Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
24/03/2025, 22:11
General
-
Target
deaf4f2d9a3d1c1c9c57159e68f92cff5d48ec072117a3c1ab856d249c2e2613.apk
-
Size
2.7MB
-
MD5
20d8b8a14f85ebb907c25228d5c82c44
-
SHA1
7591145f93863ac90cecee5db81fd4eede77a772
-
SHA256
deaf4f2d9a3d1c1c9c57159e68f92cff5d48ec072117a3c1ab856d249c2e2613
-
SHA512
d5e3be2a2b31529772c17bccdfc16d99e8ac05b33670dfc7d9151bfcd3410e936b640dfd7ceb95c48dc170bd44b99cd302f4d020a97fcd37011fb31941711e9a
-
SSDEEP
49152:CiNQ6Kjcf1ObPyI4trAm8a8KLGBHzFOTkCMmn6U9BrVT9mDl8r601sS8IQf:GFjEI4iZaUzYH99yI8
Malware Config
Extracted
octo
https://196.251.88.114:7117/gate/
https://196.251.88.114:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://196.251.88.114:80/builderxxxzzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
84B
MD55a59ae577852893ad63c2db10b42e201
SHA15eb9b72abffbe343b1514c87d5e450b1d0edf1a4
SHA256e97fe1335c01be4fef458dfeebb0bd390fc623f4b2a24ce7be44f67ba97cc94a
SHA5122a9106cd9b666a1d2c7461abff9f935d294d2674592f39dc34740c768afb4222f46aada071359314863f5a876493ec0b26675f32a49de7e0aaaf2c1f686bf638
-
Filesize
68B
MD5caa0f9a1c7ae082f6346ea7f893509f2
SHA13a9453f9d63a4429f8ffdd723a5f8f8061dc1402
SHA256bc04c13f2db9ed9687ace4548b8736f790da63c36800e3a5909c19266f697247
SHA512f1a4b871a910377454da7fcf8074e4cd8db47a5778987a1ae4c784a5b52e66b00d705048c696ca9e459be09711f40176b18c0eca2b52356cd22486167231f2ca
-
Filesize
68B
MD5b11c2b488068554b72af1f70330f8809
SHA1899cb5422c6ab4e616d8e2aaaf75796074ad2fd8
SHA2561ffba87bcf457912a77edd681a5c8958d44b937fa52165a72e6d6f351c499fa3
SHA512d2e0a2f23948626d5d7818a8206a6636801fcb91d59e59c44a47b92fd4abca9dc792bb94f6ca12aab076f941b85e8ebc6835aec9d40344e1bdf9d30f914b1751
-
Filesize
214B
MD50e0708357f194ea1a61528359c675de5
SHA17ae93010a415dad07e0e49e71101fd6cd46fc0d3
SHA2569b47804d26f010c5285979035cc6893da5cdf1ca6a77cfa909aa183eff79ddf6
SHA512b60c8130e5c94392f07f3d2e78f868d058c4354c5f3c278728bed51a85b57114f8d794c92b2aedb08a3669ded92a37daacc52bba4d01d8cf987199ee8e06bc1b
-
Filesize
54B
MD56c9dd8a8be7d3134b2b339eb862cd21c
SHA1a431bc792a5589a534cb7e81b1ec33d702b7c97a
SHA2562d030f3cfbf559d650e0c7b041f235074fe37da2096b49beae247b914e0e0ef1
SHA512133aa5b8714ace5bd2a1630c02e2302e3e660471f34e5c03b2f1706202190a83b5fe3d347878c86cf1d5054ff4a350a2e19a98acb0a2fc73bdccab15dc6c8c88
-
Filesize
68B
MD569c603551451baa0c67f664b59a72924
SHA1a868b26e5d4fba294e1dcd9d22580655f4b32f8e
SHA256820018ead9f9f18fb12c2f17dcd7520be47f1c7f4ab7091e2689284fefc30ad0
SHA51204754f5f256f9432ecb42e430bc965cdf6bf019f934a89af40db6fb48cc75e104c40625b2b3650bb3d6b4f2f4b02b8f3d259cca5d29bd688f6403fc08caa9f96
-
Filesize
60B
MD56aaaf3bc62b8e4f3ed06ec11ab98b122
SHA1f51a8782347458f5b5155617a77316d88a889422
SHA256a36122a551839eb2b375d8b4464e0261d7b0cc7e69f862a87bc4c9f0d164844f
SHA512732ac12ccc9cae43aff960d8ae9571f7355588af1c3938ee9a69f8ffa4ea58894772606da384054b20338bcae580a97c864e7b1fa6c4b5565b6a045263794f59
-
Filesize
490B
MD5aecc0440e427827fcd581d5176d5190a
SHA13b09ff99b3dbd353389f7639cf2557f34addc495
SHA25631ea9a2d5f3f87d6721ed9f2087a1edc04191801c3a88e5895ffa97685bc0dfc
SHA5127e62f62f2a532af6c65b0efc06b5781f321344c7c7b12e61de43d0af4eb09b0049cc1e9096759eef2361873cd21c8fb0f8281e22242ff2b9b0328e50569e34e1
-
Filesize
60B
MD53a6f50d975f62db3e6b59ce1b68a1c6c
SHA1b4f8c681761992269d3f5df84a0fe841e13f0cc4
SHA256fa2f730fa9033aafec9b50b935d1cb2fb9146d9bb81fe5a2ac728e92fe54ed09
SHA5125366d667fae3c9a731f4bdf350b352a17ac460ae2e1c7243045be443320d661dc1ad7d3e7286b74cb555923d3f6a309c22dbdd2f8e8e139d0cdedd033320be60
-
Filesize
52B
MD5e569e1d8ab1acf5ddb4e9a4c1117f4ef
SHA16de40c26b593650828bff715bcf218debb7c1414
SHA256ff90e1bfbd8a6652aa091c915965d603cf056c5d053361422cbfef54302c2eaf
SHA512367900fa493cc75f75de675062e727ea541c7c344fca1ff5e93511b6e0e13aee3524a5adccdfeb0bb3806253bf5fd86061f099a53542bcbb71c6b6d029f91ceb
-
Filesize
66B
MD5a02343e3bfbdec4020ea3c457920cfa2
SHA19c1a8f7d2bdd1599c8530638aa024b1544e22995
SHA25625132320f72a0473ccd2573ec64cf7c84a4f8b97af47149e4cdce9dbb477b7ff
SHA5129c8ae17698602b1496b453ee1571c2dea85792e11cf5defae044f88bbfd74de739a7a57526427d5446588328f9c3ad244079c3aa70fdfeb52f341b85ac2682ce