Overview

overview

10

Static

static

6

a38001f2d8...74.apk

android-9-x86

10

a38001f2d8...74.apk

android-10-x64

10

Resubmissions

17-10-2024 06:15

241017-gzygqswajc 10

08-10-2024 15:05

241008-sf5x9ascnk 10

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    17-10-2024 06:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a38001f2d8f3c817f3579e676dd57dd0826bc7e07ab9c64fe279918da9a49374.apk

  • Size

    7.6MB

  • MD5

    b8411f981726df894bd3be20fc905be3

  • SHA1

    91a1455e833505c864c7911524a2d92bb66f6de8

  • SHA256

    a38001f2d8f3c817f3579e676dd57dd0826bc7e07ab9c64fe279918da9a49374

  • SHA512

    4006968afe1de57608235e18d2373f19374b9c2270f9d440d3f4607bdd19ce12215afd9e513d6128ff694fa9c991d3b94f7ca184f17b429bf0bee61f2120780d

  • SSDEEP

    98304:MElSb73N1O86wj7KRstD399zlZVKLnc/9/5iSRG0gVpsk:MBRNj7KRm99zXUrwxrW9

Score
10/10
octobankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

octo

C2

https://3eaeecee59236992bdd208952b783e39.au

https://9439fba008d7b8de8f77b13f0b55792b.uk

https://649561c1c64a0163240fe3b4aa9e84df.net

https://2a10fb95e85de2ec8940ffcde6d625ed.in

https://8f3935d7f12f86703cfe6634f42995ff.ua

https://0fda2d426ed8312561b8a9885a89f9e0.de

https://3c5ed2332f91eb9c1471f4b15b9affd9.ca

https://30dbb12403845fe70854f073b49ea567.us

https://29b9cd62c2d3a637943ea235409895c3.org

https://8fd9bd7ff33c890cbce381116049071e.info

https://b2823414ceb39e6c24579bbba518d081.ir
AES_key
AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto
  • Octo payload 1 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.share_applicationa19
    1⤵
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4243
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.share_applicationa19/app_business/PBgBjr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.share_applicationa19/app_business/oat/x86/PBgBjr.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4268

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Input Injection

1
T1516

Virtualization/Sandbox Evasion

3
T1633

System Checks

3
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.share_applicationa19/.global.com.share_applicationa19
    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

    Download Submit

  • /data/data/com.share_applicationa19/app_business/PBgBjr.json
    Filesize

    1020B

    MD5

    37027d1d2c87f24f86e2390229bf180a

    SHA1

    eb7db3d60b2ddc0b7d089033ddcdc82b107deb06

    SHA256

    f7a9914ec57789f5ddea4757d31ded0d0d4f1871dc53169074db83f5bcdb0411

    SHA512

    9b9a1325669279499a70173ff3ca4418c00caaf1c75df30bc41fcfb8ac9e3ccb3eee845526f559e76ed1bf4dd04ec52d50296d0fc7bdd10336eec93b9e32f03d

    Download Submit

  • /data/data/com.share_applicationa19/app_business/PBgBjr.json
    Filesize

    1020B

    MD5

    4757176b551f5bcf4d24eb4201492ad7

    SHA1

    6c85ea10c5945d41463f89aa5fc58bf9f61034e5

    SHA256

    140d5d0daf9d074f0f4109a165489aaf055d4a70f2bad038bb55c9207dc27483

    SHA512

    1bcc43430dcdcde6170bc66e139291259ff457cf7419ba5028399ecabee89ff94201241cd7fe961e59221ebff2bdf54d8f8e6795e1cf6f98b1d25a035a13863f

    Download Submit

  • /data/data/com.share_applicationa19/files/.d
    Filesize

    307KB

    MD5

    4e73947cabb5db3f92ca85004981b754

    SHA1

    6d9667fdb0280ed2dcb782b4683e422a51bdc601

    SHA256

    6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

    SHA512

    be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

    Download Submit

  • /data/user/0/com.share_applicationa19/app_business/PBgBjr.json
    Filesize

    1KB

    MD5

    aa6bd84f0e640a7db50289635c4b46c6

    SHA1

    ec242976dc9d4b93a25bcad0cd5909f19caf2937

    SHA256

    73704d7ec1445e42329ea541779bc8940247ab0a5da165cf040d9d694ddb942a

    SHA512

    f357f46686a09cd3911d961f24e6e137d197ac9e857817ecde93b620221610e480d2a4222ee93c8de7426ff8baad77f11baba983f2aaed678e11c095a35522f8

    Download Submit

  • /data/user/0/com.share_applicationa19/app_business/PBgBjr.json
    Filesize

    1KB

    MD5

    4b669b81390143cf845142e78ab943de

    SHA1

    50288112a1743d2ef9ecaac64e7eebfeb51307e9

    SHA256

    4b5b98fe5728e2d37c686b7341bfbc3cb5ea07fa2d1cf499102baba56b855396

    SHA512

    995dfa68e454bdfef2a1029fda3de9312a09656aeeba6f82f422b533a3662b7ba9947f0fdd26bcd98e9bce974e27f7229e92e7ead3581c81f57e0d8f519c8b6f

    Download Submit

  • Anonymous-DexFile@0xc83f8000-0xc847b850
    Filesize

    526KB

    MD5

    d245ba43d4cbd34f774611b5eb35cdfa

    SHA1

    a68735aac8307227b30e5bab933eddfb6bf38baa

    SHA256

    b9406de6d1af34f61af4ccfadaec06c2fe4bf93096cdbcfd774ea13c78624b12

    SHA512

    e90c1b2e16c7d2030e15ab4100cf20a37c81c0cc4ec8212058e9f5223b887be3e3036c957bfcb1878a37507ebfbb42f751c1dab06da487e946371cb01a2a163e

    Download Submit