Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
29-10-2024 22:10
General
-
Target
0b91df5b8b86b91f84407af496df310820f04322bff3c17fd33eb78565fdc972.apk
-
Size
576KB
-
MD5
49953fbd7d6a3ef9f5070f6e40c3f8dd
-
SHA1
8c6a413e2cbfb8410d9393757e0465cc6e5effa2
-
SHA256
0b91df5b8b86b91f84407af496df310820f04322bff3c17fd33eb78565fdc972
-
SHA512
b1b636a743b8e04e95dedf7b0bad8b453a1f011c0d491cc125d258d9fee1b069ffdbb946295e7eaa96a5e71a0fe620b3887baa2cd3bd1e8e719659f8de4057e0
-
SSDEEP
12288:fqzHJaTXcCRdUl1e/iQlordVb/b43n21rSl2fhh5WiN1fyMmQt2qnYQNjP:fKARdts5VbTq219wW1tF2qnbNjP
Malware Config
Extracted
octo
https://maradakalman.shop/ZDUzODlhNjExYmFl/
https://marabalardanken.shop/ZDUzODlhNjExYmFl/
https://karamakasa.shop/ZDUzODlhNjExYmFl/
https://karamarabad.shop/ZDUzODlhNjExYmFl/
Extracted
octo
https://maradakalman.shop/ZDUzODlhNjExYmFl/
https://marabalardanken.shop/ZDUzODlhNjExYmFl/
https://karamakasa.shop/ZDUzODlhNjExYmFl/
https://karamarabad.shop/ZDUzODlhNjExYmFl/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Octo payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.beginhigh191⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD518b183a4e344ed38af065d54b82fb34b
SHA129ff8dd18ce901e8d3ed82a2baae1ab49dee806e
SHA25683b205d23f00e2b88a712ac3148b5c81069762d2aa09a25df4adc37a2665cbc3
SHA51251b0167f85b1bcd9c522640f0e6131a13db400174b58376ad9fe90b0fdacccd9eb9ac3bf8d761c136b85c5b943f3005932d97d46ab3f5cc65532db6aea6d1484
-
Filesize
435B
MD5e4667e5e92f9f047f3ba3e470406efda
SHA1c9b90b4e7e5371d6e5c1749c2929ca9c0524859c
SHA2564fabfee887231492d08e0e620d73437c3209468b2914d2fd8b0c519290d278b4
SHA5129c463b998b549b313fd267ffc4b0b112c834563ff02de9165340c9681bdd6804b2cc033b01b4b3cf9775bb4a2a7f1bda91d1ccb23522d99b0cb086613cfed43c
-
Filesize
1KB
MD582ffaa7ffd4e8a05e7ebf81cd83084f6
SHA13bb941e5f8440125209cdb670c2ba94e7697d267
SHA256274b4645bcd3c19ea8a73834cc82450b3365f7c9e5714df96894df1774293b49
SHA5125799c55e8e0f019db1320d19023a405436700a6f723058367d1ef4826d390f27aaea807d33aa559839625186ac4e33fa3c690f9744264b457ecad51278cd5af9
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
230B
MD5d4dde32da65354c0711dc5fecea6e1a3
SHA10a2272063e1e3531893407c175c8ad49b2b22b5a
SHA25678a24382d88d229ecd3ab091ec40b0c8806d37b919932e8f3960c542d5437446
SHA512097372249745b92e8cfdf57f6f61d2dbe73f14223e997ca4ed5f96896a2aee15e2e00d85a2bb95899ba65f42f288fa68b5a500948f917d30f07f015762118099
-
Filesize
63B
MD5c6cdea16e01332263831d6b606bb6da9
SHA181140bd0753e7d24f0d1908a3a3595d90473efa3
SHA256dae3ec79068250c1a59cbb3cd0ed0471f4adc2971a052fc4ca56527a3fc9a85d
SHA512a27d53dae93401e2a12f125c758ad50853525a622786242f9c46abdc8b159971613fcd0165374b06e9ee6732ea6b325449f4f9d29bd8916a67b3a13264388f40
-
Filesize
54B
MD518a46a05b3996ec414f2f6de366253f6
SHA1c3d7ad65d693a60d0d573edeb0608e8d464099a6
SHA25613ec142d7f6177574b0989127b0f7b62ee96f6472408a3dd46ea11c4845d290b
SHA512bf094955aab0c7ec1809556866200667825722d2f291b1086986928ae33af4ff269fd8ead34d8711fe6c9ac67287abecd782428bc6a6a014e812b15d6e19a8a5
-
Filesize
423B
MD54287dbd48f43d90bcdb23af71f47b7b8
SHA1b6c21755b3fbc2f412c7fc3681b60e0205a47bbd
SHA2563de276bff2b04edf01be847bf16051f8e55021009fa44911ac62accbf6552e68
SHA512e3e8776102c8a9bee9af5b8602eedbf5b58c86986ab31a32d67e9cafa4a605b1b557b329b2cae3ab99f2e8aaf233849f8a269472528f031807235207f8ac6951
-
Filesize
2KB
MD58d07b626eb8d8d13bbd92a8475bd6685
SHA19bdb6ad46d075da0877f4f359b238ee57a8a40e1
SHA256a38858cdae7ce92a43bb126e034ce4a19e649acf02159a1b2fa2e6dfd6272dd7
SHA512e642dcef8eaac5dca708d170e6715f8e9ebc8546fbdcc5cf64bf830ff1a62ab7f9db878fe7d2fa9858e81e7fda5099a3e87072c544330893c3e4e96f949c1c64