Resubmissions
06-08-2024 07:44
240806-jkt7watclj 1005-08-2024 06:12
240805-gx86fssfmf 605-08-2024 05:57
240805-gnvlpsycrj 601-08-2024 10:08
240801-l571ksvfrr 6Analysis
-
max time kernel
329s -
max time network
332s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
06-08-2024 07:44
General
-
Target
E-IFADE-VATANDAS.apk
-
Size
1.1MB
-
MD5
bc5dc768e5d005ff2b8e0ecdb84fe048
-
SHA1
cf87b335e4b086f03dfa9e5d8e129844584b7601
-
SHA256
9bf9b54ff34459ea77c1d3c849de9bc557b40c9a13ac9e20254eaf1569ceb05e
-
SHA512
5e23581beb23eafb9690ca58045271dddc68fab72af4b34ec6c41bdfbcab15b04fc0abd9977f93bd7cdcffe5ac606cd9bc9d82b3dcd47d210c7615619746efa9
-
SSDEEP
24576:l6m2oE2rOjocdTq1P5KnU2UdHD9aIWzeNZHhO6G24+fZfjHo2qnO:dE2r9cdTq1PiU5D9aIW6lO6G24+fZLIU
Malware Config
Extracted
octo
https://104.248.139.201/MDAyNTg1MTVhMTA3/
Extracted
octo
https://104.248.139.201/MDAyNTg1MTVhMTA3/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.beginhigh191⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD50e61a147862f80d05f98cca723e6121a
SHA1bd2e9c5ad3fb953e2ff2935df27128d9b39b7214
SHA2565fec3818bed5c62b8b417893eef7cf47254e4ec81193e670bb9a601df2850213
SHA512782bd75b66bd229e89e07b939c38ff7e96a423cc957703643a3b761e81f9dd26f52038ed3bb7475663fd77b838a5d53588fc62937111aba4aaaad94800edce20
-
Filesize
460B
MD53f17e680c59033d3a0c4d6c34f4ffc84
SHA171938569b6e0861323bca6f9bd82473b60ae1a37
SHA256f2c54eb2a8636a1d125c7ebe9971175e567b4bbdb60e44c3864f60f3cce42b4a
SHA5121409be4a0978adc9449bdcf52baaacd94bd3c665c1e9791832cca0ab734c27ff5af3df75e7a03ca090d0c3571881c8ce1f7968dc17451c8e90e7f4673f4ea2ff
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5b246002e07a2b49b7b87868cd1168492
SHA14e4b1c9cde03f420d9a263c309aa5b85b5bfe2fd
SHA2565e7b02b64b80209e592057baa23195dc9ab5cf47eb4f6c6527e8f6c8413f4114
SHA512f6eca643a48c24a612741315cc7363f8741b3de0f012f9e5031afc0f0f80345626e05b6c5b587a7c2a58e5ab6c66d683deec5e9d22267636537d3cf7f6951f04
-
Filesize
63B
MD5bc9778a18b1bf532149956d6d98a69f5
SHA151b71d96cca9cf6f8eb26798ad354875e121d6d0
SHA25663ac5006acbdd7025554b34efd105cd5ac5784ad96bc2a6d6f7409be82c9e8c1
SHA512e3e105b8aa93e6016e39dd32392965901eeb70e3752825fbaf108dad5b481aa9b3b400df492bddcdd65bd6a75efaeab3906e27abafe49206e25d8477511ab169
-
Filesize
54B
MD57002711da3616a8cf909bbda8f000bda
SHA1c636c1abf0a3439009327a10ef5a94af25a795b9
SHA25686fa850086470462f20b50980ea81a86192bd84efc9da62aadd813818b9a0058
SHA51286fffb8a5fe8de58fd3457a79f1238276a46a7badbd49a9e019eb96966046f3857cddc9da31b31592961185668e2ef248c4c4633a314abe8be15c9dc9774a01f
-
Filesize
423B
MD5ffec97051bef959036626242d00e2fbb
SHA169b3124a812b24b528b4642e6132d6070ce50bc4
SHA25620aa1275f4b6093c7a984c5d4beda37375d08439adab5ae5b5aa577b9d641e84
SHA51263717eeb88926a69ee51a7670a6782707414db6c22c25d5138bca4534ae3d5bb2d70defc75bdf1da7037e3a12d348ff652de842612eae58fcfabc1e7c47c565d