Resubmissions
05-08-2024 12:08
240805-pa55aavhjp 1002-08-2024 15:48
240802-s893nszfkj 1003-01-2024 17:25
240103-vzshdabae6 1024-12-2023 19:17
231224-xznwasbhh7 614-12-2023 08:27
231214-kclffacdhn 1003-11-2023 03:07
231103-dmbwesbb4s 1001-11-2023 22:00
231101-1wx7cadf5y 10Analysis
-
max time kernel
329s -
max time network
336s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-08-2024 15:48
General
-
Target
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
-
Size
509KB
-
MD5
60609814e43a1c814b30435f15d361ed
-
SHA1
61431ed485c98b8a291e289a7e17e8d3e6db3660
-
SHA256
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
-
SHA512
8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
-
SSDEEP
12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu
Malware Config
Extracted
octo
https://84.54.50.100/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.broughtbluea1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
478B
MD5ec238f6d4931ae1ca43febdfebc40624
SHA1ae7e82a8c7dc9a4b4c338905fe9c92311d72d0c8
SHA2563f5b893407dcb88eda71cf406b2f3a916a6760e0b7ba0010d19d63b03a9a7e6b
SHA512276a8251f6c497bd6c457ffdb3fddbdeaa0869c8b092fbe3ea839415840165a423a1e9206a3bcf35e736373455b258d2480fc65022f09d28d07e059e1cedcbe6
-
Filesize
449B
MD54032a55d1629494ce4a776841cc6d1b7
SHA1aa5423fc9de09207ea730b832e46799948a16587
SHA25697e4d927d4e6b9fc28d8cc7bd706e87b1d4188d684969eedb9956a4c2d29caac
SHA5120460d464c9f0271264f32be678a83f4930df5c9cc6a1269dc3821d380e13d814e94fb10383df4ab7c4148eeb258138a3efa89ce4f0d50484d0bdf27f7b1fed2a
-
Filesize
449KB
MD5fb15ea8794c6547c5ca8f58577e433a6
SHA147c530ac1858cbc7584429190a07c3c4313857ac
SHA256908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095
SHA5129cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5adea358ea55b63c1ac518f4c333dfc5b
SHA11d4c76cc6bdcd616fd433c12aaebfe27b574b68c
SHA256682638e0c026a21b569a9c7e4ef18978bce0d1fa4842cc4033cb1b0fc537aa29
SHA5121b7729b35129bbb594cf5d3e7b4fe19fa41f3886d1fdf12b36c6bda6bc9326b06c913712b79bf2cde4535ce05b19b7913d25b70471e732eb2422d33ddac4578e
-
Filesize
68B
MD5e85a1ee5cf3815492a637c93c09b7c8c
SHA166659d8718ef790062702c599699ebe554cf8415
SHA256c1c1e9c262a79cb49e2aa08764e67bfb8cce954618f5505c111bfa4ea3dcd44b
SHA51276ef2871716162d834eb4a7b3bed4593321ccfc1efc13cf54f253e58790e13a730ca1a2ab048d18b62dcc953f82e33a51d2361090cf1ff625770c91c374fa695
-
Filesize
68B
MD54542d13c07eda4e67f28f9a94b24657e
SHA1b26c0b2bc7a5f578a0481e067597c821e5cef9c1
SHA256330a468ac2eb3aedeac3cb4abcb7fe923eee5f622ebe969ee3ac9a7878a580cc
SHA512201fbdaaba0856e87305c75a7004fdc0f5f42b976da369ff2866737be24be60a30a778e60e38078d19c1248cedf43671c88b969eeb49248c82e1a034c873b368
-
Filesize
76B
MD5b2c13580b1d24511c1494c5131b4fa52
SHA1c0a3dd53ee5b3db3e6f7b68bb09be7e450673be1
SHA256fd58b4fcf7538462c549d344344700323d338067f432914321334eb5b9ae6758
SHA512be29146935c322f35ab776e7e98748474b8891abb9cd2d03ec7dcd4d8edcdf69c0b68d69f99339ed0c598b4bca0905d0ea2e5e94ff0c00f6c9ffafd5f83dd904