Analysis
-
max time kernel
148s -
max time network
158s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
12/04/2025, 22:01
General
-
Target
62cee2ecb2088a4263680cc10224347c8675d922c4e5bc62ab1b09ec371545b1.apk
-
Size
2.8MB
-
MD5
8042dc545786a0941521b95699e42e2f
-
SHA1
9296f8b32e970a426ca801de24faca80ce28f542
-
SHA256
62cee2ecb2088a4263680cc10224347c8675d922c4e5bc62ab1b09ec371545b1
-
SHA512
40c1fbbbe5e0a3e0d19dda0a674e87b8aa6825872f352d7ce8b9b66dfbe48611f19f9c1affe9cd8d78a319e1268cda6483eabc10e7589e425f3506068d463a7b
-
SSDEEP
49152:ULsK1fhxdb87B8if7TeDrGLwnogyJBxNwIe7zoMCdbGdIHO6nhmc:ULsKL6Gif7TeMAsx+Ie/onKWu6nwc
Malware Config
Extracted
octo
https://196.251.118.53/ZjJhMzFlZmQ3MjUy/
Extracted
octo
https://196.251.118.53/ZjJhMzFlZmQ3MjUy/
https://196.251.118.53/zjjhmzflzmq3mjuy/ZjJhMzFlZmQ3MjUy/
https://196.251.118.53/zjjhmzflzmq3mjuy/zdllodgzmzq5mmuymami/ZjJhMzFlZmQ3MjUy/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
ehd.rrlafcz131⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
449KB
MD5d7ccb358ba726ca704e9708c5075afcf
SHA13163b95af7609efed9825941917a91634332d58c
SHA25648650104206d21d6c57544b53fad326b5d04d7949fefe1e0759f4c28eb9ab506
SHA512df687c68146fbb11baa8cd4fd8c51f951fb6d3fcf2a646a86968215cb9be190e3a6a8a0c40e77c19a85c2e05fa8623599e0e9ba2e3981a16fece7e3aa1ce4c68
-
Filesize
365B
MD5b31104784b013b9a03e10313d0025e1e
SHA13b7bf37f396be58a7de97d9c3afa90fdb4a50ae7
SHA25632c6b44ab6d9cbff88f0c8ad9c18954870b745824d297694c7be2ad46a6b7faa
SHA51210be09490ccf48de91fc535224a33bfcf2d0fc166df6fb657806f6a7682f6f57b6ba38edd216516624cbadc1e3fb6f3455713588dc3af5ae845fc6e07568b0cb
-
Filesize
45B
MD51a7c982ec340f5dad64e1b83f97641ee
SHA1529efe32ccd41803ad7f6cb2fa182b7524673a30
SHA2565f5ee24320bbdc4b8ccb3dd26e2d6c1c94291be64ef00ef0c19f676c10822754
SHA5127265deb26ab2fc8979e2a964cd7abdb69eff7e0d9b7c43d7e5b98c7fc5c0700dabd793ab8f60e27000634237279107753c056c2116ad69d915f32ffdb2ccf1e6
-
Filesize
70B
MD548a58ee56a8d6038d0f7af773360bbed
SHA1f5626d1424256b68655a5ec3622b5b9d186055f4
SHA256663f67b124792121ee1775a46beb4c08236cb43563220f10bd450b9018829939
SHA51263b965a30b96ab803925458979b1f888465003fc466e1acd702407589e5f95e70b6aa305073c59a532365f05ab50473954e2b86355460dcc194506105e5e929a
-
Filesize
45B
MD58d70b2a87e7f2f67b719e09fcd791a1b
SHA12329b052ae54dbdf1e8cb0ffc2e7248726949dd0
SHA2566d9a7239f3fd4f7273ca7e490982632d568229960da153a9a1d6bcb9c6a6e985
SHA512ad59d6c98808adc568742020962abce0d287ffad8fc5119184ccd7291d397bfdf99cd02ea3f8c35e819480309e38397f27163053ab3ff2cb0654114452cd5a80
-
Filesize
79B
MD5c73e841aa6cfca095519a39820cad874
SHA109583292198ac70e22fcf1671667eddadf2c3614
SHA256b4c5cd636c1507b5e21c9a0e4c0ccbc76810bbdf5fe2e14f0bd926c5cab62773
SHA512a53e9da7c927f3966780a37b31aa46b8edd7ba4c419712e6e8e42c43dfb4fbb728e841a3417b9584aae8a160c1b4b9027d5bb0128ed6700e5f63380bd70faf3c
-
Filesize
490B
MD54290af4ca648295c0e3598e5b818c303
SHA14806ba94e355492d0be5ee4c1bbd2136252bbb92
SHA256bc9377f3f4eb2d5d3873950c46303a03ea9b93d11da72b524fb7d0bedd6cfdf1
SHA5121bc3be9fa0c48d3d0e0395e320ddd315a365e97c7a2a2de0dd2d8c7af765da29c23e7bb380c4366ed6aea66c88d04cebcb68575b3b670f890d149764d81da6f6
-
Filesize
84B
MD542334bba8888c1de0e69b24cc1957ed7
SHA1c8160203b847527922e101dac4a6be591f84e375
SHA256162d3e3556775358da54348a1dd28f6b0a22e3ee2b0b1cab0512f50cc17b0c25
SHA5124448933c7cc4ca01e1ef90606dd0051a7433787063308079f75a6e52c6c4aeeb8da29f804710d25f4c3636673594004a1ffb4bfaa0f66b1ef1e5dbf66417538f
-
Filesize
68B
MD51602444a19fa87f1e7f38f50315d5573
SHA1b4e71801ef5ce4a1821a542244b1e020521d6158
SHA25614a3067c83852e7545f29990dbeb8ba9469e8a53382817015562d85e530f6a4f
SHA51213debbb71232b83038de88bbfe03d5734fd5f3f1688c9ff17d575e5a5684b374f40eec094f6b48e197add1a84148b34de426284a0165bc447e13e251d35154e6
-
Filesize
68B
MD54be85bbde585c2ada1bd8671a1e59c98
SHA1ea13343ab3287669ebb375db35a4e283fec502dc
SHA2560c60802478d7830a318d9881bb2371161958f4ad1c4b32d94a21d30d52d1f13f
SHA5126f755d072b0837bc624144a70b8a4f1224cd816f65add2d689b24088515e24f63b257936163534c25c76f03a4af8a3e90f5c1455dba95aaf5883d316b4e5264e
-
Filesize
214B
MD5cadca6c9b2dc1aad0289bbb9558fc89d
SHA1e15054af827ca1cbf06c61d1aeec61c2201c7525
SHA2564116d7b489d51ff24ed88d14e1e9517a7e7ac8c38e18e655bf41857761b735ae
SHA5126e7a1c29ce37c1996f9f348c1b1977bc6add3981817edbcb557e447acfc14fac5520886a41be413278461601d31a19240c7bbeff6c894c7c504e80f35fd76cc4
-
Filesize
54B
MD5590200cd42ea19b4a23dbfb78d4281ce
SHA18ed353ea78cd59c43cf9e9d9c1b423675d3c64fc
SHA256436d90277ff72e4dfe5db99112b52b8aaf3f90875e0cb7df0bfee1cdecc2fc07
SHA5128e55797276aecf75212d30f131676ad9875e1880220ec9cefb50f4cdc9f3c7eca649d82e039fa7f34cd9deb7fb19b8502ef918a4830316c6beb86ab7d97b14db
-
Filesize
68B
MD5987d63cce0093b8ae8a89f87ca187d07
SHA1c1cfa6bbf0d7954d95f2961e09c63f9fbaf578dc
SHA25689fd9f226ee86cdba000e028167f2a3766f13414c142e3b547a2cd0fa8023591
SHA512ed480d80c89746fd09a60f4b646b158bd5cce06c8cafa392ad02e9196ba71f1647366364027e9a3ad22a46cf11a0f457901b9ae6bb0590273cfc17544a8c4c19
-
Filesize
60B
MD5de349624475977315b287d5af304e8e2
SHA158b48505e316ea5371545b23451267e97ba3ca15
SHA256d86ff0c97efdd6044137cfec8d086d807d6e465b16de2d86c856ffe58badb4e5
SHA512984d6e432321961dc6bea4826f3c9220dedf35f4b1742a4f7df62de0933fa5732ed80032e04c2f93ff1a45e300dc303e42b0ef34c4f1be5f44ecb4b534a61754
-
Filesize
70B
MD5d6ac5db58c602a81141b50a17fe888e4
SHA148973834cb4aac875b231063c629e27dee6367e4
SHA2565e7e3e1916ae46c79b238a629577d9ad0f534e28ef9e35fc8e405999e23a26fd
SHA5120edf20a65af7cd2d984847baddd564f948dc693f3ae4fff1fb79e147b83a9a4f5d8b1b6d2600d1e80bd4d1c5334f855ca31ac9332649c05fdc0bf610d8b654ec
-
Filesize
55B
MD584b83e94d52060ab304dd6c9a313c43e
SHA1c42296266b622697422ab9df1e02048da7840226
SHA256ec5b259310c989c6e499b0c5093d2d9be3f973d5cc68cf24ddab63b29823c865
SHA51223530cc0c0961d54aec7897c208814af18644ce1327190ee5cfd52013686f31286dbc00c755e1fa97551a9ca2b1da90e62070ace777141076053dce902d65bc9