Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    15/10/2024, 22:05

General

  • Target

    a282a58cf5458b38ba204faa3974c4e96dee4ae09f7d824167fec23593e4ae43.apk

  • Size

    509KB

  • MD5

    7bb8f82efb175a8b8b6628c2e0468065

  • SHA1

    f69c53e22cc3f012c7d5a68a89cd1f0d037e601b

  • SHA256

    a282a58cf5458b38ba204faa3974c4e96dee4ae09f7d824167fec23593e4ae43

  • SHA512

    bcc65f2ec0408b6324b1abc91a861e1a0fe2f11c01a5f99dba01c45377a520787a7af6fe8822849e94f3d9ad2933c6301faa49291981cb5e972b239662d77f47

  • SSDEEP

    12288:IEn/M/drAv3SHh+0q9izKSNB2NKeV/ykZtBJ4WDne:IxdrAv3kh+59izh2TlykZp4WDne

Malware Config

Extracted

Family

octo

C2

https://94.141.120.34/NjNhZWUxNmQxZTcy/

https://pethsop332.com/NjNhZWUxNmQxZTcy/

https://2pethsop332.com/NjNhZWUxNmQxZTcy/

https://3pethsop332.com/NjNhZWUxNmQxZTcy/

https://4pethsop332.com/NjNhZWUxNmQxZTcy/

https://5pethsop332.com/NjNhZWUxNmQxZTcy/

https://6pethsop332.com/NjNhZWUxNmQxZTcy/

rc4.plain

Extracted

Family

octo

C2

https://94.141.120.34/NjNhZWUxNmQxZTcy/

https://pethsop332.com/NjNhZWUxNmQxZTcy/

https://2pethsop332.com/NjNhZWUxNmQxZTcy/

https://3pethsop332.com/NjNhZWUxNmQxZTcy/

https://4pethsop332.com/NjNhZWUxNmQxZTcy/

https://5pethsop332.com/NjNhZWUxNmQxZTcy/

https://6pethsop332.com/NjNhZWUxNmQxZTcy/

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests modifying system settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.thatfall4
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests modifying system settings.
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4474

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.thatfall4/cache/dmutuabtv

          Filesize

          448KB

          MD5

          5ad7dd6a1a6cdf3edc35320563a6fb6e

          SHA1

          ad5fefa4dc35203191e0bb86473fe28e277e758d

          SHA256

          b589b9fb542ecad6507bdb9043751a6d074b7972e2fcca0bdc7400725bf14600

          SHA512

          8a2ad5ebcead354b954caee1f9a8fa99792593b020d9434c63f6aae73b92603a7aae56fa0c4e8a9a448c0c53c273996671459c1e5d1664e4bcc0f74cb12fc3ec

        • /data/data/com.thatfall4/cache/oat/dmutuabtv.cur.prof

          Filesize

          312B

          MD5

          e052aa638d2b2dcf4019480501891593

          SHA1

          4dc261c8266cf2f057bad9bbb270f812e2ce835a

          SHA256

          83b3e40016ffa24aa75da99d9033b7882fce871f809e15eb680bb4003a6bdf9f

          SHA512

          3dfab1a33ee6cb54af5e25a4aa0051c444c759e69bb7524a86e23d2a5f17195a818f75db1f6692247f3df01e160d8ab9cc5841ad4c893dc68d3a2ce5df31af58