Analysis
-
max time kernel
148s -
max time network
156s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
12/04/2025, 22:02
General
-
Target
ee667e8ff27ee1d0f85ff311fd762b3efb3490f89bc9d002718b08194538e9c1.apk
-
Size
2.8MB
-
MD5
5dcaa41fe1e56edb3b81301419c16f5e
-
SHA1
eaf0fc6948141a62acc3be1864a31a8b4a5fed18
-
SHA256
ee667e8ff27ee1d0f85ff311fd762b3efb3490f89bc9d002718b08194538e9c1
-
SHA512
e04193929fadf1de8c5fb74810df6aadfabb612e0b0cd5131e94196b87253a4e2b0c07fcbdb0213945bc849643f3459b91274a7a25d5dfc80c9c3f3d3d4a1036
-
SSDEEP
49152:ULsK1fhxdb87B8if7TeDrGLwnogyJBxNwIe7zoMCdbGdIHO6nhmD:ULsKL6Gif7TeMAsx+Ie/onKWu6nwD
Malware Config
Extracted
octo
https://196.251.118.53/ZjJhMzFlZmQ3MjUy/
Extracted
octo
https://196.251.118.53/ZjJhMzFlZmQ3MjUy/
https://196.251.118.53/zjjhmzflzmq3mjuy/ZjJhMzFlZmQ3MjUy/
https://196.251.118.53/zjjhmzflzmq3mjuy/zdllodgzmzq5mmuymami/ZjJhMzFlZmQ3MjUy/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
ehd.rrlafcz131⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
449KB
MD5d7ccb358ba726ca704e9708c5075afcf
SHA13163b95af7609efed9825941917a91634332d58c
SHA25648650104206d21d6c57544b53fad326b5d04d7949fefe1e0759f4c28eb9ab506
SHA512df687c68146fbb11baa8cd4fd8c51f951fb6d3fcf2a646a86968215cb9be190e3a6a8a0c40e77c19a85c2e05fa8623599e0e9ba2e3981a16fece7e3aa1ce4c68
-
Filesize
306B
MD578eb1aefa69ef5269f129944cc2e17c2
SHA107d717277b440bb47a8fce71767aa2a269177a54
SHA2563c8093f49353185e79dd96cb850d7fd3f4e2bd86800b21624cd07370be56a2d1
SHA512cf838374a45dc10ff43cf4d016bc810e515beae7608cdfaef0c9537c2fd8b0fe1b245ebcd658dacc8411a53405aa6d77429d810a36ab83dce4d215cd605457fd
-
Filesize
466B
MD5dfbaffa1808878a80d29c7446cbe77b9
SHA11e7c58fc255226a01e2d9153dc60b674bb66ffff
SHA2562e5c599b45c2ac2e1189d498539795df1c4354be378bcfa15f4f9526d226f794
SHA512b111ac281e7768e2ce956c7a1c99d19bcaec2db74772c15f1e8331b118f83925edb817df48426e5b53b2770283750d139fffe11bb5c8e7721be17b9f1cfe4099
-
Filesize
45B
MD5a3baefca2a7601f4c140e25074b11a13
SHA1a801a3290f865e4bce94e137571edf77ae414b81
SHA25685e55530fe0dccdc78110449d2ac2cd2e39430923484ae0363175a723a40d25c
SHA5129dea8ae03090878143d2e22214c0063e646f762e880acfae77f140721346162931a21b77c2d05fd52964fac310a79a53b95c72439a12bf2fe3996c79a6fdce08
-
Filesize
66B
MD5c0607342fb08f6fb5b8f36fb3c69e37a
SHA17fa1e4bca7088a92264c98de4eca0439075f944e
SHA256a18cb9e73cf49cb7d917aceeb59b00003468b03087efb645eea1f644f74c43ab
SHA512fc04521a26b79467ce427bec3e9657b33ead361f745faf22280d52a2a584b1ea4028454fde34191794f8697f995835a58421153102a7ef2b03d76253971c9f47
-
Filesize
45B
MD5fdf2ac8a09999ae9c15c6d66a15215b0
SHA103310afbc712e98b2400765f9f3932710ade528d
SHA2569cbdc55fc253b9f76bdb71fd194e6ddda11ccd21ba573bbae55aeeddd6085754
SHA512f54a13e5bf40bc115f576f3da4f95e6a6499ef5bea50e20bd529d14e109c29e45749b2e6ce0f489940935bf18bc42ee6670beed6b32abcdc73f214039b632162
-
Filesize
84B
MD58af38603d934339fd1794668dcde823c
SHA1f75185af4b673cebc5faf9dc841e5c4bf4a26dfc
SHA2566800def543435027104622cc9db78c518a7b4d0e8ee9261c8f0cb0eb23fac42b
SHA5125c5b07798889a2b38d145f5160fba2c2a7060709fc54d31ce71c69a9f60a0d5695ea5862f1a5c777da4af8913206f6732f457b3dbcdbde49928fab57cbe1aae3
-
Filesize
68B
MD564b7d60c3162e819e5273167cfa8ed81
SHA12cf46ade157e9123f04d5fd3469b7817a5e6cd67
SHA2568b7df5a38e73c0fb6405258392053ac3fceceaf939b0268631e03f1cf724f962
SHA512d07b9b41198673efaaab4d5080b2f742d47c6e1fa921727217b3b1ed131ab2dcfc7b05bbf1738f380d3a9f2a278d81b38adea874441388858975b2a9e6bb3542
-
Filesize
68B
MD56076edbc190c45686a5bf5bad86caa61
SHA18c01c1f57cd8b098c653ae6ec7d462a960b1df33
SHA2564a46ea483d6055f084b64c95638522344ce4a6938c007a160c51269b28b8afa7
SHA5125bb265a460373675ae5dab8e80503f8a6424354bf81f581765fc064c7dec2b99217fc4c46b10d924178ee45a8cb7919db50da197e87d3bb6a9bff741ccc4144a
-
Filesize
230B
MD5590ef6ad55c65de84acea6fa06a21fbc
SHA1596f9361fc9661b56facdb1dc791066384416467
SHA2568f159889ae8977b197603daa75a1cd8e8ac0d0c1c10118625b83e67b692f2cd5
SHA512b46df23cdb54fa10d4694652e8f1ab17bda9ec94af7d1459d35991bc52009a30c996eccbfe95a182851d9b9ffd778f6eb589146ea058bc3207ddcdfa2abfc436
-
Filesize
54B
MD51c56c0e4bdc4e16741701512db53a638
SHA18e512d194a86f08a433a395fd597b2e14d14c848
SHA2566a2fcb837623d55d3c2a52b47e6d8550ee679e1bff8da5f5118da04d2318c53a
SHA5121fb912f7f768f75337f76f70e75133b71ebdafabf5139d51d33fc05f5782ed4811de535380182841ec4fb5c51cedf84798b474caaf3c0a196eda025d2cf99e07
-
Filesize
63B
MD56253a5f23a78957614c77a26e710cc04
SHA1238a3f998dd23c0f5e33ec56032d05357573cbf5
SHA2567cb5dfbf723f5470b3c56803435f27063b15136c4490707af0d13c56efa1f6c7
SHA51299d071487a987c40ec8d0c93feb78a6ca5476ae18f90dd82589e74f745ea49b0615c209c70993a5d82adb9067bdd12bd22f57da9a686ec6db797a6d24a9642c1
-
Filesize
45B
MD5cfd97511a46eb22bffd2e31bf39b911a
SHA1da7fd9324db1f0ac6ad6e746d491703c34f1df47
SHA25604cf3124dbe75036e910c01a514de6c9d6ac678630975ef0f6ef4a45fc483985
SHA51296b350203072c167e24b6a6b744d5d9f6ee7bf89287ac0d9e613e0f7ce38b597bac13abea204d98e85a9459e487e4c9a4eafac0e146bf9f046fc0a63c903afbe
-
Filesize
63B
MD5547f9d77831fcebbf8e67df488dec292
SHA11b9ad7e234313af528abcd69f37d9c8cd7a5a624
SHA2564f3126a5e87ce23cc1b1f8123f3cab67b6c454bbbbca307191a73ce8a591d48e
SHA5126349fb518ede82af3f6d659299871525420b0b367046eefface4d30f9cf0015839aa1bd940799eab44f536a06d9846483c50cabc19d242e4dc79ff6758676a93