Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    15/10/2024, 22:05

General

  • Target

    a282a58cf5458b38ba204faa3974c4e96dee4ae09f7d824167fec23593e4ae43.apk

  • Size

    509KB

  • MD5

    7bb8f82efb175a8b8b6628c2e0468065

  • SHA1

    f69c53e22cc3f012c7d5a68a89cd1f0d037e601b

  • SHA256

    a282a58cf5458b38ba204faa3974c4e96dee4ae09f7d824167fec23593e4ae43

  • SHA512

    bcc65f2ec0408b6324b1abc91a861e1a0fe2f11c01a5f99dba01c45377a520787a7af6fe8822849e94f3d9ad2933c6301faa49291981cb5e972b239662d77f47

  • SSDEEP

    12288:IEn/M/drAv3SHh+0q9izKSNB2NKeV/ykZtBJ4WDne:IxdrAv3kh+59izh2TlykZp4WDne

Malware Config

Extracted

Family

octo

C2

https://94.141.120.34/NjNhZWUxNmQxZTcy/

https://pethsop332.com/NjNhZWUxNmQxZTcy/

https://2pethsop332.com/NjNhZWUxNmQxZTcy/

https://3pethsop332.com/NjNhZWUxNmQxZTcy/

https://4pethsop332.com/NjNhZWUxNmQxZTcy/

https://5pethsop332.com/NjNhZWUxNmQxZTcy/

https://6pethsop332.com/NjNhZWUxNmQxZTcy/

rc4.plain

Extracted

Family

octo

C2

https://94.141.120.34/NjNhZWUxNmQxZTcy/

https://pethsop332.com/NjNhZWUxNmQxZTcy/

https://2pethsop332.com/NjNhZWUxNmQxZTcy/

https://3pethsop332.com/NjNhZWUxNmQxZTcy/

https://4pethsop332.com/NjNhZWUxNmQxZTcy/

https://5pethsop332.com/NjNhZWUxNmQxZTcy/

https://6pethsop332.com/NjNhZWUxNmQxZTcy/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.thatfall4
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4375

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.thatfall4/cache/dmutuabtv

          Filesize

          448KB

          MD5

          5ad7dd6a1a6cdf3edc35320563a6fb6e

          SHA1

          ad5fefa4dc35203191e0bb86473fe28e277e758d

          SHA256

          b589b9fb542ecad6507bdb9043751a6d074b7972e2fcca0bdc7400725bf14600

          SHA512

          8a2ad5ebcead354b954caee1f9a8fa99792593b020d9434c63f6aae73b92603a7aae56fa0c4e8a9a448c0c53c273996671459c1e5d1664e4bcc0f74cb12fc3ec

        • /data/data/com.thatfall4/cache/oat/dmutuabtv.cur.prof

          Filesize

          456B

          MD5

          3b8d260e43029e3e94eea7b24cc5497c

          SHA1

          5f2f87be80241ea384aac01974939c956d479e91

          SHA256

          4d2e0d18dd7b5133e106e9fd15aa31597c3f5f00ada304b00c3006681d3dad64

          SHA512

          1b61e1092acbc496d3e62be87b3c83fdf63274dd1a83af5f3ad655f96481aff7d338e35ab27aa00c3546fdee910ff60fa9cc10d03aab8ea2c9f152678a1d9be2