Resubmissions
05-08-2024 12:08
240805-pa55aavhjp 1002-08-2024 15:48
240802-s893nszfkj 1003-01-2024 17:25
240103-vzshdabae6 1024-12-2023 19:17
231224-xznwasbhh7 614-12-2023 08:27
231214-kclffacdhn 1003-11-2023 03:07
231103-dmbwesbb4s 1001-11-2023 22:00
231101-1wx7cadf5y 10Analysis
-
max time kernel
329s -
max time network
334s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
02-08-2024 15:48
General
-
Target
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc.apk
-
Size
509KB
-
MD5
60609814e43a1c814b30435f15d361ed
-
SHA1
61431ed485c98b8a291e289a7e17e8d3e6db3660
-
SHA256
b38019f9e80c2166a4e09eed0cd15bad651263f0ff3ea26199a08896ffd8e1fc
-
SHA512
8efba5603fd4217b9c9c96e28a69f9f262568f76d43fd959d6914694808488f089f01fa92e2d04f44d5aa0859efcfb34fb080dc7b3a49502469598ab90a662fe
-
SSDEEP
12288:KwGWfjEhy4pNodk6TZFo9nheT5BQ4YvnAu:KnWf0y4GNIsmRvnAu
Malware Config
Extracted
octo
https://84.54.50.100/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass2.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass3.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass4.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass5.net/Njk4Zjk4YjdjODY3/
https://pakuxxxnatationclass6.net/Njk4Zjk4YjdjODY3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.broughtbluea1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
463B
MD5fc86d0221570cb0157f92c4727902b23
SHA11d46b2700a14d2700f018c2d3f9eee2c7fc0152f
SHA256a6b39a5f8b140a252d1dae9cd658efb56ea663049df5a685e5aa5db21d5a35dc
SHA5124b3a6bd2fb56839c9c782f269e385a3f02445dd1cc3eaa5ad70140274e2299b746c757d381ac0efdbaf4c2d996618dc98059f6b0cbf85c2011119cdbab2ce6bd
-
Filesize
491B
MD5d036ff031b71a936c11d0416ab65566b
SHA1babf08b7ec0f31776b0fd3a9f5ff0b5778802ae7
SHA256512df5ea038216c33499ffca8dd12b2e09e3a3158467a2541798588e4424fcad
SHA512b655fbc2004c352a3d5140cf3a0bda446f572b1ffced3eff09487c5b75dde3ff4c4f090a4b678e7998e2c685df1bd9965c30330aaa8f73c8b1525be0debe4961
-
Filesize
449KB
MD5fb15ea8794c6547c5ca8f58577e433a6
SHA147c530ac1858cbc7584429190a07c3c4313857ac
SHA256908588c8de2b52b69f30917583d91ac67f96c7682c017df3943d3979c9fc6095
SHA5129cb724a385917e949052b84be546cd61a952474ee8671743034463b356de4c5bc60732b07287c326da65c4cced7f8c8247b348bbb5abb436c86fedbcb4da90c9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5a83ecdb86deadd47e92368814b07c944
SHA18e327b10a097a9a26bb6c892a73ca55e34fa3838
SHA2566984bb6286a63a5c0385c5ddda1a3e59058374c25676abf7a77ed71f69b121a1
SHA5123238fd9878c4fac61bfbe17a4650a5fa7270e7b2ffb850b5c2102335671459a0837903d89673d382dce715ea07e8524c4de00a664612fad973839d26f8fbbf84
-
Filesize
63B
MD513940fdda24b04dcaffe3563ba37ca8a
SHA16d93252a2c49a2a60915004d64fac944aa470cdd
SHA25664581b00e369d22d1cb1a1738d77a84bd4584128a20d2a2357d991f37ad15abc
SHA5125449467d2ad040fdef46d74e65f0fc0551435f9d29ba7677054af576c64c298616d04ed2d7b1922d1aeabd6019df89ca45022151e98f3c56afc266b98ec2fc90
-
Filesize
54B
MD5e392c24da3880b1b871597ca46bec577
SHA1c38e7a6725df93dbd44093c092b77633601d4bbe
SHA2563ac76dfeb9f648a56309b0aba02f79e148f1ca7a98aabbbbc0e1b5e20b3e0946
SHA512f194ecda02d4bf17e25284980cfa6a8306d9ff020c145de8a12d83598a7123c219a6c8c372408a24de44b57bf35632f65cc946eb22d09dc0c6616f0827e0ce4b
-
Filesize
423B
MD534c2e15578f43af04fd1d037d8f00a54
SHA16c854ac92bd6e80101f8fdba7f1302cb022040e0
SHA256ab41a82cb9fdf404bbb9773382e5e8fed639d26ac25079001ac17985c4705d7d
SHA51202547d164549ad0d8e45c636a5c61400341fa9515967f9371ba9a22ac7e1cd67563a7185e848b83af89c89820bbbf8bd1c1fbd841a6e62d82b0e39b8ca8ca3eb