Resubmissions

11-08-2024 11:59

240811-n5rppssfqd 10

16-05-2024 18:27

240516-w37bdaaa2x 10

Analysis

  • max time kernel
    59s
  • max time network
    68s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    16-05-2024 18:27

General

  • Target

    Chrome.apk

  • Size

    509KB

  • MD5

    5b08d0c18c35b052788084a11bf003b0

  • SHA1

    f5b9d39d482ab057e8771610c1e8a0bb767fc6a4

  • SHA256

    052ec0779752b426df2de4d8bb497834487b784a510467b1ab290d0c899f607c

  • SHA512

    2cbaa7b88e067b114603f6d5e9ff489e71cfcbc58a1ee4e01c9fff071bf533cf4505efa60c8cc153c5ae52374f13e24a38690ca3a5e69974652af68fad10a8df

  • SSDEEP

    12288:WWYnP1zW3qeDGtz57N5azdW0R7RJcAZydxinMkaHZhrOF:WvntzW37Gthraz777OxinMVHr+

Malware Config

Extracted

Family

octo

C2

https://moneymaskalandd.shop/MmExODA3MDAzZjA5/

https://moneycsffhgm7.shop/MmExODA3MDAzZjA5/

https://moneycsasfasfh.com/MmExODA3MDAzZjA5/

https://moneycsasfasfh.net/MmExODA3MDAzZjA5/

https://2moneycsasfasfh.net/MmExODA3MDAzZjA5/

https://2moneycsasfasfh.com/MmExODA3MDAzZjA5/

https://3moneycsasfasfh.com/MmExODA3MDAzZjA5/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.manynearujx
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4578

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.manynearujx/cache/oat/wgjdmcmqbst.cur.prof
    Filesize

    319B

    MD5

    d69184679b6fb0d3b6fe06e64df6cce2

    SHA1

    82ea618f92631d86b06f55bfe056b92afe479500

    SHA256

    9e896ce4654d6553161d1fd7933d395da5000f76028516e672cdd4addf1b98a5

    SHA512

    3b51d6a275d299a73bfe33a5e3e6445c805e158265557f6414c8750ad5c510d251184ec5263c504226340c7a395ccc53f45e4bc4a58f633f8437114d69bfd9d8

  • /data/user/0/com.manynearujx/cache/wgjdmcmqbst
    Filesize

    449KB

    MD5

    11f306ca3a60cc579beccf71a4d8b563

    SHA1

    cc9de84e4e16e39e75c9df582313008c912a473f

    SHA256

    7cc2275b2e24cbb17327b62b6f37ad7d72d6c7f8af91b2d16e282bb5968c18cd

    SHA512

    0d1667c33b3702b9cdadba0284f1ff2fe2b38f4c15b4c18a196ca9586b0e0f1852dcb17a4fb31dfb64f08053cd2e36400f397a9fc5352218dabe859c8dd2a703