Resubmissions

03-05-2024 05:43

240503-genrssae99 10

03-05-2024 05:43

240503-gel8zage5v 10

03-05-2024 05:42

240503-gejg3sae96 10

26-04-2024 11:24

240426-nhtwjsfc6y 10

26-04-2024 09:55

240426-lx8bdadh3w 10

26-04-2024 09:35

240426-lkpy9sdf5s 10

Analysis

  • max time kernel
    61s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240229-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
  • submitted
    03-05-2024 05:43

General

  • Target

    1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.apk

  • Size

    509KB

  • MD5

    398d22e2d522ad3b4dec483d095ab0a0

  • SHA1

    57864eac5ff484b9943bb30657a5b8b521a04068

  • SHA256

    1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7

  • SHA512

    7d4c8aad0e3ea2fda730554f4fa8220567b94cf0e6a7c3d93112ea1b0b11cc972b00b3d00346976e664cdf82d672f94185f5868df9c6b9b81b2bee9748649b7b

  • SSDEEP

    12288:+f22AykQKMrEjYTYVk5B+vdosmXw91+9VYATRWcOqZUeJnPG:+55QjYTPMvdjmXw9M31W5MJnPG

Malware Config

Extracted

Family

octo

C2

https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/

https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/

https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/

https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 27 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.beautyship5
    1⤵
    • Makes use of the framework's Accessibility service
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Obtains sensitive information copied to the device clipboard
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4274

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /apex/com.android.adservices/javalib/framework-adservices.jar
    Filesize

    25KB

    MD5

    b7378810aaedc21703a206caa03483f6

    SHA1

    c7f25825108746487b3845bf92a050cd58d8696f

    SHA256

    ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb

    SHA512

    29dc68938e9ed5cf0ce51ed35ba10496ce703a9099a4a2dc4849470aa8f567b3052e08515dfee102f22c5b5bb6f2a4d21daf03b97a61e3d1d2964bc450956d37

  • /apex/com.android.adservices/javalib/framework-sdksandbox.jar
    Filesize

    11KB

    MD5

    898c6c1597e17488fff3ad1f075b126d

    SHA1

    ded41197706768e8fb5a27211091710de74f87cf

    SHA256

    e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2

    SHA512

    34126bb4f7e75a9386c5960685c2d6107b547ca545643a4158f09876d62e4a04e48961e01664ef9bebf2faa165952adb29d447281178fbdc4f157a079a2159dd

  • /apex/com.android.appsearch/javalib/framework-appsearch.jar
    Filesize

    145KB

    MD5

    45f2b5cef7279c9e721764da4618a83d

    SHA1

    c3b16d4e71bb29955481eba3d2e7bac78292d1ac

    SHA256

    a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7

    SHA512

    fbbdefd3117f8af38dc60676b85a86e7d38009bf839aca2d1d7f38960e05942befa7d5645f218cdbdba56aef6d7d1f5794ed3fb53c0f2134ec782323b03d7c9e

  • /apex/com.android.art/javalib/apache-xml.jar
    Filesize

    1.2MB

    MD5

    5c1dc5d635f8e0de770c930b244d72ab

    SHA1

    1cfab9c114f0e14bef8f58bbb5c46ea5c7f45581

    SHA256

    a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626

    SHA512

    fbe9dead311f0279587006fd60f13759635ae39f81f3eaaac71db264e2ef773788162fccaf6537f87e7b7b9d5a7e8cf0ff31561774686e1bc3fed0ec9bdbd363

  • /apex/com.android.art/javalib/bouncycastle.jar
    Filesize

    1.4MB

    MD5

    610cf8fc8e3b9316656d5d8562edf98f

    SHA1

    6c628e96dcc908ef390c46a67de435b06607a2fb

    SHA256

    b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06

    SHA512

    3adc4a3bea3ce819f1b5eeff0988d5cb131d850f2a3ac6c484e4b7f4ced566dbd081d0cc6042ab3caa344098650c0b1a4c5f691f7921d2cf1ca395e08e3222b7

  • /apex/com.android.art/javalib/core-libart.jar
    Filesize

    549KB

    MD5

    9dfc76933503bef1af365e42ed68879c

    SHA1

    65c92169881f1a10fb26a407494f9c4b383ef84d

    SHA256

    eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38

    SHA512

    f8ffef274eae3e01003cc8643de1eade69a5747978f3ec60d910a02d18445d776d997024130dc42dd92287900c6ba57463bbddedf045064bc2374669f00a792d

  • /apex/com.android.art/javalib/core-oj.jar
    Filesize

    5.0MB

    MD5

    f1a98ecb23b9134c358015fcab1f0215

    SHA1

    e71c1849677f17d5aa83a20853f3483136d449e4

    SHA256

    d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf

    SHA512

    8e2a6dd96a89d2195ac770320933a1938977dd55ac98bc822bf33646fec208a2354f1e2dee14463eb776da13b737517affe9bc336093fec1fa9bbc6c7b67f1d2

  • /apex/com.android.art/javalib/okhttp.jar
    Filesize

    397KB

    MD5

    a4b2495e244595af5f3e3ef446f3fb05

    SHA1

    5a19ef43d0ffe4cb740cefd5bef48da5bf60e774

    SHA256

    14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada

    SHA512

    5fe72bbed317af46c385cde578bbb9d47e429ff192f96799ce81e891098ee45ce5d6287373cc78ae07b664af168e0ed7e516184883442132664e659ae5d0aba8

  • /apex/com.android.btservices/javalib/framework-bluetooth.jar
    Filesize

    937KB

    MD5

    dfeab0380131c54e132e010995886029

    SHA1

    8d99f8257731637cace5f413916741a94fe5e460

    SHA256

    9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c

    SHA512

    2f101e3e655e0d6ce4952ba462692d706752491d5ff3b8528d0331f1523ac227c0830a26c74bc850117f7bf028d1547cf190bdac02f647ca245e83d60f9715d9

  • /apex/com.android.conscrypt/javalib/conscrypt.jar
    Filesize

    453KB

    MD5

    7ce91e3f14e20db318e38b3fb497984f

    SHA1

    068ebff84b6fcb998fa518e39b78b4d52707edae

    SHA256

    787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d

    SHA512

    54ffec1ac57503575b6a2f471f8eb895b1042b2592b5febe63377e11522103dee0f70f01ae52cb2081b06dfd16ef79723cdc1b40680a6d2622fa0a5067b5267d

  • /apex/com.android.i18n/javalib/core-icu4j.jar
    Filesize

    2.7MB

    MD5

    baf8aae4583bf6989f30a3512d36cdf4

    SHA1

    b8623c5c6be23f8201cc1b826f83eaa6ac8f7b46

    SHA256

    baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5

    SHA512

    420c583336e62cd5137809fc6d2267344d1d52fe5edd3e0ed8385207f6731d17a6370b61b6418260039266c2ae2c5e814c5eb9b16b4e672a6b0e3b1e5714f11f

  • /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
    Filesize

    670KB

    MD5

    5041171aeeffa6ae45eef650b594445b

    SHA1

    cc2a8d2577fedf8cf3f5c146a7874a3420a9015e

    SHA256

    dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83

    SHA512

    79201fe62462460065e376879ff014232394dc608e838fee0e2391b4f01fa1e8c76866398894b8195e23d45e2ae56ce348930d9abbb14e622a0874df0f4f66d7

  • /apex/com.android.media/javalib/updatable-media.jar
    Filesize

    482KB

    MD5

    5b75de85d1963c518cc39440e203e80a

    SHA1

    cd199428ef27a5e6c42462a600fe572a0c8cdfd3

    SHA256

    19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9

    SHA512

    de7ac7c3d55f36d9efe66d7fce049543fcf2e37c24e50f8e593c50b71e3d77271f50723a223e5b6877248ae0c53f9dcfd450dfe428e2b4e6ea5e5c8195ef0ea1

  • /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
    Filesize

    73KB

    MD5

    5f147ff03fa6df46871cc7988719efff

    SHA1

    1bcc3c94c4edaec0c4b71d619ad6e93834c98420

    SHA256

    6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b

    SHA512

    d6d6e022fe31d6aed2663ffcd7c909aa22d93e4389f8c4930c32bf4b49062e57c4481f9c551cb2963457a0418cdef8acb24c123204127b0873e8b18e89a591d2

  • /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
    Filesize

    8KB

    MD5

    a226d2dab862fc8e24ab338ca5eefd26

    SHA1

    d424730e7a0ab29a2ef906b7e71e50f857d24856

    SHA256

    f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f

    SHA512

    df211db5e4b6dfaeb74f5cdbe9d776486753dec9d527364ffe3d38a1ccdc5718f8edf1d59a4a9bc1d0fe6cc568de9a43a46510a7cf2ea5c93cd3fd0cdf9adc17

  • /apex/com.android.os.statsd/javalib/framework-statsd.jar
    Filesize

    73KB

    MD5

    c62549e4c3dc3dc6828b5930a696d82e

    SHA1

    a19f79ea7a2fb4a730e20817b52a51625ab23dcf

    SHA256

    22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914

    SHA512

    cef48a5871c75d214a74fdc2907bcb6052b7a6fee03c7463ee0922fb1158d08e770a0a6fa5412fc69bd5704b65800c9cf875a563a560a864778e873772747d9a

  • /apex/com.android.permission/javalib/framework-permission-s.jar
    Filesize

    173KB

    MD5

    dddbffa4fb9866e65e46ddedbfc917eb

    SHA1

    d1b1e3f5e3596544a4259a019607d93b31d2a271

    SHA256

    25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219

    SHA512

    6a55f0c915ebfcff4fcd928dc67a0126ae7a0467c8ba39028996c219d089312872f8a2f672ba9b3886d003726961da10d66a8459bee91934fcde28ec8ea110d1

  • /apex/com.android.permission/javalib/framework-permission.jar
    Filesize

    612B

    MD5

    11055bb5f97d6dac0aa37bfeca7051e8

    SHA1

    b71d72d66800f512b9ccdbe3e3b1028f8e1090a2

    SHA256

    e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c

    SHA512

    787b6f40c233eae5c0e5d84c178f02f755cb0c8ba9ad3991e145841fcc05da69573d489f3331f46a778c365e25d3cfd20a1388d2cd6ee4dd99a0381feb90b2d9

  • /apex/com.android.scheduling/javalib/framework-scheduling.jar
    Filesize

    11KB

    MD5

    9667a58cf7cbf24089068395a663542d

    SHA1

    233b15ea03809e8d55249ecc2a386ed8d6f1b05c

    SHA256

    a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e

    SHA512

    21b7e60d5e299fae15d61212f657504aa429120ed90f0facae98b5e04b16f35fd79b63a6668c9a1bfa799e47f42f42ce9495e475b86e01837cfcab88111f92be

  • /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
    Filesize

    5KB

    MD5

    dde2bd24649e82bea6ea5d8bcf7c0589

    SHA1

    ad1b2b9ffeb9e87ce85db2d47a896c551990a985

    SHA256

    835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5

    SHA512

    2b9b75466911a0e7f75b02d7132a497017873752a4310a2c79251b546e0c5e426f90ac460fed1e932e6119738cada32cc6df041d4b9c49200675dac9d470abe1

  • /apex/com.android.tethering/javalib/framework-connectivity-t.jar
    Filesize

    374KB

    MD5

    6af554dbf0735cde24b20ffcbc996fc7

    SHA1

    2f8e3e13b167f5a619b4a4aba6e735516a04f68c

    SHA256

    595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608

    SHA512

    b450779b88d6e07537e6cb39e413ae69c8b60e4e18786d9654f5d610abbe404f83c9ed9036977051766a1b414d7434383c6dfab7edda3d854b0a16562d41f6ab

  • /apex/com.android.tethering/javalib/framework-connectivity.jar
    Filesize

    490KB

    MD5

    4f7a254ff28a65ea2a4cffe24b1339ce

    SHA1

    5c2861faf85e3086eb0144bb6006099503b5e283

    SHA256

    13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0

    SHA512

    53357cfbdaf076104dc6d6feeeabe1235d8e4214bc4b5b3a70eab2107799be19efc0b970add2eb65e8c099b4f0dfce72a309842a5d0bf6c266e3707b73311a2d

  • /apex/com.android.tethering/javalib/framework-tethering.jar
    Filesize

    63KB

    MD5

    d81b5e468aa772e188d4d826bea7022b

    SHA1

    a95510ede5c549b29c6778b235863a6c817d982e

    SHA256

    fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc

    SHA512

    bcec5c487477d83cc8aa43c75bc1eec9d3e50cf34960c302ace30d8a91a1ed298b5314dcf83845dd142be202cf960a4514eeb8dd376fb7947c7728349d940ae3

  • /apex/com.android.uwb/javalib/framework-uwb.jar
    Filesize

    102KB

    MD5

    7f8f7e544abbf10bf9d0623e09aabe34

    SHA1

    ee06d0f1adc3ce304d2b4dde0bc043b37a0e32fb

    SHA256

    31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367

    SHA512

    8c49570f530b73c9edeb948ff89f1d4491273e4c5ae7a79156d38f12d5cc93076f325913107848cf91f566ee7b59c30b86db213c078fd0a635e9aa6eb9a99ddb

  • /apex/com.android.wifi/javalib/framework-wifi.jar
    Filesize

    985KB

    MD5

    38bb2ecc2647701304bb9980e35480fd

    SHA1

    1bfc5c534617cbd176268d6a267abd59959f3184

    SHA256

    79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65

    SHA512

    02fc2026b43e02c25cb370606ff2adfc3c9b66b393250ca92b2d5eabbfbd2568c391d8932ba774bd5c5661c850bd71157a0ce454b195658066b65b7363a1f551

  • /data/user/0/com.beautyship5/cache/oat/qhqrdtmuyib.cur.prof
    Filesize

    394B

    MD5

    6af14bb3a5d26476f2a43888673a816a

    SHA1

    4b4553d799974a0ccf1307e46266434543664ad2

    SHA256

    14d73d9d3658e9ff2452f107e60fcb3c12592645173343185cbd10835232ddc1

    SHA512

    62c6089e2b0ecdd3480a251b8495ea9c0c2fa20d4515f5eb17a8e682b90f358018de272286c47da148ecf5de8bcc138b9e94eabc05c4e182d8383543fd7dd276

  • /data/user/0/com.beautyship5/cache/qhqrdtmuyib
    Filesize

    449KB

    MD5

    7cfcfcdf2f1a2e962d3975435a55b97d

    SHA1

    0e3b3c6e167542c580dec3a674f2fc3b4e91628d

    SHA256

    abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929

    SHA512

    eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a

  • /data/user/0/com.beautyship5/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/user/0/com.beautyship5/kl.txt
    Filesize

    52B

    MD5

    7f27aad5fbd8691c0f69ed2dd5fcce36

    SHA1

    f622b95fe0dbb25a7922fa0c28e0c3f497e3b99d

    SHA256

    acb960c6e8a29502ad7bc2efea3fcd1ce91eac5a34f70dabb3df3dcedf72a992

    SHA512

    2cd09ef67e2b288927a1d5ef18dae41e7685dd2dd348acf33aec9b93ec764544b07c4bb09b23131cb9c3ddec23a803726351a44c604a345347113ad2fcb16809

  • /data/user/0/com.beautyship5/kl.txt
    Filesize

    70B

    MD5

    6ce1be9f2b2bcc4149f600c000178920

    SHA1

    f91b19249a871dd2e87d045b43d6424a7f03d306

    SHA256

    d84ca96b920f774ab6d73f89a2427f5d791417df47b76760abb13e700ad881b1

    SHA512

    ad77d8e2b3bc10767dbfff60ae892b53066e7b50a912ae4a38f3615822f5524ee9f3ae9ce62be31bd2a5d00508b3a704278c49bf213d5d258d7d6a7bf8c1b90f

  • /data/user/0/com.beautyship5/kl.txt
    Filesize

    62B

    MD5

    9a1ef346708d24fa891ad080d7b667f3

    SHA1

    b738de93bc81ed9839a4223d9ec890f6097d3d1e

    SHA256

    d35a037c9a63e0c7d5463ae9becfe4396b9f14c56a78ff88e0d89b78e603e0e6

    SHA512

    cfe2b872b573af64371a4d9faa6b5dc9dd290dad1634cd4cfcbac500000becebee8a93b369a3873e277aed9887ea6353428c87b4e7b28e6bb55d5424581fc1b8