Analysis
-
max time kernel
150s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
13-03-2024 22:00
General
-
Target
bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf.apk
-
Size
298KB
-
MD5
0cdf9620bee1ded109c511b160cfe4a3
-
SHA1
67e865c6420fa12215eb732bd180dfc6ecea8a46
-
SHA256
bece14b4e9fd1fd8b237fdee2b0c2739a8de0f84f72c7770d90d0250fd21acbf
-
SHA512
9f54a98821effe043cd4c2c58dd3cd53de4f443ab07c96c1caf5e6d2d48863efcfb4c0750227deff7f74c9f707b75f912cb94fc7f08a96237af28440767d2f47
-
SSDEEP
6144:C+SKpd5ol4JgS3r0JrkuUbHpDddCOdNR8pbNGbszlKrPI:C+SKpPoGmc0IumHpDddCOSpkslkw
Score
10/10
Malware Config
Extracted
Family
octo
C2
https://2.57.149.238:7117/gate/
AES_key
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.nameown121⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)