Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-11-2024 22:16
General
-
Target
9056ea7d090647e02f1824915a7af8d1ade92aeee246a59f97c409d9f9e1d05f.apk
-
Size
3.8MB
-
MD5
0c9cbb06461003b9f41c76c91ab0c0c5
-
SHA1
2d473e68131e62a45cf7db3aa702ac4548592819
-
SHA256
9056ea7d090647e02f1824915a7af8d1ade92aeee246a59f97c409d9f9e1d05f
-
SHA512
cb28fa49e999a62ceaa7b514a90f0470b29142d9f82b960832cae84ede0a7600df84b65dff765af2f1fec0212d1144d44382f93e13d0c18e4deda8a0dc44611b
-
SSDEEP
98304:lMmoZ+NjKHItxtrZE2h5EmDQRaA2+EAGXWXuRN4tAxP:lHL9f7MT3WCEX
Malware Config
Extracted
octo
https://93.123.85.21/ujjwal/
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo family
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.sonnokta1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD56311c3fd15588bb5c126e6c28ff5fffe
SHA1ce81d136fce31779f4dd62e20bdaf99c91e2fc57
SHA2568b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8
SHA5122975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6
-
Filesize
245B
MD5d398a7865adb762f4200efa5e71450ae
SHA13439a98c097a481008516b0a9e75350b70aa3acb
SHA2569906795459c832cca0db0986b63de357e6663dd5bdeda9a5934d16b0b1c82a35
SHA51217cd7df3d21cdfea4e888eb3ff571951f9eece0304c4e79d37cd38285b5eb7b153704d7e1d1768cdc1c88f29fc3af9ede67c872a378ac7ed0a728c66dd6e8169
-
Filesize
71B
MD5b0b5b96783868d5b38d028fc3083fdb9
SHA1dddfb605c0494fbbf75eb196e563f3d2ec28a45d
SHA256dbea80a3e0ce5b9ccd5f8634f0f2761c989e6af635d65198ca6dc3871435be9b
SHA51225942c8826be4d9febb10df52271ded0abbbe186e3903647ca3c91bd7f53044421b70922abf11deb8e53f5421c774a164d9db33e074ee9380b825674030f3132
-
Filesize
83B
MD57e34413f2acefaae6b523bcc5d412573
SHA1d771e8966519c324cec999c0eda7847850136911
SHA2564175011291ec8341db525e775af926ea29a98e7ecf2065d9bebb295188588068
SHA51260f71264ea716c5dc89c718724a43635a2544963c9e2ccc4b4d71d914163b00842cfb291c56443ce16e9ad64e0fac05a24300e4b278419442ec4bfdc6b54bf5c
-
Filesize
88B
MD5e2ec57437cbf71cf927ffce2e6f08eb6
SHA13a1d870563f42667523f850a3bfc2b2d2e509912
SHA256887fb065bf999b974b0bdfe4b803c4fda2ba4b0317c467e46de40a35fd3d2a9e
SHA512ba16fc21c7ac9400fb515a672dbc7493e2d49736ac88d4172155b3bb47011b7857a73c7d116b6983be2217c36e7cb51f5eca52e43771093e5765eeba1a0ac7ff