Analysis
-
max time kernel
150s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
24-01-2025 21:26
General
-
Target
2_e0e674ead8.apk
-
Size
7.4MB
-
MD5
8b7c9a2f5d9f433e88078a58a88ffb7e
-
SHA1
7cfe826255012225dc3be526706aa00fe7693701
-
SHA256
89ff1e5fbfd528574d51f1b48ca3283f53694b081f858d1c08cc1bb12bc3a729
-
SHA512
98dcaaec7669a839b5e882419a469e29a9b7a8ac3ebcabd64bdf645b0b2d39740e6bb7a22ec72f7b7113b06dbebaf7d6b0754fc2ec7c26f740ab1e7cccc3e76c
-
SSDEEP
196608:oF/pCRlrF/j7HUmZmPn5X7sVmRoK9viUz:oF/p+rJ125X7ToKwUz
Malware Config
Extracted
octo
https://81a10c7ce78c2af74b5788a6a013efe3.com
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yrecommendation_intelligence191⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
335B
MD58994594aec4a0cdc3e40a764d3ca3457
SHA1e821b0e735d82b33db07322e1b219dd6d72ff6df
SHA2564eddd088b1cf89fea84b14ca7ca6cbfb67d133857fbf1fe4230e597e5f385103
SHA512534483735f4dd6389b2d3ab135197c245548f319c8129b0aa98d56a13f46c26715245ff2098708712e9df5bff6426ea310fb8dd4cc493eadeec600711ab4d979
-
Filesize
265B
MD50f90b0da8101f3ee37f3340f58f7bda5
SHA1e351809bd4d3164dc154b1e74959f8bd8ae8bac3
SHA25603a8330ba44f42c2b56b2e7b5cb79c3918d72e7aef327985af85dedce0ec0541
SHA51219d230d59cc2493b9f2bcb3583affd29dda210ee33ba95b95b640fb4f727af6102f5078c0a73b4e957f211dbef44ac144b881a8a156e093db3d8eceebc149a16
-
Filesize
194B
MD502bd9744c3fdefb07f727e43f6ed3ed1
SHA1d04c7e34eb28a34b75917c7f74b591912b810583
SHA25644191dfcc2d33febd0d4cde3b1813512d5271c4c32e08e2b57acc82fd7c3f74a
SHA512b174aedaf1360ece27417f84b1ae39ca68d861af2a65719e083b81d1c36359e7260c5508fe2407682292e4c7fcdfb52369f236999df3f44b09e0ea1a93c42317
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1KB
MD5e79590ed9061ed84c662a766035e0f6a
SHA1f05b61669f4cad3bf19ac2164f73fa61c056f5a4
SHA256d8a3b68720bc21cf6f4bf0cfc8c1a39a8c858f63d8b4994ed2b4f28aedabf50c
SHA5126da08c49657f26318aa496873e6fa6339fbb31670c8377ddc81ec4d06830f02d742cf942beec5b6ff855bce5e382e150405af3b630b9f720e365f10ffe0689fb
-
Filesize
1KB
MD55606167d688284d134d4a1b81661f4ce
SHA1b85fe9dbc7dd6e80db14ab9a7c2c6f15491f2c14
SHA25681164f8ff11e1a35ddef6d9d07a5228fb8a78c3c8baba125a4548649f9acb9bc
SHA51272f6e75dbf89f895ab0edba6f6c8fe8233cfb1546b2ffe5055bfd8faf58acc84df01318d091243178fe96bb010f13088eaf1830d5465575ef3e4faabf35e2f10
-
Filesize
1KB
MD5c4086482f3bb5af7d088f3ed04c038c0
SHA1156a07566e71c8a7cd118ebe9909d20530320d28
SHA256bd5890895f290cc8e2930fb69d0373d6b7dafce44771de0f841bded02b9082b2
SHA512fa556f59236b4204847f0f13a02a205eddfc46bbf3845cd2b2500409cd555ccb0e51534a6ec85c39e2cc30d220879fd2bb216faad56cdbcebe5744310db9e936
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
701B
MD5d87d8c54b55892f6829843a7d741431b
SHA168b2347c994ebda422d77170a002499354c84ccf
SHA25601876cbf7953313ad00ee75fb381167f925cbd59e52e8b1e74afbd8519cc5d4c
SHA5123e843b3aaf77d9235f308a532f81d1522c2d0103ebc1a1b74356c415d5253d87706beefaba536c312228ff03cb8c7dbd70fdee3a0f14adcb509513ea00f8f399
-
Filesize
530KB
MD54fdd8add1be56712fba83dac6e3f5e93
SHA1c461e004b264879ff3a5a7147afe090657abe9c9
SHA2568d29b41ce8a88f213d2389c84c2d9f22b6d5826e5b4d3d22da624672666db4c3
SHA51221d99b2930762717b286298d6516dd7044ab8b3ad4047bcfadc7f30c4626864483a745fb63994203e374d2b7e084d3b7e88233be15fc963bffbe597a4732ac55