Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
-
submitted
13/09/2024, 22:00
General
-
Target
79744a092f856deca058c31a51c89c3cdd63f37d3c69ba1cf79963a0ca0bac6f.apk
-
Size
561KB
-
MD5
c949272f6f9498670ee54e9595c07f9b
-
SHA1
0407d2b325c1c7f51c55bc57bc2f746001dcbce2
-
SHA256
79744a092f856deca058c31a51c89c3cdd63f37d3c69ba1cf79963a0ca0bac6f
-
SHA512
57bf6c35ad67f1f8819aa0cbcf6dc78de44731f04be1e7020faf561fd7cff4046bc6c849adf69d9d7ed861e48f69927f08b96d7019745dccc64db629c8f03b1f
-
SSDEEP
12288:gSAhwk/jcrvvlwO1cPnUXEcSadfuD01iXjcMRbgFbPLJRlox3eMZdRHu/A:gSAhwk/IrvvlJc/KEIfuDgEcF/7alemH
Malware Config
Extracted
octo
https://b2iribizid7urdursun2645.net/YmE1ZjViODYyMDhm/
https://yedekalandi2324141.com/YmE1ZjViODYyMDhm/
https://75biribizidurdursun2645.net/YmE1ZjViODYyMDhm/
https://75biribizidurdursun2645.xyz/YmE1ZjViODYyMDhm/
https://700biribizidurdursun2645.xyz/YmE1ZjViODYyMDhm/
Extracted
octo
https://b2iribizid7urdursun2645.net/YmE1ZjViODYyMDhm/
https://yedekalandi2324141.com/YmE1ZjViODYyMDhm/
https://75biribizidurdursun2645.net/YmE1ZjViODYyMDhm/
https://75biribizidurdursun2645.xyz/YmE1ZjViODYyMDhm/
https://700biribizidurdursun2645.xyz/YmE1ZjViODYyMDhm/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.leftpassrr1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD533cdedb03d44e888d030e2a52e6f04dd
SHA1cabeb07cd47b37469ae7f35500e8e8421bee3fb7
SHA256c93282d295487bb491c54e5da572a4f46dea1347098159de735b1ab31dbead59
SHA51228e9e9ea55bd17f31531b9665b77b41be5c49c1dfc6777ce1bfb7474c7d4907173a5b099461dbb9686ddd8e5c83b3b990648c41608a30215d4e002fb6bfb2bf3
-
Filesize
383B
MD5efa48c92ae4d4a2cd23196b73867d9f4
SHA1ba26f587cffadc02082f683d6a7e5da96a1462e5
SHA2568d83c2cf5caf32b4a0dc4742c673b45c877ad7436ceff96c158ac42aacf8cace
SHA512f9b0c221d314525adb4d774f117c398157ad28e5c9d8a46eee6cf7458241198ebf3814a791e69c04aa97d7e6fa494e5942046beaa548c23e1d1c51f6202ccee9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
219B
MD5a566f26aa1db5357fd514be2e974239c
SHA144840db510c79d904680f878ecc718b126170d62
SHA2569014d2e9cec5be2cb05649f2bd4c3193c3bbd52018e1d38bf7521b982bd906ab
SHA5121490adcc9f1734d8e9de093be095e75cbbbeebc44dfda90eb90f0551721d5ead7dc45395021493b3e8bee7c4ac1cf8205791594de84dda482549e3431f65d9e0
-
Filesize
60B
MD5466c085b14f6efc4303535f0a0dc0973
SHA161b80be430a41c79a644cdd720f0412682a9afcc
SHA256472f2e5018f0b17790f796d2b5f617dbd6c262855b2407772852091b965188ec
SHA51215a4400702835cac87a2b1ed9d87c406b3aeca5782b0ddcfe23e2d417494193e6ba1929b7b3241a686c98040776f500f769b8170978475700c1f721eb0f13132
-
Filesize
70B
MD520d97692c6de59ddc44c52609fb44951
SHA15d95ef992951660c0ad1b701b2683bff9c097867
SHA256b315d86c8724fbae6c9eba1779cd2bbd4ca4570ddc8177d37363539ea0e53d60
SHA51298da2fec71254d596c542215445f2e18039fce8ea8f7ec44ae74e7a3709d4dfe6236981e810517dfecde3013942ede87979ba9e98017f27010d4bbad3936d361
-
Filesize
84B
MD54c25f5b2749a1f5774d749323f976669
SHA1d06d16b45e2625bb9346c8ad60e6c0c5bb26db03
SHA256cd52ea28e94b29a7a1932b809723b611334f54d116e6cf64991c289a88c0c932
SHA512b06127f47123445308e4d00fc1f33d291793bf3d976e59a999f730491c29b333c3f62227b2d0e963483408c139f3eaa1c1d8120eee8550769f79900324094c59