Analysis
-
max time kernel
69s -
max time network
183s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
28-05-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5.apk
-
Size
537KB
-
MD5
0e22ede9e904c6e28cda207001b993af
-
SHA1
a9edadc76597182d7bdbfc1225f569b7c98bdfe3
-
SHA256
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5
-
SHA512
738cf0bba0c78099ec60fb79b3d4221ca8fdf31551fddacf4c2c14c1d3ad1f4ea6a8279fda2cdecd3e68d5d9d762cf076ce95bc43a7651672ec61ea8f345a7fc
-
SSDEEP
12288:shOTOE68iehj1VuNJbFMnF/ZaDLtthoW5Y9Tnv2:sCHfiEuTuBaDJjoFNnu
Malware Config
Extracted
octo
https://94.232.249.36/MmE0ODdiNjkyNzdi/
https://89divos.art/MmE0ODdiNjkyNzdi/
https://89divos.tech/MmE0ODdiNjkyNzdi/
https://89divos.shop/MmE0ODdiNjkyNzdi/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/data/com.whatev2erwh2atever/cache/ntygrhadjbuptz family_octo -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.whatev2erwh2atever Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.whatev2erwh2atever -
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.whatev2erwh2atever -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.whatev2erwh2atever -
Requests modifying system settings. 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.whatev2erwh2atever -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.whatev2erwh2ateverioc pid process /data/user/0/com.whatev2erwh2atever/cache/ntygrhadjbuptz 4284 com.whatev2erwh2atever /data/user/0/com.whatev2erwh2atever/cache/ntygrhadjbuptz 4284 com.whatev2erwh2atever -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.whatev2erwh2atever -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.whatev2erwh2atever -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.whatev2erwh2atever -
Acquires the wake lock 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.whatev2erwh2atever -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.whatev2erwh2atever -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.whatev2erwh2ateverdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.whatev2erwh2atever
Processes
-
com.whatev2erwh2atever1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests modifying system settings.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.whatev2erwh2atever/cache/ntygrhadjbuptzFilesize
477KB
MD565cb593886751d7394957a9da951aaf8
SHA164eedc22cbde9f912d227744f9ebe6b8e6f638f8
SHA2568a6242f184ede2ac58585af93dc550c4b7a824570bc881222afa5071fb50d4bf
SHA51213ab53b5c34be5e6a0aa93ee6d8761d8797d1626a9005c2ede2e23547daec56a58902e8e87e13ae7e4540618abbff5857233c7bfdc0601aeeabe263fc46e3766
-
/data/data/com.whatev2erwh2atever/cache/oat/ntygrhadjbuptz.cur.profFilesize
515B
MD570f36ace70f87d99d804ac9061f9ee2e
SHA14b2ff9824a00a3df1d7ff9d3ba0ef58ecb65e0f7
SHA2567a92b426565f402f260bb23d4ea9ae7db0048f8985ca35b1e8fec628ae31cdd5
SHA51208bf56e94aca923d228ee10c630ca95d81ebf9246c3d61cb2804f7e83904cb5cf80816e2696652b09009bcbed18d4785b35bbc247c8d097657a762bbaa9a35bf
-
/data/data/com.whatev2erwh2atever/kl.txtFilesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
/data/data/com.whatev2erwh2atever/kl.txtFilesize
237B
MD56e5ece685ed2484342fb9b0e8bed3c2b
SHA1f68d019095bbb7df99d101939117eb57086e644a
SHA2565c3aa907b68e717acb7118a250849f4a1fa1ec04ccd917b008c7c282f768dcc5
SHA512ff735662db04b12a94f3fb86f9bd5f956e71a937c4155824f12db959dddc84d7030b428e18921e2a5bdb443d6e1b843088d1562b1fcabecbabd041ab9d69422a
-
/data/data/com.whatev2erwh2atever/kl.txtFilesize
54B
MD5a3c8802ac868f017d4c0cc7954ed12a9
SHA1ec8f49f40a4a2edb1a087a6caf03016e89f3670b
SHA2569797a27a6d63da508c87f98357ab007afafd5b7e4ea08384ee12fff331466cad
SHA5121f488ff5b22dd6b9a2903a8e6f698dae298c7bb89dbff56d923fa9567abaa34e4af4d5a6d48856908c8cb79d8da330cd1880d1e77d3bcb5af2b0c5cc3b72a93b
-
/data/data/com.whatev2erwh2atever/kl.txtFilesize
63B
MD55aa1781ff6b8de3408268a8942d88867
SHA10a5a2cca0ac69b7e1239949da10ee2f50044d66c
SHA256162d9a7f07cf146305206cc7d27ccd3ee92d6fcbd85ecf85dbbff92581a5a0a2
SHA512f92456c2c28222b19d234325ff139b93277f7aa432362663b69103d8a79c5c26ebe0f37795734a09beaf3153d38197f5a2b8077da12216a6036e8b5d6e67fa75
-
/data/data/com.whatev2erwh2atever/kl.txtFilesize
437B
MD56e95e011070dd0e5f7896a5f4141244b
SHA1e20956a760f7c1b40421424e4d48b50b7a300436
SHA256a1b51bd265bf897a74c6a966fbbc6bb09e8d721d6828146402b366f15d63178d
SHA5129f685d67a1c0f051ac67ad3ad67887e78703d99a7f79fde4faf92c4ec72be763b17ab4e4b11fb408fe09f5b8e2a73a5805dc4ed394bc9cd244f62bb35ec2a5c0