Analysis
-
max time kernel
149s -
max time network
137s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
10/04/2025, 22:09
General
-
Target
258da28c6c8ce9fbaf05ae7e38535a804fb334675ff49c9765781f42817b4d9f.apk
-
Size
297KB
-
MD5
f387a649697df8fc57ad1e340073282b
-
SHA1
e189abcb1a82c206f3c5b431d23f5f04b96ab0ff
-
SHA256
258da28c6c8ce9fbaf05ae7e38535a804fb334675ff49c9765781f42817b4d9f
-
SHA512
7e60315efe0d055ae3e31413ae39087966c6a90f7e8c01e2c9a3d9a90a05f4b160438fbee91413e02d4b629004eee9e9283e0ad2837025ddadcab35b153249ee
-
SSDEEP
6144:DuHsUuM3ySn13SWoqm3uHYG+PmXgIaCY/s9aD7JcaqeJB20VAb0UDn:DuHsBKNoh3uHYG+PmQd09aD7Tl2Dn
Malware Config
Extracted
octo
https://196.251.117.226/MzY5ZDJjYmY3YTRm/
Extracted
octo
https://196.251.117.226/MzY5ZDJjYmY3YTRm/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
ppd.erajftc141⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
449KB
MD562e8df988a0c3258d989c9440335c24e
SHA1f581ab44efcfffa3d804a2bbf58bbdfa0d4949e5
SHA2560028f148451b7afd6b6ad1bb735de6ec73a33f84a7dc0dd9dda87033196647de
SHA512fb5a1f6bd1bd11a25cdbf4b1afd832be7327a0eb2581a08a8a0cd63ddbb3d663d569fe3a6fd269290123c45b797dcff0e82a37f8199f31c1538c9ea3bf6f87ff
-
Filesize
306B
MD5061090d5bea68429581a8147cb69b5c5
SHA1809854df2545ea42b359c4f0834004d9bd027de4
SHA256e10421c3e569bd78735600ce94586b23b99f4d621f50e25d280f74d56cf12711
SHA512be43ec9aa0fd346de446923efb56e98e08510f6ee1a4a1259f98bc025a67300f4de58f3921e94ecaae0f55f64c5fd119cd5f8aaf01dc66dd895ba19144a91dea
-
Filesize
466B
MD5cdc0eb266f6a0d06673aee6e4d86763b
SHA1e56a511caad85a1b11633d8e56f91e8bd33de8c8
SHA256e7cc8e4cf0bfe90debb778772bff0fc5b815cbd2bbe3d572ac356b87f21f5357
SHA5122f5795c5520ab893e2db8cc0658d259a16c2964e8014c195914e97397edee09c1c067c168942d424a17f3d367378d456c5074ab0d6d9913d656bdb35559aac25
-
Filesize
45B
MD5d37a81fff4fd08a37b8cfe3973795844
SHA1aa3c032afe6ca758cad0880bb40ee64151046148
SHA2569bd9fb2fe430c75810919e8dd6f1ac0742ce60ac52584036efef30c348c78abf
SHA512a30ab8fc2293aa059f8c78688dda3bc4013e96d46cf03daef06858bf3d64856f1708ad1d8955a6b7148ae5df02deed13be326fb3708a572d959c89742053f6d9
-
Filesize
66B
MD569624111c083e23c566cdcec7efacd8e
SHA1495100b5afe12d6658cb522364007c3fb991ffa4
SHA2562f16965af3e474c1fee9ab16c0705e47838a9bf81a578567f21585355f611894
SHA512e9d6e069f33042749bea0c4c22421813aab736a13d9738c190a10f36821978866ad93c536f9c36e444cc899edc2de81adf16de0856b489b37a697c6995aa52f0
-
Filesize
45B
MD582995684b4e7601658df291c37900db0
SHA1bbcc45134c6fc005a93aa9460cd7ceb1db8140f9
SHA256e1dbf95465de3e2112c52ed3f4807221390f1981e8c26b7e2d862a9143b9ff97
SHA5120ba008079b363609af2ff7a2353ce6d0fd340ffaedde91253134ab7aa7737861b524d3b01636932a8c4e28fba28aa6b63c5c26ecf6fe0a165d85c687cfa43b67
-
Filesize
84B
MD50f8d1f8d7de3f2d5a30c15eb6433eb25
SHA176bf17826d44449cee81dc3bbea9e29bd235dfd3
SHA2568439f353c37cdf66b9b200ee975caf679e47a8595a645070f96ef23e18cf222b
SHA512d4a23f3355cb6afc94f705448bb23b248c34b5244baf266d17ba662c9d3807d83f99ed8e08f15c2ebbe18ac96d4f29c8b409cdadbb188a2b0762e0033cb2a8a0
-
Filesize
68B
MD5fdff61c3bc84a060834182b199e370c2
SHA1f0f3ad5c5b099721eb1541c493f6cb5d91ca0b02
SHA256efee186db42311c117c423e3def3a16cdaf9aed1d007be3f34155a9ddf3a40c8
SHA5127f4bccdc718037282365dbcfaa70cc8da762f30f812838ab944856a1976db47763cc8a081747cf9eaf8cae283417943a2dfb1b3217da4207d061bb73ce64ca4d
-
Filesize
68B
MD56e4db7cd94f5752184d879e9bc1c39be
SHA17e2df0225fbe28cf58393270bd4304757dba9491
SHA2564f1faa6a49fa56afacd1281e5c763a03bc71b4531e1717fbec884c63bcf56cbe
SHA512f8418bc9d60c5dacd973e16b11ddff68c727e40a6a12632189adfa94bab46039efd3c9c75cab3445f1418065a21aec2a3964a3c42692ead20dd170e1fc72563d
-
Filesize
230B
MD51f37576cb5b4a98c7fbdf7c9568334d8
SHA14ec6e0242974cb411e0d52696f7117008fb7cdd3
SHA256e6621da4bea3d8c57464fb1c9c5418d1a32fb077580b68df0d1c976d64e73aa3
SHA51200dd4dd03be1ef67cf5010a07b08a38f2826e2e1657f10103ff4b857fd4e145491fce459dc2236111ec5c74e94979f8d593f66e9a786fb0321289c7aea175b40
-
Filesize
54B
MD5358d664cc0891646b8b37b9e9c464eb0
SHA1777e4058a2471005b1e9d9d3afb3c5a154d44c95
SHA256fb25f2bb73b7fb636ad1bc838368b2f6f2efd08f416e6ff5bfd0689c9f517853
SHA512b233fc8177f5b014b1f702312457336b10577ce30d815260811005eb1742b7d7dd716bc19d538109c820b7fd63508d0e9eff1ab6e98270c73c262ebe3e918973
-
Filesize
63B
MD5d482fa16bd83896f127272635c5011b1
SHA1315902adc2988b1c8cd89f9608eaa3440a55f557
SHA2566641c4599009e9255c522a521c8613b75d69c4f7dbe1183ef653c80a905e172e
SHA5125bbd42ead53123f1bf60fe087e792e279e55af2d678aa1146905af7afa37d7984fcbe75c8f771702e360f2c1529049ffe175a7ce4d12020cb348596beb343491
-
Filesize
45B
MD569b468b736213b06304d887ff18099d9
SHA18d333c6bc41b1fe6f2659a99286252775f846f94
SHA2565b4133dc76dc66195d8c2f7f6177fb61f870029f94951c7087d54f17a8c69947
SHA5127008a6e06854bba6b925dc7d5889c45c7fcfd2af8ea5abf76b24c85a60f30b795e5875032d20821f496d7f9628775074465412ecaaf85fb55ab5de48b2c34e44
-
Filesize
63B
MD55ae98266e6d982436eddd6556c42144f
SHA1450316bb36db388ffe188ef2b253c601db8e2722
SHA2564705b2f80ec370024f8df97c3c68c20325225d5826d3be6fd802b4dc8a2e80c9
SHA5120bc72e1e5b92fa313175db4d8db598a4e2682282c5e03fb460a308ead29926a20ab0ab13775649816cb0e6d10192836147cf649029830d8413cad5610135bc2b