Analysis
-
max time kernel
59s -
max time network
68s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
16-05-2024 18:27
Static task
static1
Behavioral task
behavioral1
Sample
Chrome.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
Chrome.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
Chrome.apk
-
Size
509KB
-
MD5
5b08d0c18c35b052788084a11bf003b0
-
SHA1
f5b9d39d482ab057e8771610c1e8a0bb767fc6a4
-
SHA256
052ec0779752b426df2de4d8bb497834487b784a510467b1ab290d0c899f607c
-
SHA512
2cbaa7b88e067b114603f6d5e9ff489e71cfcbc58a1ee4e01c9fff071bf533cf4505efa60c8cc153c5ae52374f13e24a38690ca3a5e69974652af68fad10a8df
-
SSDEEP
12288:WWYnP1zW3qeDGtz57N5azdW0R7RJcAZydxinMkaHZhrOF:WvntzW37Gthraz777OxinMVHr+
Malware Config
Extracted
octo
https://moneymaskalandd.shop/MmExODA3MDAzZjA5/
https://moneycsffhgm7.shop/MmExODA3MDAzZjA5/
https://moneycsasfasfh.com/MmExODA3MDAzZjA5/
https://moneycsasfasfh.net/MmExODA3MDAzZjA5/
https://2moneycsasfasfh.net/MmExODA3MDAzZjA5/
https://2moneycsasfasfh.com/MmExODA3MDAzZjA5/
https://3moneycsasfasfh.com/MmExODA3MDAzZjA5/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/user/0/com.manynearujx/cache/wgjdmcmqbst family_octo -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.manynearujxdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.manynearujx Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.manynearujx -
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
Processes:
com.manynearujxdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.manynearujx -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.manynearujxdescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.manynearujx -
Requests modifying system settings. 1 IoCs
Processes:
com.manynearujxdescription ioc process Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.manynearujx -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.manynearujxioc pid process /data/user/0/com.manynearujx/cache/wgjdmcmqbst 4578 com.manynearujx /data/user/0/com.manynearujx/cache/wgjdmcmqbst 4578 com.manynearujx -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.manynearujxdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.manynearujx -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.manynearujxdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.manynearujx -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.manynearujxdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.manynearujx -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.manynearujxdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.manynearujx -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.manynearujxdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.manynearujx
Processes
-
com.manynearujx1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests modifying system settings.
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.manynearujx/cache/oat/wgjdmcmqbst.cur.profFilesize
319B
MD5d69184679b6fb0d3b6fe06e64df6cce2
SHA182ea618f92631d86b06f55bfe056b92afe479500
SHA2569e896ce4654d6553161d1fd7933d395da5000f76028516e672cdd4addf1b98a5
SHA5123b51d6a275d299a73bfe33a5e3e6445c805e158265557f6414c8750ad5c510d251184ec5263c504226340c7a395ccc53f45e4bc4a58f633f8437114d69bfd9d8
-
/data/user/0/com.manynearujx/cache/wgjdmcmqbstFilesize
449KB
MD511f306ca3a60cc579beccf71a4d8b563
SHA1cc9de84e4e16e39e75c9df582313008c912a473f
SHA2567cc2275b2e24cbb17327b62b6f37ad7d72d6c7f8af91b2d16e282bb5968c18cd
SHA5120d1667c33b3702b9cdadba0284f1ff2fe2b38f4c15b4c18a196ca9586b0e0f1852dcb17a4fb31dfb64f08053cd2e36400f397a9fc5352218dabe859c8dd2a703