Overview

overview

10

Static

static

6

492457b579...0c.apk

android-9-x86

10

492457b579...0c.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    18-06-2024 22:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    492457b5791ad7d2eeaf104fc0a0b9f5021ef4b362163ee7b310a3f11a790d0c.apk

  • Size

    509KB

  • MD5

    1fc2dd6d5f8298269f44e3a75aaad661

  • SHA1

    37012cfdc361a01375894977dd999783768c93b9

  • SHA256

    492457b5791ad7d2eeaf104fc0a0b9f5021ef4b362163ee7b310a3f11a790d0c

  • SHA512

    398d5be6d1ef0f2ad7505bd51f998969cd3549136754617df6505cd4d268c0244118abe92b3aa0b3dbda1bf3f6dfdbb10fb8462ebfa42ec8973eee0afdef905b

  • SSDEEP

    12288:hsUS5gmTM4X5elQz862+G1djPaZOseHGkKjEN2zwivjGzEvznyJ:eUmXTlX5elQc+uTaZyHGkKwN2PvznyJ

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

octo

C2

https://multipay-3d.website/YjNlM2ZhMjlhNjNi/

https://novediaben52.com/YjNlM2ZhMjlhNjNi/

https://novediayladostadogru3.com/YjNlM2ZhMjlhNjNi/

https://kolaicmiyorumlanben3.com/YjNlM2ZhMjlhNjNi/

https://uyumuyorumlanben2.com/YjNlM2ZhMjlhNjNi/

https://yemekyoksuyok42.com/YjNlM2ZhMjlhNjNi/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cryplacens
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4266

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cryplacens/cache/kxaqwvnpfrbmr
    Filesize

    449KB

    MD5

    92b6b49234f7c173766f94372732eeda

    SHA1

    fafe3c96b8f2c5ff16a5296b54d71da4c5750c58

    SHA256

    d53bfb57d10285ea8a7565cec9117d6d266a68f68d20a310c5345153409ec91a

    SHA512

    c67a4976d2120262e12d5fda93f8d2f2c3f5d89849a49524b5bb6fd4a99c51e51debf557757336578ff7b382fc09201fa446ea0078e801b18ba4765b04e4869e

    Download Submit
  • /data/data/com.cryplacens/cache/oat/kxaqwvnpfrbmr.cur.prof
    Filesize

    525B

    MD5

    f5c7b21c17b339504c1299c85fdc95bb

    SHA1

    7fcddfbf2562a6a00e96aa0b5e32828f84d45bdb

    SHA256

    24c368078d9ee5853b05b1821f03d861a61afc38cabd72db4d9bcb934bedd7cb

    SHA512

    0925e356100fe1898b92d7a3f9522a9c14c61a0a2eca399871ea909508943947b65d92d7948354980caa8ef812cc50ff3b5f98be4a1f747f647e788c540c9b2d

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    63B

    MD5

    e380508e86e5336c5bd405f767445dd7

    SHA1

    2aff16646a5b64742a5392280e94957e067a53f6

    SHA256

    957bc894e72327055434742a308c1122d1635fca12b8942dedbd012387a3b47a

    SHA512

    d3785c6ccf2eb801ff4e2c2db282aeeba0219a8a5b11c16fe95d9d36c9a5e2e9f72aefe6e9c63ffcafb6f8c16236e2b3bc2786870dcff34e7e5b6060e551563c

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    54B

    MD5

    4488591bc4c7894af043bd2617b62a40

    SHA1

    4b604ca296846b658a3fb0a11963c7d32359ea48

    SHA256

    050e123c15ba8b9781d73d765cf14be0484e76e6169e6b6e0d9ea0a68dc51579

    SHA512

    c477350507be2bb4f65d7f7379969290040bb7d08fdd77b84719733e7a0bd831d75bf044e879475b6b00102d99f3b2e564744afc532e0c642033aa11707a3711

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    63B

    MD5

    f7c981eaa88389b9e44ab6de187c303b

    SHA1

    e294b16e5bd8bfc30894bc85f9e1312b873b354c

    SHA256

    7affdfe0243c7b8b150ae4c99d237d4b282620042d95f41f9d5f9417b3ff2a73

    SHA512

    b2c9dc3f93b1afe68d1539ef3c348c151e1fe29850fbba8461c656337abe6401ab97622e3e78a244ecb96556a8ec9a21e1a7604fd0e769af157ec7b217ba5f7d

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    437B

    MD5

    ed37ac62df983010f3c0b02ab2613c28

    SHA1

    d2376a7ed7eed8164132451efdf7a7ec31c021fe

    SHA256

    da3cc47de1e15cc40d1f9c4a8b7c851652cbb1590b60cb220caa4b8a3283dc52

    SHA512

    df7c9d5c0ec852117279eb1ac3e3a7358042471ce39ffbda305ba28269871a58103069b28b68b638ba3f7b00f4b1791faab986f769acd4a4310431088815b7ee

    Download Submit