Analysis
-
max time kernel
299s -
max time network
307s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
30/09/2024, 09:53
General
-
Target
751E36D86F2F903206E38392A760387E091265118D39A256428CAE4B312FB0CF.apk
-
Size
8.3MB
-
MD5
32c0bf4fcff08cc439754ed4e79d54f7
-
SHA1
77556c54dcca1995747d1ca58d4edaf5ea5aefb6
-
SHA256
751e36d86f2f903206e38392a760387e091265118d39a256428cae4b312fb0cf
-
SHA512
bd50ef51d75fe6d6f8f35e961668a9f2adb1ba1fc798cc4023a878d66cff3a97c843346928e31bacbc91e26aa00043d19c7064c1f5a226b7c6634bbd0400c93e
-
SSDEEP
98304:FhBlNYEzf6wj7KRspPDnQmkJZDb5iSRGZ2VK/G4JKJCkC:zBomfdj7KR0DQmkJJbr9UOqmpC
Malware Config
Extracted
octo
https://520865f8baa00f539e6958472424bae2.com
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dcell_volume421⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1012B
MD532095d309c495c91e88e334739ed2ce4
SHA1f50a573cd48612fe56fd03dc84c8473ba56ee3ca
SHA256fb09025c513eeb9dc57e51e9b068d5ad83c9ea6963fa24bacfd3b5b263a679fc
SHA512a4c2e21d0dda6bd058a1eba38fa3ab6ac13a65498250ba8f8408a3f398963bd92739076be1a42ba956481b63f93d73d62271bb03b70e6edb4903a2f42b9fe54c
-
Filesize
1012B
MD5f468a01c5add684e9b7780a2f11c569a
SHA1d4172c518cc9883ae92fd5bcc3999f72f31eef7a
SHA2566859893e71ab36c05e5709e0d5134e224055b818d88fa4257c521bf3e4d8ff2f
SHA5126c11f27852de2ddec3df66709ff50f637da7f8e2b0817f31caede3d32cbd3709525d5490febbc3f207589bb93f8074bab6f76b09fcfb40b4e3bf1891f759fef0
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
473B
MD56c2b2b76ae78be1b8b4dc42e850373df
SHA14002119c04f6a816aa3797c7fbc588f4ca4dcd2b
SHA2568f58599340968a14690e3494afae447d6ef9cfe70ef79c901e780427cc4cf05d
SHA51261e1a1baaed151b6afc47a1647641e6adf9e6949ed61ffb8909d034dce6df1203db9792e8da21498b082c7d7fb2176bf1e0be42db3ad47640f361930cb4155b8
-
Filesize
525KB
MD587579306477288e8bdfda7c30138ace0
SHA1f1d51485f9f95c57ff362ef7d2afcb333cbd1b31
SHA256fb1be6ea55e2744d049b7c5bde71314b51e0926e859b64ad0dd4d2990e4bc7c7
SHA51227347feb6274d1707d925599d72106a9e5ac1e62725b97df8f692b9d4aada2cdc0577136fab07d5607ad4f972dbbca3a3f4d748eeed39c97a2cfafefce6f9bdb
-
Filesize
1KB
MD5009e24530882f2f739ff7d772d1cb240
SHA1cb2cb8a5a92b7d63306eb2d00bc01bef68fd9da6
SHA25662b6d21b8c914a006ff007aeb817304693488549bf74cb90a57e930b09f45917
SHA5127c06e2f65122c3f453d7a3d68345d28b7c1c6c3e0ab102f3fa05d7f9a52c9a7f08b4710ff65e5f13fe98fc37a3aa988d6edddaadb78feea4ac056d90a3e838fe