Analysis
-
max time kernel
179s -
max time network
185s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
10-07-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
acde63a15e888817b6e8364ae38f314d27503c4f9c8a2fbc08bcf6457a7cb605.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
acde63a15e888817b6e8364ae38f314d27503c4f9c8a2fbc08bcf6457a7cb605.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
acde63a15e888817b6e8364ae38f314d27503c4f9c8a2fbc08bcf6457a7cb605.apk
-
Size
509KB
-
MD5
30f3ace7c339be873d071e6602a03267
-
SHA1
dfb558d6ca932fd6e54da8dd0b138d2c07e510d7
-
SHA256
acde63a15e888817b6e8364ae38f314d27503c4f9c8a2fbc08bcf6457a7cb605
-
SHA512
ecddece9ef2fca37ce31308ce58aa5218485a40a6412a0cb343721d4bb059f5885017e11bede41d4853a37ea096f9b6d00b4ad7034ff9b737ef6e7dc3fb693d9
-
SSDEEP
12288:VCWVC3vYJEB0TqwhTk1s8xpCFGH7l/A1bkVyHMR/FET8ZTynC:sWVyWEi+GuMGH7hsbkkM1FET8ZTynC
Malware Config
Extracted
octo
https://kesmecekarpuz.site/NGE2Y2RjYjdmYjg3/
https://kesmecekarpuz.com/NGE2Y2RjYjdmYjg3/
https://kesmecekarpuz145.com/NGE2Y2RjYjdmYjg3/
https://kesmecekarpuz878.com/NGE2Y2RjYjdmYjg3/
https://kesmecekarpuz5446.com/NGE2Y2RjYjdmYjg3/
https://kesmecekarpuz8455.com/NGE2Y2RjYjdmYjg3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/data/com.realsing1/cache/tsfnruacvdexrn family_octo -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.realsing1ioc pid process /data/user/0/com.realsing1/cache/tsfnruacvdexrn 4535 com.realsing1 /data/user/0/com.realsing1/cache/tsfnruacvdexrn 4535 com.realsing1 -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.realsing1description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.realsing1 Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.realsing1 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.realsing1description ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.realsing1 -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.realsing1description ioc process Framework service call android.app.IActivityManager.setServiceForeground com.realsing1 -
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.realsing1ioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.realsing1 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.realsing1 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.realsing1 android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.realsing1 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.realsing1description ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.realsing1 -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.realsing1description ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.realsing1 -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.realsing1description ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.realsing1 -
Requests modifying system settings. 1 IoCs
Processes:
com.realsing1description ioc process Intent action android.settings.action.MANAGE_WRITE_SETTINGS com.realsing1 -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.realsing1description ioc process Framework API call javax.crypto.Cipher.doFinal com.realsing1
Processes
-
com.realsing11⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.realsing1/cache/oat/tsfnruacvdexrn.cur.profFilesize
309B
MD5be53de24a6a75cb68590583b2896cbad
SHA1ea0a716c3116a110af381599ec79c9eda0f503df
SHA256e9feebe99c3a720d0ad23566a72fada31608a94a9802e775d3f672cc565570aa
SHA512cfaa207d9129a4047d42cc98ae43ef94a2807e5a155dc88c6a0bd89b72a09dd3d8214876e2f35088c8f421446c751e4d6efb28f0a7933d73bf90ab29a2ead8d1
-
/data/data/com.realsing1/cache/tsfnruacvdexrnFilesize
448KB
MD51581b5c2b64065a768fa60b5a6893bd1
SHA1f03b8a15489a42e203a8634be85bcbee8fa279ce
SHA2562bf909f06284800863cde93c145a93b4fb131a53bfcf2fe53d987dbc9de23648
SHA512ccc4a1f1b6b7d2006a321a7701e93f6068ee10245ddbda5acead5e72cb44cc92cab0a9c2fc47a5c53b7baea38632abbfab55a2adad6a01df453b796e726d2b19