Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
14/04/2025, 22:02
General
-
Target
d2f9eeabec8e077a9464f1093685396f4e49da39aa7442feada9db2a3f1b6152.apk
-
Size
2.8MB
-
MD5
119be7ab68ff6dbde4d1f94a5dcdc2d8
-
SHA1
314a4809c23e200f3fa004498829dcfdf26cc1c1
-
SHA256
d2f9eeabec8e077a9464f1093685396f4e49da39aa7442feada9db2a3f1b6152
-
SHA512
03f15f3e8c659522d1059daf59608f8edaa5a7201795b8c88c2e055ffbc3bf98c058d4caab8fcbce8a8193645760afc9c2e073b7b1964b537ba4a53519c0cac5
-
SSDEEP
49152:qGFH1fhxdb87B8if7TeDrGLwnogyJBxNwIe7zoMCdbGdIHO6nhmZ:q4ZL6Gif7TeMAsx+Ie/onKWu6nwZ
Malware Config
Extracted
octo
https://196.251.118.53:7117/gate/
Extracted
octo
https://196.251.118.53:7117/gate/
https://comolokkm3e.xyz/gate/
https://196.251.118.53/gate/
https://196.251.118.53:8080/rootmd50ma/panelcgfuzwxleg9kdxnvy3rv/gate/
https://196.251.118.53:80/builderxxxzz/gate/
-
target_apps
at.spardat.bcrmobile
at.spardat.netbanking
com.bankaustria.android.olb
com.bmo.mobile
com.cibc.android.mobi
com.rbc.mobile.android
com.scotiabank.mobile
com.td
cz.airbank.android
eu.inmite.prj.kb.mobilbank
com.bankinter.launcher
com.kutxabank.android
com.rsi
com.tecnocom.cajalaboral
es.bancopopular.nbmpopular
es.evobanco.bancamovil
es.lacaixa.mobile.android.newwapicon
com.dbs.hk.dbsmbanking
com.FubonMobileClient
com.hangseng.rbmobile
com.MobileTreeApp
com.mtel.androidbea
com.scb.breezebanking.hk
hk.com.hsbc.hsbchkmobilebanking
com.aff.otpdirekt
com.ideomobile.hapoalim
com.infrasofttech.indianBank
com.mobikwik_new
com.oxigen.oxigenwallet
jp.co.aeonbank.android.passbook
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.nameown121⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
449KB
MD568303b26471d260524fef541491f5f32
SHA1d75c1ee936588cd530f6f4b7b0b4d81c0d7c1a14
SHA2569c5a2f908328f224663e5df788f66c03861a86c8b4fc6b9a8f2c157e7c118a0c
SHA512300b0c9a5c6f51cf1d2c89004f76eb804987febfe608f3817fbf5b722211ff693c577795dc3af152164a388c7aaffa90a6057a5d96f1fbd3d38bf75483640582
-
Filesize
371B
MD55e7c67c83e80624d554f2d6ca8c39fdb
SHA10466029b323136636b7571f735275cb762cc21e7
SHA256da68a20e1a83739f1c34ac5123b1719a24982be059fe58868770d806c18eefc4
SHA5120a0359aa2d7e9852879b8e843efd72307f42fc0c5582434cbe5b9ccc6a899f7a1c93c597e8c7b2c13162a476794752a7c840d24f45a237aa2f818db2a7e1051e
-
Filesize
70B
MD53ecad822b57929e5258d10c504914aa2
SHA18001d73cd25146c510aecb96eaaa1207f5af0e52
SHA256938770d45abfd8d70d923215ca6ce81d6f8531deaf2a7238b73b6ec6917095a5
SHA512a65fba80d4fbbbc65148cb45bfac6d05dc8f1fcf1f24d065f8b9577c532339d48ede90e9e2eb723712202e5f281374badf71fd00327cb859450deabadea847f5
-
Filesize
68B
MD55a5f671888fe26f43454883297c3c9b1
SHA15c3ced1dc3add8b10e336f3c91c918b4f6989fec
SHA2567dc7e86516830cc63efac48dc5731119ad4cb0f5b06d49c4b194e7dfeb140992
SHA512c7a8ea942e538218781face7c557de2180486112bebf954e8651757663137f2818511083784f3ef8104bedd7d88a4a9ad29d87f43677f75b9de9163b80c020a9
-
Filesize
68B
MD538c440c4ce6c6ff45105bfab181a1781
SHA1eb46230238fe794979bbdec04ac5f775dcb561db
SHA2568f7465bfffad9c8beb824f4e925552befaf251569d2c8201cad41a7b6ed3108d
SHA512b4703fadb804cdee8e4bd2290844c212e4fe53c911546246ae386bbfc422f2110252eab29bdb040a4e9ac76681c908eab0bd14c0c64dedb00f0cc688dc3adfb1
-
Filesize
84B
MD5d4d926edcaec9fc539edb0640da808f1
SHA16e5812bf6431b5514b1d596dfded2f60a277512e
SHA256529c5bf0f9ebf65415f6a385c57db6cec0bfe66625f096805a5fe4734cf8efa8
SHA512bd8d8beabea6097dced6c0530658852245f74dcb6c9059999294465fb2d0a59ccc4668f7811ad383d2d8d9ac6f9f13f39fde4c07112d228b980bce9f1f101836
-
Filesize
214B
MD5a4de0803a4f42c7b03e5f14c9208c8ae
SHA161c7c1f0e8fb2c9f641e127f3fc82bc13f204a51
SHA256f5a65292c559e79a94ec60bcbb53aa2705da9c1f67d65272176af8a9649bb28e
SHA512366f072beb0ff4673e8934fbdc7da002ef748f6ef64ba62195bb498be5d0e9f5e1acbdfc3f1f96bc27242a3dcee6f88b34bd29c09655afdeea9665a32fa4bf64
-
Filesize
54B
MD5a5ae2a4c722e7e6d3a31722a81233a2c
SHA125ca8882368e2ff454eb84d619758e23963afd4a
SHA256117999f725bd9427d38303a3f05f8d36df22018f04a9afe9ce4df0e86d90b4cc
SHA5123d649dcface696c864d2071c38a48c605e3ffc15b5970071e4a5fc59f7c945e72092ad8da387a5c27575babdc307c3d0b4cc87964185d293c617d3275e6e7b2d
-
Filesize
68B
MD5de5e6b20a11c4c0c5dcc2e365d52f7aa
SHA18323cee7953d9042b65f4b6444dcd412fb06668c
SHA256fdc3e55db0634196fd8e19cf20080ae8cc7b1f73cd141968dbc8aa2c1a831a92
SHA5126df8c22f8a8719589880aac87af3e6dbef528a6de8ec16bf5bbe1963b86b0e2544890dd5eb2c9c556e669f050bd418347e2ffd989996305a3217f26a62a3dcaf
-
Filesize
60B
MD5c623e41effaeea0f48f01ef310a11195
SHA1235caa50d778bc8ac58bdf9f67b56541ad0a5109
SHA256a9fa35fd7e08b0fbaae3e934531de0fc669389989b7993b681997cbc8e7613e4
SHA51276111348a80e4076f53a5ca5eb7eda058a99f4599c4c652ce0a8df34755a9099d01ad60f8a832163f8415de05c18485c72dde143f568d6de501a8fe752ed0ce4
-
Filesize
490B
MD5509e258e6d96673d5c75cb1b381ef7f5
SHA1ad7f046999c40b602a70829f3d16433f27102620
SHA256f64d6feb850d54b35215ca2278b3602b5e4074e65f6d1c508fd589f6fd6b5910
SHA5124e9d02324d3130a17eae53cda156dd81567557443b3888f57c056abc3e4876efc7dfb7bdc7b34a5b136a474e4744227a78f98cbbc363767f3d11e80dbcdd6c15
-
Filesize
70B
MD5f1ce81dcd5ca1a46297a8064bf9345fb
SHA146b2975e72500526ba233438f6682695c05cb981
SHA2560f2252b7cf8e6dcdede276db039622ccf24485586eca83f39cc6ececf17d7f9e
SHA512017d57b435c1940b4ab5f844d30f61894ef5fc38ece75431bf4556671bc9db24b967a5608057a5c00a09f70f65bfd6b0dd40d384c40966e2da4cf48042a051a4