Analysis
-
max time kernel
148s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
08-10-2024 22:06
General
-
Target
3f2a044a9bd1842f15932e56e8f9c8503d5728b7dfdb29f5f197118eeb16766e.apk
-
Size
509KB
-
MD5
d1ed1f5a91b581bdb3c66763fc269ef7
-
SHA1
9c4576551a6460cf083eaba6d50d5b3b04f87b49
-
SHA256
3f2a044a9bd1842f15932e56e8f9c8503d5728b7dfdb29f5f197118eeb16766e
-
SHA512
1daee51776fb02b74ef4b7a0c46c124e0a37bdc67aa3fe2bd7704b137bb93369bf566086429f861ef2509bef6629e48d19458b1cc5ab1a6772c349d76fe53506
-
SSDEEP
12288:QaTNrWP5b1N+9JI+PvK9VI9715xHB2WkLeElptNEv/+qm4Vg94Y:Qwr8v+v/K9cbxHB2WkLeElLN7qTVs
Malware Config
Extracted
octo
https://46.19.138.93/MmM4NjczNTUyYjAy/
https://primesecgate.com/MmM4NjczNTUyYjAy/
https://1primesecgate.net/MmM4NjczNTUyYjAy/
https://2primesecgate.xyz/MmM4NjczNTUyYjAy/
https://3primesecgate.com/MmM4NjczNTUyYjAy
https://4primesecgate.com/MmM4NjczNTUyYjAy/
Extracted
octo
https://46.19.138.93/MmM4NjczNTUyYjAy/
https://primesecgate.com/MmM4NjczNTUyYjAy/
https://1primesecgate.net/MmM4NjczNTUyYjAy/
https://2primesecgate.xyz/MmM4NjczNTUyYjAy/
https://3primesecgate.com/MmM4NjczNTUyYjAy
https://4primesecgate.com/MmM4NjczNTUyYjAy/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests modifying system settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.seecause81⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451B
MD5c2bbb279add58cc2a14aa18f54a01357
SHA1abb7a415a24b8dce553a7c5cdb77118fc82f3c62
SHA2569c11e6c6c40638c489d18b08ec4829d34f137cb5feef53b7c5007bd7941ae00a
SHA5129a19551de82bb8b35af8efc43b965c2991ec173a89ee8bd67e4101c549e87503c66362e454d0edef283ade06ed78751053a684c56d9b8227d8a95381cae8bef4
-
Filesize
449KB
MD50aa16ec6037288118aa4cfa197abe399
SHA1b38c5c170100e70151dcc2d008f5a2dba78d311d
SHA256f3646151ed3265561782d41d52e55402a526f852d546afe5cd78568d8aeeac0a
SHA5120efdce4b58f05fa6e93c1b9905432ad7b8a1434894a1261a4dc4ed7da6e1494c783dead43a8ca076eaa2ca3faa879ba65334d05777246d399ef8c2df26fb90da