Overview

overview

10

Static

static

6

492457b579...0c.apk

android-9-x86

10

492457b579...0c.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    183s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    18-06-2024 22:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    492457b5791ad7d2eeaf104fc0a0b9f5021ef4b362163ee7b310a3f11a790d0c.apk

  • Size

    509KB

  • MD5

    1fc2dd6d5f8298269f44e3a75aaad661

  • SHA1

    37012cfdc361a01375894977dd999783768c93b9

  • SHA256

    492457b5791ad7d2eeaf104fc0a0b9f5021ef4b362163ee7b310a3f11a790d0c

  • SHA512

    398d5be6d1ef0f2ad7505bd51f998969cd3549136754617df6505cd4d268c0244118abe92b3aa0b3dbda1bf3f6dfdbb10fb8462ebfa42ec8973eee0afdef905b

  • SSDEEP

    12288:hsUS5gmTM4X5elQz862+G1djPaZOseHGkKjEN2zwivjGzEvznyJ:eUmXTlX5elQc+uTaZyHGkKwN2PvznyJ

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://multipay-3d.website/YjNlM2ZhMjlhNjNi/

https://novediaben52.com/YjNlM2ZhMjlhNjNi/

https://novediayladostadogru3.com/YjNlM2ZhMjlhNjNi/

https://kolaicmiyorumlanben3.com/YjNlM2ZhMjlhNjNi/

https://uyumuyorumlanben2.com/YjNlM2ZhMjlhNjNi/

https://yemekyoksuyok42.com/YjNlM2ZhMjlhNjNi/
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Requests modifying system settings. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cryplacens
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4445

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cryplacens/cache/kxaqwvnpfrbmr
    Filesize

    449KB

    MD5

    92b6b49234f7c173766f94372732eeda

    SHA1

    fafe3c96b8f2c5ff16a5296b54d71da4c5750c58

    SHA256

    d53bfb57d10285ea8a7565cec9117d6d266a68f68d20a310c5345153409ec91a

    SHA512

    c67a4976d2120262e12d5fda93f8d2f2c3f5d89849a49524b5bb6fd4a99c51e51debf557757336578ff7b382fc09201fa446ea0078e801b18ba4765b04e4869e

    Download Submit
  • /data/data/com.cryplacens/cache/oat/kxaqwvnpfrbmr.cur.prof
    Filesize

    334B

    MD5

    b4af3e4e6aef7c036d664cc0a13b77d7

    SHA1

    80762996eb7dcc532b716fd36d72920be6b0c4fe

    SHA256

    a314761bb0524bc53fba2613933b4ce44ff7955003c378860f9f71b98913b52d

    SHA512

    03f9808f83cc024453a687a709b544d417ff821b57da9f7219edb2f634336e1c825516aa19e5a111328a03619ce8a17a18b4329d0b5db69ea64032f07d8493c0

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    28B

    MD5

    6311c3fd15588bb5c126e6c28ff5fffe

    SHA1

    ce81d136fce31779f4dd62e20bdaf99c91e2fc57

    SHA256

    8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

    SHA512

    2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    63B

    MD5

    5a0ab91f990684744d622e4682e58b57

    SHA1

    7350bff4de6ad37034fb31866a0c462105c2e4bd

    SHA256

    217d20cf931e6f6f6215043683af29eb3fd5c164ad57dd46a33457f27d6d353e

    SHA512

    4496dd261953ae80792e414bddb15645072d33dd9790d1d1e1358dd90d3a34d6627599b2096bbee1baaf75df9deaad3f325108e4ada4c919936d269aa7e865a6

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    45B

    MD5

    70c08c56432b991b6a1fd002067d957e

    SHA1

    ec30dc81cc422a852034d610a2a9aa3fc2c64997

    SHA256

    23a9d8a0abdf5571de474a786852cd8b14be345c9eb8cfa1d3ee6c49ef401985

    SHA512

    2e30bf6baf0c17af9b157cc9b3ec1934f4ba89287024d0d29574f16612e61b96a7c7b27e49da395394d74a0a93d3e986087f8f985fdd9e62b9eddc2ccc2c6005

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    75B

    MD5

    b2985ec5f3f3ab29afe9b9756e60b325

    SHA1

    d84b398028feb0ccffdbe19076dab78a34cac415

    SHA256

    43e9a4789d4b5569b698192ccec94bace43152a7d2b9c51d88ee19d40dd13196

    SHA512

    ccbecc662e38776d69a2e69cedd38ecb3f1210fed705b4150e4d948c3806719d8acef7989b9ab15e7ef7ce3a4968c1c19d2d52511421200f025d748cdfe1738f

    Download Submit
  • /data/data/com.cryplacens/kl.txt
    Filesize

    480B

    MD5

    365a50719be2a9bea6d854871f06c303

    SHA1

    0b092fb868b2adf175e65bec5beb4a3c5e05db24

    SHA256

    c490eec922c202fec9e160d96a98cb68a258a6211f27a26d021a12259848a133

    SHA512

    488b9a8883c6ce799c4ee3ab922f465e4d55f66c95b47c25cea2e5263063b288a19051bd0ee5dd16ad81a10826038b61bd8a82fc410b2e544db114b99645dd0e

    Download Submit