Analysis
-
max time kernel
140s -
max time network
144s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
11-10-2024 09:16
General
-
Target
339c5d83068577cb1f37c15f0fa1a5e57d813eb4b950ee3fe2c04769a97349c4.apk
-
Size
9.0MB
-
MD5
96cbf811730ce3ef8e36e7679903415e
-
SHA1
4149b44d9e75f74e5ef0f32f38087d49c8fca44a
-
SHA256
339c5d83068577cb1f37c15f0fa1a5e57d813eb4b950ee3fe2c04769a97349c4
-
SHA512
e2d6581bd213e40fbd7113533c17170cf03bee45d8ccc126ed23a14fd2789d14acbad059bfb5f7f7b12370df1fd27c1dfa35195ee9e03085764e91d2ad4b13c3
-
SSDEEP
98304:Cj7ox5iSRGxAVKJ59wjcRgUB/97jgsWDVTij7URslaAu62a0T:+oxrDUFwjcRgNOj7URxAGT
Malware Config
Extracted
octo
https://a9a55d66ccccbb4307b1615730d9b8eb.net
https://0e97556072acd897b127d53221a49ecb.com
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dfast28cranehanded1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
1010B
MD54e5efd5a2746191264758443b5cad0ea
SHA1275d84b4cea3dcab252808e2ac31f6408411225a
SHA256995e6459704d943b5290088377fe4b7e8a98abc869aaa909d73da3d3eb348798
SHA512d48120bb0be815ec0923f181efb5e3775df9b672ff1e60492a2a3ed89de05fdc36faebda87f64842fa30ec7540a8a945234f0ec571700b20b77dd52201b7cab6
-
Filesize
1010B
MD515aadc85110133da520860a9b8f7bc01
SHA15261c36b30119e23881c7e7ca26a1546726f9c01
SHA256fb4ee1031d14de970212bd0188241ecd279ec087453afe9171b3eabf5bf5e9e0
SHA512766b4bf9b036560686eb4c45bae48307423edbc6647f39508799fb3b1900e4761e29477c54ae5556b88ff59cd3f5b17a4a60faa64498c5a32bf46ecc6f30707b
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
Filesize
293B
MD5fcb1ae3242921344e00e7f59c469f322
SHA1da95d0288391d35964f748eca97361bffa58f1a3
SHA256d4e062da73d58d8f9a60c4a206d567f5692a7e176edd81574f33ff9d3d4e84f9
SHA512e272cd03cb76d0ba10b6e6edb471ba9783c9fed65d359fab68bbbaddaccb6c207c5c0b2498805422afe55bec6e02113ed94cfeee7cce2a96f748307b81a0a2fc
-
Filesize
526KB
MD5d2dd8f6c5fb586e758557103bf77c3db
SHA1c5e085bfcaa3aabc0ebe072037746a40676b0bba
SHA25689fb18cde7c823198030bdfae29ec91a124af0c885f0bfcf0bc7093a56576a58
SHA51292614919a700e3caadf9a2d49d418b22d5dff042735790b80ea15761e22e6ce161fbc2d26fb80d3c4266299b0662b22acbc9623d19d8972ee0cbf911d4f0eeb9
-
Filesize
1KB
MD59954e705e0a30eb7b52adb8a5bfe7aed
SHA15f00bed61a0cb2670c383a392fdd20473a632385
SHA2562f53a0ce13b29cd24866b6b6172d2fb8e283f1d3f9168bc119906693a8748126
SHA512aac2ad11bb1a0a5ecb105d5ca0eb3f00b7b88b7625da265ab953fc4b800a18556beae4e067d4b0a68d4cdae9842df8c50c9f28b7afb13402ab724fc133576b31