Analysis

  • max time kernel
    69s
  • max time network
    183s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    28-05-2024 22:00

General

  • Target

    bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5.apk

  • Size

    537KB

  • MD5

    0e22ede9e904c6e28cda207001b993af

  • SHA1

    a9edadc76597182d7bdbfc1225f569b7c98bdfe3

  • SHA256

    bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5

  • SHA512

    738cf0bba0c78099ec60fb79b3d4221ca8fdf31551fddacf4c2c14c1d3ad1f4ea6a8279fda2cdecd3e68d5d9d762cf076ce95bc43a7651672ec61ea8f345a7fc

  • SSDEEP

    12288:shOTOE68iehj1VuNJbFMnF/ZaDLtthoW5Y9Tnv2:sCHfiEuTuBaDJjoFNnu

Malware Config

Extracted

Family

octo

C2

https://94.232.249.36/MmE0ODdiNjkyNzdi/

https://89divos.art/MmE0ODdiNjkyNzdi/

https://89divos.tech/MmE0ODdiNjkyNzdi/

https://89divos.shop/MmE0ODdiNjkyNzdi/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Prevents application removal 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to prevent removal.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.whatev2erwh2atever
    1⤵
    • Makes use of the framework's Accessibility service
    • Prevents application removal
    • Removes its main activity from the application launcher
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests modifying system settings.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4284

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.whatev2erwh2atever/cache/ntygrhadjbuptz

    Filesize

    477KB

    MD5

    65cb593886751d7394957a9da951aaf8

    SHA1

    64eedc22cbde9f912d227744f9ebe6b8e6f638f8

    SHA256

    8a6242f184ede2ac58585af93dc550c4b7a824570bc881222afa5071fb50d4bf

    SHA512

    13ab53b5c34be5e6a0aa93ee6d8761d8797d1626a9005c2ede2e23547daec56a58902e8e87e13ae7e4540618abbff5857233c7bfdc0601aeeabe263fc46e3766

  • /data/data/com.whatev2erwh2atever/cache/oat/ntygrhadjbuptz.cur.prof

    Filesize

    515B

    MD5

    70f36ace70f87d99d804ac9061f9ee2e

    SHA1

    4b2ff9824a00a3df1d7ff9d3ba0ef58ecb65e0f7

    SHA256

    7a92b426565f402f260bb23d4ea9ae7db0048f8985ca35b1e8fec628ae31cdd5

    SHA512

    08bf56e94aca923d228ee10c630ca95d81ebf9246c3d61cb2804f7e83904cb5cf80816e2696652b09009bcbed18d4785b35bbc247c8d097657a762bbaa9a35bf

  • /data/data/com.whatev2erwh2atever/kl.txt

    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

  • /data/data/com.whatev2erwh2atever/kl.txt

    Filesize

    237B

    MD5

    6e5ece685ed2484342fb9b0e8bed3c2b

    SHA1

    f68d019095bbb7df99d101939117eb57086e644a

    SHA256

    5c3aa907b68e717acb7118a250849f4a1fa1ec04ccd917b008c7c282f768dcc5

    SHA512

    ff735662db04b12a94f3fb86f9bd5f956e71a937c4155824f12db959dddc84d7030b428e18921e2a5bdb443d6e1b843088d1562b1fcabecbabd041ab9d69422a

  • /data/data/com.whatev2erwh2atever/kl.txt

    Filesize

    54B

    MD5

    a3c8802ac868f017d4c0cc7954ed12a9

    SHA1

    ec8f49f40a4a2edb1a087a6caf03016e89f3670b

    SHA256

    9797a27a6d63da508c87f98357ab007afafd5b7e4ea08384ee12fff331466cad

    SHA512

    1f488ff5b22dd6b9a2903a8e6f698dae298c7bb89dbff56d923fa9567abaa34e4af4d5a6d48856908c8cb79d8da330cd1880d1e77d3bcb5af2b0c5cc3b72a93b

  • /data/data/com.whatev2erwh2atever/kl.txt

    Filesize

    63B

    MD5

    5aa1781ff6b8de3408268a8942d88867

    SHA1

    0a5a2cca0ac69b7e1239949da10ee2f50044d66c

    SHA256

    162d9a7f07cf146305206cc7d27ccd3ee92d6fcbd85ecf85dbbff92581a5a0a2

    SHA512

    f92456c2c28222b19d234325ff139b93277f7aa432362663b69103d8a79c5c26ebe0f37795734a09beaf3153d38197f5a2b8077da12216a6036e8b5d6e67fa75

  • /data/data/com.whatev2erwh2atever/kl.txt

    Filesize

    437B

    MD5

    6e95e011070dd0e5f7896a5f4141244b

    SHA1

    e20956a760f7c1b40421424e4d48b50b7a300436

    SHA256

    a1b51bd265bf897a74c6a966fbbc6bb09e8d721d6828146402b366f15d63178d

    SHA512

    9f685d67a1c0f051ac67ad3ad67887e78703d99a7f79fde4faf92c4ec72be763b17ab4e4b11fb408fe09f5b8e2a73a5805dc4ed394bc9cd244f62bb35ec2a5c0