Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
08/04/2025, 22:24
General
-
Target
054428f86bf6fabe10063194320f70159d79c8cf87802f187fef45a50a4effe1.apk
-
Size
297KB
-
MD5
6fe2d7919c60ec71a58c1a6c7367ad1f
-
SHA1
85d68d31086f3a4bd1f8e984d043f136bb9ca85e
-
SHA256
054428f86bf6fabe10063194320f70159d79c8cf87802f187fef45a50a4effe1
-
SHA512
c3d98fbe50c4a48eacf477431ac001d20303b63c3a61c1235e6c965576e609c9ec5778f249d64c4299b67cad94c5efc7d270797dc3f593243806da0b92e307af
-
SSDEEP
6144:OOk1AkPZFWsJPDNd857JyxJYxQSWIVc+Ey1I7JcaqeJB20VAb0UT:OOxqPLyJ+YqS5J27Tl2T
Malware Config
Extracted
octo
https://196.251.118.53/MTNiNTc2MzU0MTg3/
Extracted
octo
https://196.251.118.53/MTNiNTc2MzU0MTg3/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
449KB
MD546d072176eba8574f1daaa5d787f6de6
SHA10adfcec21fae4d39447d5b8e05b4c90ea02c0adf
SHA25643dd770d7e52ba3d1b24da8c83456da8a77f440906ba687332a66f9f5bafa5a7
SHA51246ca5c48d304d092ee5b8fe7a315aac3f45895a5858abb5a1390a3f59a1faa6557e8259cd5fedc90ef0d9de81080d567e22aeea1256ff2277238f46d60f47c05
-
Filesize
369B
MD5de603c5d81f721adb0bff7b549334714
SHA1bacb9b01531945e9feaf3a01897e2d19ca0470f7
SHA256ca823be1021eb04c888e1ebddfe6fbaedb0c89532ef8a1fca0a382bf38be12bc
SHA512bd2faf32f85f17dc6acbe64069d1d7e39cc6185709a635f62aa9496ff26e5d0980ac1fb28fbb8c535aa0a9fb2c2de8dd08217f19f9057c40b6857c57a843f5ef
-
Filesize
68B
MD58b59eb7ca9aa205ddfd1844b540d4490
SHA1eeb37f19c2ea5befa314985d4df18d23b34a69eb
SHA256036d13dfcbd8b556be443005466e6ad81edefaf3d7f048ba7c6e268d6daa82be
SHA5122e823910dda0a488891fba17b2d98373183faabfcd1b09f67d56a2336ea3b049d8aab588a85ef96c7c0edfef0ba5930ba1f399c35d25f82d7f6017a48e951c2b
-
Filesize
68B
MD5b76444e573fd4d5ab59a0dfa09a060e1
SHA1d1ed0d7e24adafb6d5d3e6bd7c3a5a1b38efc5bc
SHA256542158d11187fc70119e7acef6a9c2776249dbcd9d87db7ff7b638369ea66d69
SHA51221e76be5d05e9adb20ebd1df8df3909f08372c4c254cec48331e7dd8823aea8e27a04cf135017885db85d1b0cef063301be75fa91b291c6b592e3430aff5206b
-
Filesize
60B
MD501108e7358a01b8b46a427d4e4742212
SHA10dfa3a330ecf49f10e7955801f60966af57238ae
SHA2567ca2291fa1bb9d478115eeae105267978d2006c94a1c44007a9d8ce4080c0fdc
SHA5121dc126704cc50b83ec6c2f64e7802db7a8907041a1bbe34fa5647ed21b143a5b9b69c23a17812afa02a495752c58b5a690e149660fd50b57739561b2b67f2b26
-
Filesize
84B
MD5249225e333a41a2c3d04cfc9db564696
SHA1d05df98f5ed6319fa3c445cc3deb325915ff73b6
SHA256f068146340c006f152c112250b6c2cef92fac3e4cf63a517590641b285dee7f3
SHA5124bda4b15e465189f638fcce6acb13c2a5dca565181276ea0ad42b020138d05ac990f0a43191eba585b78b1a6163e3d15bc1c77579d6b4dd878987c270dd845ba
-
Filesize
214B
MD5851f049c4d2177d63cb5a7f3f79183dc
SHA15cdb3eff44aca80cd7ac323ea9e85950fd43b8be
SHA256d5163ec67479da6df5fefdc287f0ec7d78355a425f7d58915732e12299aea1c9
SHA512c3d25c19af7f97cfd0af6e5cf4e4dab5811defccb3af574c7b5f50280ed62319ca3b7ba4ac380842d651de93bc118e890b895a131027587ba93533d13000370e
-
Filesize
54B
MD508c1ede3c0eb63225ebda28c8c53ba77
SHA11651dc641d0a1a29b572b4afecd11855dd520ef4
SHA256634ccc9751ccbff826facb3bef0e2a1497de944a1095e318fd6e6eca56302c9e
SHA512a9f853647a46eb3cef276187a5fbbc44796f5a7bc0b22c460fc4ae5f901c7402eb0708dfd734fd725015c100c65f7445710ee035610ae4e18e2e9e57f12267df
-
Filesize
68B
MD5f1eab3db843678966f14eca501aea20c
SHA1cc891eb0efb747bdee60b473274904c37efdc464
SHA256bd622839a141e63f1b19d31746a836b8729212ab97d569bc9a48a1234c58d467
SHA5125f3b7f4afdb5381cedcbe43c3609e3deac1871a586a761f84a00d6121900377da7a0938b0c4522cd2e266882be925962097915b4b302a3aecc03e2d7a6dd454b
-
Filesize
60B
MD59a7e5afc418ec61eccdc903f3880141c
SHA15695fdd043d0fbc038e6338104ee1962911b2541
SHA256c8d82936b6affc4a2e652f342db85c28e30017a3d788f2d25060f5fef11f2de8
SHA5125dbfa3b1e25e41f6c2f0f649d6428858497d2906f77712f7cff2010b2fddcd58478030be141ccfc1397db274ea8364345c674900089a4f8023731898e3be8c0f
-
Filesize
490B
MD569f6e98d68ebc4c7b02a3d09b2c2df4f
SHA1ffbfd19f9a67058b38141c78dc4a523737f7193f
SHA256b1ab67186a7b0f3b6435c68883c365ed725b5e322dcf5a701f148090e469ce03
SHA512cb745c4bbbb0371da98ffc84b3ec0ff572140b6a076998190d483369de683afacdba24a85c0902877c474e5e9234ea85e2d56b4d808202422410e8bae3118df0
-
Filesize
70B
MD5634d4d7bc219cc5ba07f9cabd63323b0
SHA1d4eb1ab46d9beb66cbdac94cfb2d4c0445982cf4
SHA256a3891e94d81ac10bbae60342d2f35e28426bc80521f17127040f10b656ff4987
SHA51252fb5cc0c6172e1abaa6870d2c15deac0fc3c417f6fdedbce71372f782577985ea15d9e6e29b440fd61d11e28aa58e52ec568afbcc03444d114b388dea7f9219