Analysis
-
max time kernel
150s -
max time network
136s -
platform
android_x64 -
resource
android-33-x64-arm64-20240229-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system -
submitted
13-04-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a.apk
Resource
android-33-x64-arm64-20240229-en
General
-
Target
173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a.apk
-
Size
509KB
-
MD5
913847e5845268f10a4a2b11024827ea
-
SHA1
b542051df3e58b6712c5a72361a5d1c686233ba9
-
SHA256
173aa89091bd450df5cb0af509b8ddd74ebb2097433e8f2998edcd3848647b7a
-
SHA512
c8b2804a0896b8e2b4ee58e4358f14c7780e5a2e28c01bf5ee31fdf17d3c033be728108fc775adbb2a0d6875b13b82240c8feb390fbebdffcbf4f1b6683f7391
-
SSDEEP
12288:tSkTYtBbHmGKNuFak1Rsg8c7kdwmlzo1wRFY4EsQWNSznw:MaCZuEp8m7WRFVqznw
Malware Config
Extracted
octo
https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/
https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/
https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/
https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/user/0/com.nextfreele/cache/bsngvvpe family_octo -
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.nextfreeledescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.nextfreele Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.nextfreele Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.nextfreele -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.nextfreeleioc pid process /data/user/0/com.nextfreele/cache/bsngvvpe 4289 com.nextfreele -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.nextfreeledescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.nextfreele -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.nextfreeledescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.nextfreele -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.nextfreeledescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.nextfreele -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.nextfreeledescription ioc process Framework API call javax.crypto.Cipher.doFinal com.nextfreele
Processes
-
com.nextfreele1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.nextfreele/cache/bsngvvpeFilesize
449KB
MD5f25308b4f6e09ffaccc0f15b94753d6e
SHA1b14cd1afaf222f7fc6f19d796e794b6fcd26b3d2
SHA256cf1999bc0d3634c395a01a9959ec67c0ef20b421115247f0b191df4db859458e
SHA51221102e789fa44b2717a63f074de6838e6f4e6150d4e251ac98ce3bd84a9a658e36bab3c2182c7a4c1d63363eb2ea8c213c3a9f19a7b84b81ae415a82bd7b31f6
-
/data/user/0/com.nextfreele/cache/oat/bsngvvpe.cur.profFilesize
398B
MD568b1eb268beeaf2e20463ba5f55cff13
SHA1c9d9cb255d9f41e05533507f0aa7ecf7b8bb298a
SHA2568ce2440089c516b7add0be9c33084780c5277e5dfb2f8158fe56d86db6140152
SHA5127e118a0597f35da7cd89c9a4e2f5a841e8c8b13c0f948272282ec9fc55d740d47c2d90c71d1a59a92e61ba5d8b45dff657376603c45ea0a451dce2bbcb21e8a6
-
/data/user/0/com.nextfreele/kl.txtFilesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
/data/user/0/com.nextfreele/kl.txtFilesize
221B
MD5c146de0ecfa6ec54d6b169189a2d26f3
SHA1973cac9c6fff4ad1ca99f3551f2acb7317ce2103
SHA2567d3bffaba1fd7eeda5aaea4d26ab877d778e7c90a51e02d0fab905effb2b5bf4
SHA512aa6411f9508c31e153cab2ecede1977362cd9efda31333f473897111f0db1fa055f7d5fe964e740fc9f476e758544751ad9098a04a3de5a6cc51d792d8631535