Resubmissions
05-08-2024 12:08
240805-pa55aavhjp 1002-08-2024 15:48
240802-s893nszfkj 1003-01-2024 17:25
240103-vzshdabae6 1024-12-2023 19:17
231224-xznwasbhh7 614-12-2023 08:27
231214-kclffacdhn 1003-11-2023 03:07
231103-dmbwesbb4s 1001-11-2023 22:00
231101-1wx7cadf5y 10Analysis
-
max time kernel
329s -
max time network
337s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
02-08-2024 15:48
General
-
Target
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
-
Size
509KB
-
MD5
60609814e43a1c814b30435f15d361ed
-
SHA1
61431ed485c98b8a291e289a7e17e8d3e6db3660
-
SHA256
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
-
SHA512
8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
-
SSDEEP
12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu
Malware Config
Extracted
octo
https://84.54.50.100/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 6 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.broughtbluea1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388B
MD5afa32946f864aa9dada647451a940fc0
SHA10f73bfb9568c2de37ae9d121f2c9b678e6f06734
SHA25668d68bc73eafe000e8dcb63b48d5947b13c9d2f1b5e9048c674db0b1cec3bd05
SHA5122189ecd1074398c66bd5f8a8b11a116c20e2948f5b94830716cf8ddf5ce8a0c22616a9e5490ff7095183c19175a2a49f876d7e3e446f26200baa10c388a5552a
-
Filesize
449KB
MD5fb15ea8794c6547c5ca8f58577e433a6
SHA147c530ac1858cbc7584429190a07c3c4313857ac
SHA256908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095
SHA5129cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
214B
MD59978024f894871b1b8e85de7f5968284
SHA169facfcd40899b4534021946afd839830a9aade8
SHA2567f3b7ad8e18f681266748609918f6f171521d3a62f7eaf53087968c3cc2cb239
SHA512ba7b9a6788637784bfc61b81335df8e7c8fc270d9807c9a026cadbeb4b07bdd6ea9f6350daea55ddf6d312b5b39bcb39c1ef54b13fcf96668df2e42d8e8e1e9b
-
Filesize
61B
MD52db9587a5241148ba6966a837ada6adf
SHA1589ae126676ec919bd6d9c33f8f5832e2915ff64
SHA256694838c8e0db256d6d88c70e1e9ccc792aaa686d8e417d3e335b125dfc10a268
SHA512159a4cdab970df9abdafd3f07fc81f2385873ee78aea57ebaefcc7854f661d4b25cbf5c84d36e2ddcb07855151d88a1ba1e177ac645daa30a50c9daa673b9773
-
Filesize
60B
MD5d1f91a6afc632910e5cc33f7a640bf2b
SHA12803d54d69f7435faa027fad90c61c93ea49c162
SHA256af3a46d591af1be3adf7cfcd8c0de06735927a7f875e089952f252c3d5018c1a
SHA5120b600c2396fc8fe01441dbc8a9fe626b718350a478c68f8f5febca265ba457339242e9f0b594b7aad4f1e5f15be8a3c9a4b33f942f508cdbcaf3dfa595804546
-
Filesize
76B
MD5e3f920d119d4fee668d6539a7b84c0ee
SHA1657246f15a30af7bea44ecc8d2e82676705b6f7d
SHA25677ea591592b4dc84617bfdf79cfb2e8f335e5fa95b0e4f752a95c8cd29cb1473
SHA5124ba772d0d1be0fb2d34421c08f08ff9e0d94ee630fa6f090cefe3b73ea5a458ce4690b666a29249539aacfbb11bcd915356bdd9cd912c92a3f2430dba047ef00