Resubmissions
06-08-2024 07:44
240806-jkt7watclj 1005-08-2024 06:12
240805-gx86fssfmf 605-08-2024 05:57
240805-gnvlpsycrj 601-08-2024 10:08
240801-l571ksvfrr 6Analysis
-
max time kernel
189s -
max time network
335s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
06-08-2024 07:44
General
-
Target
E-IFADE-VATANDAS.apk
-
Size
1.1MB
-
MD5
bc5dc768e5d005ff2b8e0ecdb84fe048
-
SHA1
cf87b335e4b086f03dfa9e5d8e129844584b7601
-
SHA256
9bf9b54ff34459ea77c1d3c849de9bc557b40c9a13ac9e20254eaf1569ceb05e
-
SHA512
5e23581beb23eafb9690ca58045271dddc68fab72af4b34ec6c41bdfbcab15b04fc0abd9977f93bd7cdcffe5ac606cd9bc9d82b3dcd47d210c7615619746efa9
-
SSDEEP
24576:l6m2oE2rOjocdTq1P5KnU2UdHD9aIWzeNZHhO6G24+fZfjHo2qnO:dE2r9cdTq1PiU5D9aIW6lO6G24+fZLIU
Malware Config
Extracted
octo
https://104.248.139.201/MDAyNTg1MTVhMTA3/
Extracted
octo
https://104.248.139.201/MDAyNTg1MTVhMTA3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.beginhigh191⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD50e61a147862f80d05f98cca723e6121a
SHA1bd2e9c5ad3fb953e2ff2935df27128d9b39b7214
SHA2565fec3818bed5c62b8b417893eef7cf47254e4ec81193e670bb9a601df2850213
SHA512782bd75b66bd229e89e07b939c38ff7e96a423cc957703643a3b761e81f9dd26f52038ed3bb7475663fd77b838a5d53588fc62937111aba4aaaad94800edce20
-
Filesize
411B
MD54760545ab0f4f399aca992062b34cdd3
SHA185eeadca03354b7bca40a3dfe2995a3629daa82b
SHA256aa99fb74f96b74d9e5329bbba3721c36ac961e59f48381f73e77bba98f5ec0e2
SHA5124aa8336fa8ed1577b56c96ff2905f3fadbc38bba855c31f55e69bd19959952ae5fe8a33b922f0d363c97f1233ee7926a038af6c8f7be94551890c8f8933108e2
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
68B
MD5bdab2b628c1fee7b2ac0d75582918567
SHA1898bdf20ffd244c72e049749b6c8e484b9837deb
SHA256584faa95313b1a7b7c644b6a972c63fd8b7c9810b9915c91e06682bf22d184ef
SHA512b46357569a4a1a864240b7fcabeadec567c6a7a056f9d705a1c9c422cb4067a8a4cf1df036ef46e8c75409523897f144b926a93ca643ec1ac79acb3d87a1428f
-
Filesize
76B
MD56aa9dbbcba87b0b071e8a856dbc67b3f
SHA114d1f53dfc81eaa5c0cdf20e9a504f93707a78a6
SHA2563eb2249eafa9f445f320eda362e55eadbf8ca712828058a52a579ae0f5ba4675
SHA512805f75b7e2d10eeff1302443f23f81ff4d4b2547c4deb8ba02a4dbc6e105a49abf26befca3aba050b191c908068cb1709cb22babaf70f8b06b1e73c49156c11d