Analysis
-
max time kernel
69s -
max time network
183s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
28-05-2024 22:00
General
-
Target
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5.apk
-
Size
537KB
-
MD5
0e22ede9e904c6e28cda207001b993af
-
SHA1
a9edadc76597182d7bdbfc1225f569b7c98bdfe3
-
SHA256
bb98625a15353ef102d20ec83b4549a067fd58b6b301e4031354661094558be5
-
SHA512
738cf0bba0c78099ec60fb79b3d4221ca8fdf31551fddacf4c2c14c1d3ad1f4ea6a8279fda2cdecd3e68d5d9d762cf076ce95bc43a7651672ec61ea8f345a7fc
-
SSDEEP
12288:shOTOE68iehj1VuNJbFMnF/ZaDLtthoW5Y9Tnv2:sCHfiEuTuBaDJjoFNnu
Malware Config
Extracted
octo
https://94.232.249.36/MmE0ODdiNjkyNzdi/
https://89divos.art/MmE0ODdiNjkyNzdi/
https://89divos.tech/MmE0ODdiNjkyNzdi/
https://89divos.shop/MmE0ODdiNjkyNzdi/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.whatev2erwh2atever1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests modifying system settings.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
477KB
MD565cb593886751d7394957a9da951aaf8
SHA164eedc22cbde9f912d227744f9ebe6b8e6f638f8
SHA2568a6242f184ede2ac58585af93dc550c4b7a824570bc881222afa5071fb50d4bf
SHA51213ab53b5c34be5e6a0aa93ee6d8761d8797d1626a9005c2ede2e23547daec56a58902e8e87e13ae7e4540618abbff5857233c7bfdc0601aeeabe263fc46e3766
-
Filesize
515B
MD570f36ace70f87d99d804ac9061f9ee2e
SHA14b2ff9824a00a3df1d7ff9d3ba0ef58ecb65e0f7
SHA2567a92b426565f402f260bb23d4ea9ae7db0048f8985ca35b1e8fec628ae31cdd5
SHA51208bf56e94aca923d228ee10c630ca95d81ebf9246c3d61cb2804f7e83904cb5cf80816e2696652b09009bcbed18d4785b35bbc247c8d097657a762bbaa9a35bf
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
237B
MD56e5ece685ed2484342fb9b0e8bed3c2b
SHA1f68d019095bbb7df99d101939117eb57086e644a
SHA2565c3aa907b68e717acb7118a250849f4a1fa1ec04ccd917b008c7c282f768dcc5
SHA512ff735662db04b12a94f3fb86f9bd5f956e71a937c4155824f12db959dddc84d7030b428e18921e2a5bdb443d6e1b843088d1562b1fcabecbabd041ab9d69422a
-
Filesize
54B
MD5a3c8802ac868f017d4c0cc7954ed12a9
SHA1ec8f49f40a4a2edb1a087a6caf03016e89f3670b
SHA2569797a27a6d63da508c87f98357ab007afafd5b7e4ea08384ee12fff331466cad
SHA5121f488ff5b22dd6b9a2903a8e6f698dae298c7bb89dbff56d923fa9567abaa34e4af4d5a6d48856908c8cb79d8da330cd1880d1e77d3bcb5af2b0c5cc3b72a93b
-
Filesize
63B
MD55aa1781ff6b8de3408268a8942d88867
SHA10a5a2cca0ac69b7e1239949da10ee2f50044d66c
SHA256162d9a7f07cf146305206cc7d27ccd3ee92d6fcbd85ecf85dbbff92581a5a0a2
SHA512f92456c2c28222b19d234325ff139b93277f7aa432362663b69103d8a79c5c26ebe0f37795734a09beaf3153d38197f5a2b8077da12216a6036e8b5d6e67fa75
-
Filesize
437B
MD56e95e011070dd0e5f7896a5f4141244b
SHA1e20956a760f7c1b40421424e4d48b50b7a300436
SHA256a1b51bd265bf897a74c6a966fbbc6bb09e8d721d6828146402b366f15d63178d
SHA5129f685d67a1c0f051ac67ad3ad67887e78703d99a7f79fde4faf92c4ec72be763b17ab4e4b11fb408fe09f5b8e2a73a5805dc4ed394bc9cd244f62bb35ec2a5c0