d8943c6a1b7f
SHA10f0f4cb03567b7d6ec1fbcbb4245954baed91fbd
SHA256c80315c7b73db828c49872097b0c128d0333f5b56c8f6fa11d6f5eec978af3fb
SHA51251d8875b72f8341a57c8a7fa8a420abee5721bb5ad007c01197d50d8db7b22a2816694d7f5bb73075536111060be986f25b7158c19b884f30987a7d4becf9577
-
Filesize
54B
MD527f23fb6bee76c33406a19241a601ed3
SHA1b19307cf0719adcde701d17354403714c588dd51
SHA25652ce4b4e3e07bd4b345be17da11e1d7f2d7dd51731602bc669c6039de9f55892
SHA5120ef5802dd8a385807b2d23bcdb43f93143229f4fb0c246dd889c67558be99dfb765ec94e77e20e0a4125cafce508c4efddf2ca35fe546747cb7fc0d2ecc8bd31
-
Filesize
318B
MD5806de60a3802eb09be9be24f3d4f2268
SHA15b37191b71e7f4af4f51043371aa8e62b8d836ca
SHA256e4cde58e5bff8250206d28cea01d3d8d7f5edd1b55977783c404599425bfae55
SHA512a839496b2713d38f422db04fc4af5d6298c60ed9eef865f18dccb5dbcba563395ade9d1390004607f3abc747e653bc34f3903ee765368aad5105aa5bd75a3884
-
Filesize
88B
MD5d93d02070695b9d9f984a905cd8380d5
SHA1a2fa3d0164ae70a1a40251eaae3e8d5a7f482acd
SHA256f6a441ec85c9cf9634b2850177a89c5a2bb56a7a522055d8653cf1051da52af1
SHA512837494f0b2ae6f96d52cbfdc72630fdca7db3b58e6a563fb3464232187d2e531690874cff8c8610901735d97a91e9af5fb07386606bb3c14dbabb7e7d61c7233
-
Filesize
230B
MD5cd73227f54b32948269b064b66365f6e
SHA1f1cb7eeb54417845374e54264c84b9294deb73ed
SHA256affa96b3f8f2db30dcbb29ef7bc139f2501850e1cc6e6f97e36e3de13a5a625f
SHA51249b01f3e694123573bc783e37673becf203f518d14e06fc32a952052e3e89a2917deaeafe4544658c74f66c267032bfa08cdf9010b21306621ec016abe0e3448
-
Filesize
45B
MD5c8b1fb6828f0e17c5f00d929042c9758
SHA164c025b2a0634c12f03e6a137fa6cef83eb4cae2
SHA256aa15edf8047e8c408c6b9f83e96a5a8f26f6a97cc8f21b2810317cfc4b0f7f65
SHA5127b8775441795db219d6e0dd7fa4d7d7f26a9898a77a34b8c6d04503f422412dfe951747995be5212f89fa3bb9d1e2080eddb7d859be56213cf815259e98999f4
-
Filesize
63B
MD50b8b9cdfcf4f5dd0f7ff24a75f463d77
SHA15b2335989eaafcaebe253429184cb46b29a3ea6c
SHA25603be9c23c7a5896084ce2878671bdd7d21d80af29417a56147035d53eac3cb5f
SHA5129a54f76b4975a07b47a77232e68d803c9de2b89c3656111eaedb3c461aa533a0b7c514864007e185fa6eac21ba0fd15aa6f321245d1a7dadac53a5f900035d9a
-
Filesize
45B
MD549c0b4410eac9f7961e584c3100c82e3
SHA198753a8961f4bed65cd1fe33dd7d1f9dc64039d9
SHA2563bb68618870cf81994ef7a9ef5a1c7ad1bf5f0cdc80019bbbb4715ff6e6d6888
SHA51275affed143e9277c59cd5503e97518d5e9d0521413e9fedae2c63ae05213d91b80518a729f01c82f321ab6258989afd497d57b3202d937b6b6792d5e127efb17
-
Filesize
466B
MD511dca719d1e66f23dc148e3898bd98b6
SHA1e9735ba984392efed31138ed1c69d7880cc8bf36
SHA2560805d440d91b815f08522982ff692553d7fea4677c057a68a6b360f9e48bda0a
SHA512f320f76366f1a7ebff47b13963dd9befe6e6f258e32580f0c073e5a924ca4194bd1298827839f205834b965e05f2ebd35fbc30d885c79d53232e154e059d7c9e
-
Filesize
63B
MD5c50cc1b0595d47eb6fea017bca11ecd4
SHA118c49436b7f4f63cb9f75b13822ac5694d6a8f67
SHA2564e95bb1227d2945bcffac4897fb407781078d1d171b4d985cd3d9d2a31410a28
SHA5128d4de232c3d786b8ba7dfb07a9aca91772eec3cbe667dd9683cff20e378ddfac23dbb0b79364d7ded060de72b228f161ed1307dca7a544546bb16433ce2ea816
-
Filesize
45B
MD5e00fcffd05825c99a4198572ad3339c1
SHA1f3a3dcd94ba865f53e885323eb4040a6aa01845e
SHA2568369395fa85a1b1f1c36421c62b049b81f041b7ab2dd258372aece2c5b7b2dbb
SHA512d84caedf4be22e79d6e8607c84ed4f2cfb5f6f9a4d544e86b892b1758f9934d84686a153c415fca35123864d164bb556569daf65878496edd30e08fb37c1ee86